THE WEEK IN REVIEW

Sunday, September 13 through Saturday, September 19, 2026 | Jonathan Brown

The daily feed follows events as they break. The Week in Review steps back from the incident queue and asks a different question: what did the week look like as a whole?

This week’s answer is uncomfortable but clear. The most important activity did not center on one spectacular vulnerability, one famous ransomware gang, or one isolated critical-infrastructure outage. It centered on authority: identity systems, email gateways, software repositories, backup platforms, industrial controllers, shipboard satellite links, and cloud or supplier tokens. These are the systems that authenticate, distribute, configure, recover, or physically influence other systems.

Last week’s review described a week belonging to systems that could command something else. This week showed that command authority is being contested across the entire chain—from the operator’s identity, through the management plane, into the software supply chain, and finally toward physical processes. That is the common theme behind the Cisco ISE and Secure Email Gateway exploitation, the GitLab and Acronis incidents, the Siemens S7 warning, the tanker investigations, and Anthropic’s account of AI-assisted intrusion operations.

The practical implication is that defenders can no longer define exposure by counting vulnerable servers. They must identify where trust accumulates, where a single credential or token can fan out across tenants, where a repository can influence production, where a backup system can determine recovery, and where information technology remains bridged—sometimes invisibly—to physical operations.

THE WEEK’S CENTRAL FACT: ATTACKERS ARE TARGETING AUTHORITY, NOT JUST ACCESS

The week’s most urgent vulnerabilities sat in identity, messaging, development, and backup control planes. Cisco Identity Services Engine was affected by CVE-2026-76460, a maximum-severity authentication-bypass flaw that Cisco confirmed was under active exploitation. An unauthenticated attacker could reach the management interface and potentially obtain root command execution. ISE is not merely another web application: it participates in network admission, identity policy, authentication, and authorization. Compromise can therefore alter who or what is allowed onto networks and how that access is enforced.

Cisco Secure Email Gateway added a different but equally consequential path. CVE-2026-76461 allowed crafted email to reach SQL injection and potentially root-level operating-system command execution on the appliance. Email security systems occupy a privileged position at the boundary of an organization. They process trusted communications, may hold credentials and configuration secrets, and can become a platform from which attackers observe or manipulate the organization’s messaging environment.

GitLab’s CVE-2026-85706 demonstrated why software-development infrastructure belongs in the same priority category. The flaw allowed unauthenticated arbitrary file reads through the repository-commits API under affected conditions. The danger was not limited to source-code disclosure. GitLab instances may contain CI/CD variables, deploy keys, cloud credentials, signing material, runner tokens, configuration files, and secrets that unlock production systems. CISA’s KEV listing and observed probing made this a patch-and-investigate event, not a routine application upgrade.

Acronis CVE-2026-87886 completed the week’s control-plane pattern from the recovery side. The vulnerability involved local privilege escalation in backup integrations, with limited targeted exploitation reported. A backup system is an unusually valuable target because it combines data access, administrative reach, recovery authority, and knowledge of the organization’s most important systems. If the backup plane is compromised, the attacker may be able to steal data, alter recovery points, disrupt restoration, or use the platform as a bridge into hosted environments.

These cases are technically different, but operationally similar. Each platform has more authority than its server count suggests. Each can affect many downstream assets. Each requires defenders to ask two separate questions: has the vulnerable code been fixed, and can the organization still trust the system’s accounts, configuration, secrets, and downstream actions?

That second question is where many remediation programs remain weak. A green patch dashboard can coexist with an attacker-created account, a stolen token, an altered policy, a modified pipeline, an untrusted backup catalog, or an endpoint already compromised through the management plane.

Sources: Cisco, “Cisco Identity Services Engine Authentication Bypass Vulnerability,” September 16, 2026; Cisco, “Cisco Secure Email Gateway SQL Injection Vulnerability,” September 14, 2026; GitLab, “GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8,” September 2026; Acronis, “SEC-10986 / CVE-2026-87886,” September 2026; CISA KEV alerts, September 11–16, 2026.

PATCHING IS A CHANGE IN FUTURE RISK, NOT A CERTIFICATE OF PAST SAFETY

The week repeatedly punished the habit of treating patch deployment as incident closure.

For Cisco ISE, Cisco advised re-imaging and restoring from trusted backups where root-level access could not be excluded. For Secure Email Gateway, defenders were urged to preserve evidence and examine mail-processing activity rather than simply install AsyncOS updates. For GitLab, the correct response included searching for file-read attempts, reviewing access to repository and runner secrets, and rotating credentials where exposure was possible. For Acronis, recovery-point integrity had to be validated independently.

The distinction matters because control-plane compromises create effects that outlive the vulnerable process. A stolen credential can be replayed after the appliance is patched. A cloud token can be used from another country or provider. A malicious CI/CD change can be merged, built, signed, and deployed before the original repository is repaired. A backup administrator can alter restore points without leaving obvious evidence in the production environment. An identity-policy change can grant access to an attacker who never returns to the original exploit path.

This is also why the week’s events should change how organizations write closure criteria. “Fixed version installed” should be one state. “No evidence of exploitation” should be another. “Credentials and tokens rotated” should be another. “Downstream systems validated” should be another. If the organization cannot reach those conclusions because logging was absent or overwritten, that uncertainty is itself a response finding.

The same principle applies to appliances and embedded systems. A clean file-system scan does not prove that a long-running process is clean. A reboot can remove volatile code while leaving the access path, credentials, or configuration change that enabled it. A restored configuration can restore the attacker’s persistence along with the operator’s intended settings. Runtime inspection, external telemetry, configuration comparison, identity review, and trusted rebuilds belong beside version checks.

The operational doctrine emerging from this week is simple: patch to stop the known path, investigate to determine what happened, rotate to invalidate stolen authority, and rebuild when trust cannot be demonstrated.

INDUSTRIAL CONTROL MOVED FROM THEORETICAL EXPOSURE TO ACTIVE TARGETING

The September 19 joint advisory on Siemens S7-series programmable logic controllers was the week’s most important industrial-control development. CISA and partner agencies described active targeting of S7-200, S7-300, S7-400, S7-1200, and S7-1500 controllers. The advisory described scanning, insecure or default credentials, public automation libraries, and AI-assisted scripts. It did not establish a completed destructive attack or a named facility suffering process impact. That distinction must be preserved.

Nevertheless, the warning is RED for facilities that expose S7 communications to the Internet, permit weakly controlled engineering access, or cannot account for traffic between corporate, vendor, engineering, and control networks. The absence of a universal CVE or a single emergency firmware release does not make the risk less concrete. The decisive exposure is architectural: Internet reachability, weak authentication, insufficient segmentation, unmonitored engineering workstations, unmanaged integrator access, and the ability to write logic or configuration.

The advisory also altered the significance of tools such as Snap7 and S7comm libraries. Software that may have been used legitimately by engineers or integrators can also be used by an attacker to enumerate controllers, read process data, or attempt unauthorized writes. Detection must therefore be behavioral and contextual. An unfamiliar engineering workstation, a controller connection outside a maintenance window, a new library or script, or a ladder-logic change without a work order may be more significant than a conventional malware signature.

No public evidence reviewed this week demonstrates that the Siemens activity caused a water outage, energy interruption, chemical release, or safety-system failure. But critical-infrastructure defense cannot wait for that proof. A first successful write to a PLC may be the event that creates the physical consequence. The correct posture is to remove unnecessary exposure now, verify firmware and configuration integrity, restrict engineering access, preserve controller logs where possible, and test manual or safe-state procedures.

The deeper lesson is that OT risk is increasingly shaped by ordinary IT weaknesses. A stolen identity, compromised remote-support account, supplier token, or cloud-management session may be the path to an engineering environment. Separating the “IT incident” from the “OT incident” until a process alarm occurs is a dangerous organizational habit.

Sources: CISA, “Defending Against an Active Threat to Siemens S7 Series PLCs,” AA26-231A, August 19, 2026; NSA, “NSA and Others Release Report on Active Threats of Programmable Logic Controllers,” August 2026; Siemens ProductCERT, SSB-104599; Tenable, “Frequently Asked Questions About the Active Threat to Siemens S7 Series PLCs,” September 2026.

MARITIME CYBERSECURITY BECAME A CYBER-PHYSICAL INVESTIGATION

Reporting this week that the FBI and U.S. Coast Guard boarded two Texas-bound energy tankers after signs of cyberattacks provided the clearest cyber-physical case in the current feed. The Liberian-flagged VL Prosperity experienced communications disruption and slowed near the Strait of Gibraltar on August 21. A second tanker generated a related response on August 24. Coast Guard and FBI personnel examined shipboard information-technology and operational systems.

The public record confirms malicious cyber activity aboard at least one vessel and a serious government response. It does not establish remote control of propulsion, navigation, cargo systems, or safety systems. Iranian state media reported more specific manipulation of engine-cooling, engine-speed, fuel, and lubrication functions, but U.S. officials have not independently confirmed those claims or publicly attributed the events to Iran. The review must therefore resist the temptation to turn a confirmed intrusion into an unconfirmed ship hijacking narrative.

The risk remains RED because the architecture is dangerous even before the most dramatic consequence is proven. Ships increasingly depend on satellite links, VSAT equipment, crew-welfare networks, vendor-maintenance systems, remote-support channels, and cloud-connected shore operations. If those systems are bridged to navigation, propulsion, ballast, cargo, or safety systems, a compromise may create a collision, pollution event, blocked port, forced manual operation, or prolonged voyage disruption without producing total remote control.

The Financial Times reported that satellite-linked edge devices represented a growing share of maritime attacks, citing Cydome’s comparison of 2025 and 2024 incidents. It also highlighted concern around common satellite-link equipment and the expansion of onboard connectivity. These figures should be treated as industry reporting rather than a complete census, but the direction is operationally credible: the satellite connection is becoming an edge-of-network control point.

The appropriate maritime response is not to disconnect every ship from every network. It is to validate the actual vessel architecture rather than rely on shore-side diagrams. Operators should identify every satellite, vendor, crew, corporate, navigation, and remote-maintenance path; verify firewall rules from the vessel; restrict administrative access; preserve shipboard and shore logs; and rehearse safe manual operation and port approach. Port authorities and ship managers need a common escalation process that includes cyber, navigational, engineering, and physical-security personnel.

The tanker incidents also illustrate how attribution can become a distraction. Investigators need to determine initial access, persistence, affected zones, stolen credentials, and any relationship between the two incidents before public attribution can carry operational meaning. For defenders, unknown attribution does not reduce the need to segment and investigate.

Sources: Associated Press, “FBI and Coast Guard boarded US-bound oil tankers after signs the ships were hit with cyberattacks,” September 17, 2026; CBS News, “Coast Guard and FBI boarded 2 energy tankers due to cyberattacks,” updated September 16, 2026; Financial Times, “Hackers target ships’ satellite links,” September 18, 2026; Houston Chronicle, “What we know about Galveston-bound tanker boarded by Coast Guard and FBI,” September 17, 2026.

AI DID NOT REPLACE OPERATORS; IT COMPRESSED THE ATTACK CYCLE

Anthropic’s September threat-intelligence report was among the week’s most consequential strategic disclosures. It described operations observed or disrupted between December 2025 and August 2026 in which threat actors used AI models inside multi-agent workflows for reconnaissance, phishing, exploitation, persistence, data extraction, malware adaptation, and defensive evasion.

The important point is not that an AI model independently conquered a critical infrastructure network. The evidence does not support that claim. The important point is that AI can compress tasks that previously required multiple specialists, reduce the cost of iteration, and allow operators to scale across many targets. Anthropic described suspected Russian state-nexus activity against governments, defense and intelligence bodies, embassies, defense-industrial firms, drone suppliers, a Southeast Asian maritime authority, and a North African government technology authority. It also described financially motivated activity involving software providers, airlines, energy-related systems, and downstream customers.

One reported case involved a compromised SaaS provider and approximately 200 downstream organizations. More than 2,100 Azure AD token sets spanning over 40 corporate tenants were reportedly extracted in roughly 34 hours. Those figures are Anthropic’s account and should not be treated as an independently verified census of every victim. They nevertheless show why supplier identity and token governance have become infrastructure-security issues.

The defensive consequence is a shift from static indicators to identity and behavior correlation. Teams should monitor token creation and replay, unusual service-principal activity, device-code authentication, bulk mailbox or API export, supplier-issued session use, unexpected tenant-to-tenant access, and repeated changes in binaries or scripts after detection. A credential used by a trusted supplier from unfamiliar infrastructure may be more important than the malware family involved.

AI also raises the tempo of blue-team work. A detection that takes hours to triage may give an automated operator time to enumerate, steal, adapt, and move on. Organizations need short-lived credentials, scoped permissions, rapid revocation, strong audit trails, and tested decisions for disabling supplier integrations. They also need to know which systems can issue or replay authority at machine speed.

This week’s AI reporting should not produce either complacency or science-fiction panic. The credible assessment is narrower and more serious: AI is becoming an amplifier for existing weaknesses in identity, supply chains, cloud administration, and detection latency.

Sources: Anthropic, “Detecting and countering misuse of AI: September 2026,” September 2026; Anthropic, “20260910 Anthropic AI Misuse Report IOCs,” September 2026.

HYBRID THREATS ARE BECOMING A SINGLE PLANNING PROBLEM

France’s announcement that it would prepare a plan to protect critical infrastructure and sensitive defense-industrial and technology sites from drone and cyberattacks gave political form to a pattern already visible in the week’s reporting. President Emmanuel Macron described an intensified Russian hybrid threat involving sabotage, cyber operations, disinformation, and interference. Finland conducted maritime exercises involving ship boardings intended to deter or respond to undersea sabotage. Reporting also described drone attacks that placed Russian oil refineries on hold, damaging fuel-production capacity.

These events must not be collapsed into one proven campaign. A presidential warning is not a named French compromise. A refinery shutdown caused by a drone strike is not a cyberattack. A maritime boarding exercise is not evidence of cable sabotage. The evidentiary boundaries matter because poor attribution can lead to poor defensive decisions.

The common planning implication is nevertheless real. A facility may face cyber intrusion, drone reconnaissance, physical attack, disinformation, supplier pressure, or communications disruption in the same strategic period. Those functions are often managed by different departments with different reporting chains. An incident-response plan that treats a cyber event as purely digital may miss physical surveillance or a nearby drone operation. A physical-security plan may miss credential theft that enables access to cameras, gates, or industrial systems. A communications outage may be the bridge between them.

Operators should therefore test cross-domain escalation: who connects the SOC to physical security, safety, engineering, port authorities, law enforcement, suppliers, and public-affairs staff? Can the organization operate if a trusted vendor account is suspended? Can it preserve evidence while moving to manual operation? Can it distinguish coordinated activity from coincidental noise without waiting for perfect attribution?

Europe’s public posture suggests that critical-infrastructure protection is being redefined as resilience against blended pressure. North American operators should read that as a planning signal, not merely a European political story.

THE WEEK’S DEFENSIVE DOCTRINE

The week supports five practical changes.

First, inventory authority rather than only assets. Identify systems that can authenticate users, change network admission, distribute software, access customer tenants, alter backups, issue tokens, or write to physical controllers. Assign those systems a higher response priority than their conventional vulnerability scores may suggest.

Second, separate patch completion from trust restoration. Every exploited control-plane vulnerability should generate a patch task, an exposure review, a credential-and-token review, a downstream-impact review, and a recovery decision. The green check mark belongs only to the first task.

Third, make supplier and tenant boundaries observable. Record who can issue tokens, export data, create service principals, access customer environments, or push software. Require short-lived and narrowly scoped credentials where possible. Test emergency revocation across supplier and customer boundaries.

Fourth, treat IT-to-OT and shore-to-vessel connectivity as living systems. Validate actual paths, not diagrams. Remove Internet exposure from PLCs and engineering interfaces. Control vendor access. Monitor engineering protocols and configuration writes. Rehearse manual operation before an incident forces it.

Fifth, shorten the decision cycle. AI-assisted intrusion and automated scanning mean that organizations may not have time to wait for a complete narrative. Pre-authorize containment actions for exposed management systems, compromised supplier tokens, suspicious PLC writes, and shipboard cross-zone traffic. Preserve evidence while acting, but do not let the pursuit of perfect certainty become permission for continued access.

STRATEGY

Monday’s strategy should be organized around the question: where could one compromised identity, appliance, repository, supplier, or engineering workstation command something else?

Begin with the RED systems: Cisco ISE, Cisco Secure Email Gateway, self-managed GitLab, Acronis integrations, Internet-exposed or weakly segmented Siemens PLC environments, and shipboard satellite or vendor-access paths. Confirm fixed versions or containment, then begin compromise assessment immediately. Review logs, accounts, tokens, configuration changes, downstream access, and recovery artifacts.

Next, identify authority that does not appear in the vulnerability queue. Map CI/CD secrets, cloud service principals, vendor OAuth grants, backup administrators, email-security credentials, network-admission policy, remote-support tools, and engineering-workstation access. Ask what each system can reach and what it can change.

Finally, run one cross-domain exercise. Use a scenario that begins with a stolen supplier credential or satellite-connected appliance and ends with a suspicious engineering-system action, communications outage, or physical-security alert. Measure how quickly the organization can isolate the path, preserve evidence, move to safe operation, revoke authority, and coordinate with external responders.

REGIONAL AND SECTOR ASSESSMENT

North America

The United States faces the most immediate operational workload from actively exploited identity, email, DevOps, and backup vulnerabilities, combined with the Coast Guard and FBI tanker investigations. No reviewed source establishes a new sustained outage at a U.S. electricity, water, hospital, or port operator. The principal risk is latent compromise of systems that connect many customers or facilities.

Europe

Europe is treating cyber, drones, maritime sabotage, disinformation, and defense-industrial exposure as a connected security problem. France’s protection-plan announcement and Finland’s maritime exercise are planning and mobilization signals, not proof of new infrastructure compromise. European governments and operators should nevertheless expect more cross-domain exercises, warnings, and disruptive probing.

Middle East and Africa

Anthropic’s reporting identified a North African government technology authority among targets of a suspected state-nexus operation. The tanker investigations include an unresolved possible Iranian dimension. Neither report establishes a complete regional victim population or a confirmed critical-service outage. Operators in the region should prioritize identity, VPN, cloud-token, satellite, and supplier-access review.

Asia and Indo-Pacific

Anthropic identified a Southeast Asian maritime authority among reported targets, while the Siemens warning applies broadly to industrial environments. The region’s manufacturing, port, energy, and water systems often depend on the same industrial-control and remote-support patterns seen elsewhere. No new regional process outage was established in the reviewed evidence.

Sector emphasis

Highest concern belongs to identity and network admission, email security, DevOps and software supply chains, backup and recovery, maritime energy transport, industrial control, cloud and SaaS administration, and defense-industrial suppliers. Healthcare, water, energy, transport, and government operators should assume that their most consequential exposure may sit in an upstream supplier or management plane rather than in the process network itself.

OUTLOOK AND UNCERTAINTY

Next week

Expect continuing exploitation and scanning against Cisco ISE, Cisco Secure Email Gateway, GitLab, and Acronis. Watch for victim notifications, new indicators, and evidence of credential reuse or downstream access. Monitor the Siemens S7 threat for confirmed unauthorized writes, named facilities, and additional guidance from Siemens or government agencies. The tanker investigations may clarify whether operational technology was reached, whether the incidents were related, and whether satellite or vendor-access equipment played a role.

Anthropic’s report will likely generate additional disclosures from affected suppliers and governments. The important question will be whether AI-enabled workflows remain historical observations or become tied to current, named infrastructure intrusions. France’s protection plan may reveal whether European governments intend to combine cyber, drone, physical, and supplier-response mechanisms under a common structure.

What is not known

The public record does not establish the full victim populations for Cisco ISE, Secure Email Gateway, GitLab, or Acronis, nor the persistence, stolen credentials, or downstream actions in every case. It does not establish the Siemens victim population, whether unauthorized PLC writes succeeded, or whether any process was damaged. It does not establish the tanker attackers, malware, operational-system access, or relationship between the two vessels. Anthropic’s figures and victim claims are not a complete independent census, and the report’s operational window ends in August. France’s plan does not yet disclose its intelligence basis or implementation details.

The absence of public evidence is not evidence of absence. Management-plane compromise is often discovered only after a downstream incident, a supplier notification, or a forensic review of systems that were not initially considered part of the attack.

Trigger for escalation

Escalate immediately on unexplained Cisco ISE or Secure Email Gateway administrative access, GitLab file-read attempts followed by secret use, Acronis privilege escalation or backup alteration, unauthorized PLC writes or engineering-protocol activity, unexplained shipboard cross-zone connections, suspicious satellite or vendor logins, cloud-token fan-out, bulk mailbox or API export, unexpected service-principal creation, or coordinated cyber and physical activity near a critical facility.

Promote warnings to RED when production exploitation, material service impact, physical-process manipulation, downstream compromise, or credible persistence is confirmed.

Jonathan Brown writes independent, decision-focused analysis on cybersecurity, infrastructure resilience, and operational risk, with an emphasis on primary-source verification and explicit uncertainty.

Support this work by sharing the briefing with operators who can act on it. Corrections supported by primary evidence are welcomed; material errors should be amended transparently. Feel free to subscribe, comment, or buy us a coffee! Thanks.