Rebecca WarrenWhat's happening in email security: September 14 - September 20, 2026
Most weeks the story is a message that should not have been trusted. This week it was the opposite. Revolut handed over customer data, reportedly including passports, to a request that authenticated perfectly, because the sending domain really did belong to a government agency. Meanwhile the appliance whose entire job is reading inbound mail turned out to hand over root to anyone who mailed it the right thing, an image-sharing service lost 23.62 million user records with email addresses among them, and a Pakistan-aligned crew staged its payloads on domains dressed as Indian newspapers.
A crafted email is enough to get root on Cisco's Secure Email Gateway
Cisco disclosed CVE-2026-76461 on September 14 after its product security team became aware it was already being exploited. It is a SQL injection flaw, CVSS 9.8, sitting in the email parsing logic of AsyncOS for Cisco Secure Email Gateway. An unauthenticated remote attacker can send a crafted message containing malicious SQL statements through an affected device, and a successful exploit runs arbitrary SQL that leads to command execution with root privileges on the underlying operating system. Nobody has to click anything. The gateway processes the message, which is the one thing a gateway is guaranteed to do.
Read Cisco's own wording on the consequences, because it is unusually direct. "Upon successful exploitation of this vulnerability, threat actors may obtain command execution with root privileges. Because of this level of access, evidence of exploitation and indicators of compromise may be removed or hidden by the threat actors." That is a vendor telling you that a clean box is not proof of a clean box. If you were exposed during the exploitation window, absence of evidence is doing no work for you.
CISA added it to the Known Exploited Vulnerabilities catalog straight away, with a federal patching deadline of September 17, and affected builds cover AsyncOS 16.5, 16.0, and 15.5 and earlier on both physical and virtual on-premises appliances. Cisco says its cloud-delivered Secure Email devices were affected too and that it has already upgraded them itself. Patch levels are listed in Cisco's advisory and are worth reading there rather than from secondhand write-ups, because the build numbers for the 15.5 branch are reported inconsistently across coverage. One practical step beyond patching is in Cisco's advisory too. It recommends searching the IronPort text mail logs for the pattern COPY.*TO PROGRAM, a retrospective check that needs nothing beyond logs you already have.
Revolut was talked out of customer data by a request that authenticated perfectly
Revolut told Infosecurity Magazine on September 14 that an unauthorized third party had obtained customer data by submitting fraudulent requests for information from a legitimate government agency domain email. Revolut called it "a sophisticated external impersonation scam." The requests carried valid technical domain authentication, so staff processed them the way they process any lawful request from that agency, as standard legal compliance work.
The reported exposure is about as sensitive as a fintech holds. According to researcher ZachXBT, who shared Revolut's notice to affected customers, it covers full names, dates of birth, home addresses, phone numbers, email addresses, occupations, passports and driver's licenses, verification selfies, IBANs, account-opening dates, full transaction and withdrawal histories, and Bitcoin wallet reference numbers. Revolut says its systems and customer funds were untouched, which is beside the point. Nothing had to be hacked. Revolut declined to say how many customers were affected beyond calling them a very limited group. The sequence ran fast. Customers had Revolut's notice by September 11, ZachXBT made it public right after, and Revolut was confirming the breach to reporters by September 12.
This one matters even though no mail control failed. Every authentication layer you deploy answers one question, which is whether the message genuinely came from the domain it claims. In this case the honest answer was yes. The domain was real, the authentication was real, and the request was still fraudulent. Wherever your organization accepts consequential instructions over email, from law enforcement requests to payment detail changes to vendor bank updates, the control that matters is a verification step that runs out of band and that staff are explicitly allowed to insist on. Authentication tells you the envelope is genuine. It was never designed to tell you the person holding the pen is.
Gyazo lost 23.62 million user records, and email addresses were in them
Gyazo, the image-sharing service owned by Helpfeel, was breached through a vulnerability in its image upload server that let attackers run arbitrary commands and reach the database. The haul was 23.62 million user records and 490 million image metadata records, the latter mostly dating from January 2019 or earlier. Payment data was not exposed.
What was exposed is the part that feeds the next attack. The count includes anonymous accounts with no registered email address, but where the fields are present the records hold email addresses alongside password hashes, user IDs, device IDs, login session IDs, X integration tokens, profile information, registration and last-login timestamps, subscription plan and billing status. Session IDs and integration tokens are the standouts. A password hash ages badly for an attacker once users rotate credentials, but a live session identifier or a third-party integration token can be useful immediately, and neither is addressed by the advice to change your password. Helpfeel says it took invalidation measures but has not said whether the exposed session IDs still work.
Helpfeel's handling was quick by the standards of this category. Suspicious activity was spotted on the evening of September 11 Japan time, access routes were blocked by early on September 12 with the vulnerability fixed the same day, data exposure was confirmed on September 14, the incident was reported to Japan's Personal Information Protection Commission on September 15, and the public notice went out on September 16. For everyone else, the useful assumption is that another large batch of email addresses with behavioral metadata attached is now available for targeting, and that some of your users may be in there whether or not your organization has ever heard of Gyazo.
APT36 is hosting its payloads on domains dressed as Indian newspapers
Zscaler ThreatLabz published research on Operation RapidRust, a campaign by the Pakistan-aligned group Transparent Tribe, also tracked as APT36 and Earth Karkaddan, against government and defense targets in India and Afghanistan. The delivery infrastructure was built on typosquatted domains impersonating Indian news organizations. theprints[.]org borrows from The Print, indiatodays[.]org borrows from India Today, and both hosted malicious PowerShell scripts and payloads. The campaign introduced four previously undocumented tools, including RUSTYSHADE, a Rust backdoor that runs its encrypted command and control through private GitHub repositories, and PSNATCH and BASHNATCH for file theft on Windows and Linux respectively. ThreatLabz observed post-compromise activity between August 20 and September 1, with operators issuing commands only between 4 and 11 in the morning UTC on weekdays, which is to say office hours somewhere.
The more interesting angle is who is carrying the cost. The Print and India Today are not victims in the incident-response sense. No system of theirs was touched. What they lost is a piece of their name, deployed by somebody else to give hostile infrastructure the look of a trusted news site. Publishers are an unusually attractive shell to wear because their readers are conditioned to follow links from them and their brands carry institutional credibility. If your organization's name is the kind of thing people trust on sight, your own mail controls will never see this kind of abuse. What counts is how quickly you would learn that a domain one character away from yours had gone live, and what you could do about it in the first week rather than the first quarter.
A CDN domain lapsed, someone bought it, and thousands of pages still point to it
Report URI documented something that ought to be more alarming than it feels. A content delivery network domain was abandoned, and in July 2025 someone else re-registered it. Thousands of websites, code repositories and documentation pages still carry hard-coded references to hostnames beneath that domain, which means anything they load from it now comes from infrastructure that belongs to a stranger. The new owner holds wildcard DNS across the whole thing, meaning they decide what any hostname under it returns. The apex currently serves an ad-heavy media downloader page, which is a mercy, since the same position could be used to serve anything to every page still calling home.
The precedent is polyfill.io, which changed hands in June 2024 and began serving conditional redirects to mobile visitors across more than 110,000 sites that had embedded it. Report URI's framing of the current case is the line to remember. "The remarkable part is that the decision about what those thousands of pages load next belongs to a stranger, and nobody involved has been notified, because from the outside nothing broke."
That last clause is why this sits in the big picture rather than the web-security bucket. The failure mode of a lapsed domain is silence. Nothing errors, no alert fires, no page goes blank, and the trust relationship simply transfers to whoever pays the renewal fee. Email teams should recognize the shape of this immediately, because it is the same mechanic as a retired sending subdomain still named in an SPF include, a dangling CNAME pointing at deprovisioned infrastructure, or the kind of lapsed domain the dropcatch buyers we covered in August pay good money for. The answer is inventory. Knowing which domains and subdomains you own, which ones other systems still reference, and which ones are drifting toward expiry is a list most organizations have never actually assembled, and it is the only thing that turns this from an invisible risk into a maintenance task.
- Revolut customers were getting phishing texts within two days of the breach going public
Malwarebytes reported smishing messages that landed in the same SMS thread as genuine Revolut texts, sending victims to a page that asked for camera access and reportedly mimicked the bank's identity check with a "turn your head" prompt before asking for a password, with one message arriving on September 14, two days after the breach became public. Malwarebytes says it does not yet know whether the campaign uses the breached data.
- Five alleged Black Axe leaders were extradited to the US to face fraud charges
Perry Osagiede, Franklyn Edosa Osagiede, Osariemen Eric Clement, Collins Owhofasa Otughwor and Musa Mudashiru, who allegedly ran the Cape Town zone of the group, were flown from South Africa to the US on September 11 after their 2021 arrest. All five face wire fraud conspiracy and money laundering conspiracy charges, some also face wire fraud and aggravated identity theft counts, and business entities were allegedly used to disguise the money alongside proceeds from business email compromise.
- NightEagle is using Exchange servers as its command channel against Russian firms
Kaspersky tracked the group, also known as APT-Q-95, mostly getting in with compromised valid credentials for corporate VPNs and then deploying the GhostContainer backdoor in memory on Microsoft Exchange, where it takes commands through x-owa-urlpostdata headers while evading AMSI and Windows event logging, which makes the mail server the persistence layer rather than the prize.
- The DOJ seized the NightmareStresser domains
Working with the FBI Anchorage field office and the Royal Canadian Mounted Police, the Department of Justice took nightmare-stresser[.]com and nightmarestresser[.]org offline after assessing the service was used to launch hundreds of thousands of actual or attempted DDoS attacks since 2022, with a late 2023 Searchlight Cyber report putting it at more than 566,000 registered users and 52 servers.
- Data broker Radaris lost 14 domains by court order
Atlas Data Privacy Corp won a transfer of radaris.com and more than a dozen related people-search domains under New Jersey's Daniel's Law after the defendants repeatedly failed to appear, and tellingly it was more than 10,000 emails and documents that tied the shell entities together, which Atlas says show they are run by the same three or four people from the same mailboxes and share one bank or payment card set and one virtual office address.
Want email security news in your inbox every week?
Subscribe here and stay up to date with what's happening in email security.