CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox VoIP systems, was actively exploited in the wild by 3 September 2026. Security researchers at Defused Cyber and Horizon3 documented reverse-shell deployments affecting approximately 4,000 internet-exposed systems.
On August 26, 2026, threat intelligence firm Defused reported that attackers were actively exploiting a chain of two Microsoft SharePoint vulnerabilities enabling remote code execution on unpatched servers. The disclosure included proof-of-concept exploit code.
0) — Publishes via automated templates. 5) — Lacks substantive content.
On September 27, 2026, an injunction banning an Orange Order loyalist parade along the Garvaghy Road in Portadown, Northern Ireland was overturned on appeal, permitting the march for the first time in nearly three decades. The decision heightened tensions amid ongoing sectarian divisions in the region.
Iran reportedly considered launching a symbolic ballistic missile strike on a Ukrainian Black Sea port in response to Ukraine's attack on an Iranian ship in the Caspian Sea. Foreign Ministers Araghchi (Iran) and Sybiha (Ukraine) discussed the tension.
Germany formally attributed a failed August 4-5 drone attack on Leipzig airport to Russia on September 1, 2026, with officials stating the explosives-laden aircraft targeted a Ukrainian cargo plane. By September 4, reports linked the incident to a broader pattern of sabotage across Europe with Russia as chief suspect.
Russia ordered closure of Germany's consulate general in St. Petersburg by September 18, 2026, in retaliation for Germany's closure of Russia's consulate in Bonn and cultural centers. The tit-for-tat move escalated a diplomatic dispute stemming from Germany's accusations that Russia attempted a drone attack.
Security researchers disclosed on August 24–25, 2026, that two Microsoft SharePoint Server vulnerabilities—CVE-2026-55040 and CVE-2026-63520—can be chained to bypass authentication and achieve remote code execution without a password. Both flaws are listed in CISA's Known Exploited Vulnerabilities catalog with public exploits available.
The Clop ransomware gang is conducting a data theft extortion campaign targeting internet-exposed instances of PTC Windchill and FlexPLM product lifecycle management systems. The attackers are attempting to steal data and extort affected organizations.
The European Union's foreign policy chief Kaja Kallas characterized an attempted attack at a German airport blamed on Russia as "state-sponsored terrorism" on September 2, 2026. The attack involved an explosive-laden drone found near a runway at Leipzig.
Russia announced on September 3, 2026, that it would close Goethe-Institut cultural centers in Moscow, St. Petersburg, and Yekaterinburg in response to Germany's closure of the Russian House in Berlin and the Russian Consulate in Bonn. Foreign Minister Sergey Lavrov characterized the move as ending Russia's cultural presence in Germany.
Russia announced on September 3, 2026, that it would shutter German cultural centers across the country in retaliation after Berlin blamed Moscow for an airport drone plot. The move escalates tensions following accusations of Russian sabotage campaigns across Europe.
President Zelenskyy appointed Mykhailo Drapatyi as Ukraine's new military commander-in-chief, replacing Syrskyy. The appointment came in response to massive public protests over military personnel decisions.
As of September 23, 2026, Meta and CEO Mark Zuckerberg face thousands of lawsuits and past allegations of harming children, with Zuckerberg attempting to redirect public perception through new AI initiatives. Critics on social media pledge not to forget the company's problematic history.