Yesterday’s Patch Tuesday fallout is still being cataloged, but today’s news is dominated by a government breach with real names attached and a fresh batch of unauthenticated bugs on the exact devices that sit at your network edge. Here’s what’s new since yesterday’s digest.
Breach watch: ShinyHunters breaches Florida’s DMV database through a password-reset flaw, proves it with Jeffrey Epstein’s own record
The extortion group ShinyHunters says it broke into “DAVID” — the Driver and Vehicle Information Database run by Florida’s Department of Highway Safety and Motor Vehicles, used by law enforcement and government staff to look up driver records — through a password-reset flaw that let them take over multiple internal accounts, including ones belonging to DMV employees and, they claim, an FBI agent. From there, the group says it iterated through driver records by ID and pulled down the associated HTML pages and images, exfiltrating more than 200,000 records since the breach began on September 3. As proof, ShinyHunters published a screenshot of Jeffrey Epstein’s DAVID record, showing his address, Social Security number, date of birth, driver’s license details, and registered vehicles. The group gave the agency until September 11 to negotiate before it publishes the full dataset; as of this writing, FLHSMV has not publicly confirmed the breach. BleepingComputer · CSO Online
A password-reset flaw compromising internal accounts — not a novel exploit — is what turned a government lookup portal into a 200,000-record leak. If your organization exposes any admin or employee-facing portal with self-service password reset, verify the reset flow can’t be used to take over an arbitrary account by ID or email enumeration, and that every account with lookup access is behind MFA. Credential-reset abuse is cheap to test for and expensive to ignore.
Vulnerability watch: CISA adds four actively exploited network-edge flaws to its KEV catalog in a single day
CISA’s September 9 catalog update covers four unrelated products that share one theme — unauthenticated access to edge infrastructure. CVE-2026-19490 (CVSS 9.3) is an authentication-bypass-using-alternate-path flaw in Citrix NetScaler ADC and Gateway that lets an unauthenticated attacker skip login checks on appliances configured as an SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual server; active exploitation followed within days of a public proof-of-concept. CVE-2026-20079 (CVSS 10.0) is an authentication bypass in Cisco Secure Firewall Management Center that abuses a leftover partial session created at boot time, letting a remote attacker with no credentials execute scripts as root; Cisco has linked exploitation to both state-sponsored actors and ransomware crews, with web shells and credential exfiltration observed post-compromise. CVE-2025-25249 (CVSS 9.8) is a heap-based buffer overflow in the FortiOS/FortiSwitchManager cw_acd daemon (CAPWAP access-point management, UDP 5246); researchers this week tied active exploitation to a new FortiGate post-exploitation RAT called PivotC2. And CVE-2026-87491 is the out-of-bounds write in Chrome’s V8 engine that Google fixed on September 8 — the second actively exploited V8 zero-day patched this month alone. CISA · BleepingComputer — Citrix · BleepingComputer — Cisco · SOCRadar — Fortinet
Three of these four bugs need zero credentials, and all three sit on devices designed to be internet-reachable by default — VPN gateways, firewall managers, and wireless controllers. If you run NetScaler, Secure FMC, or FortiOS/FortiSwitchManager anywhere in your edge, patch before you do anything else on your list this week, and pull logs for the CAPWAP port (UDP 5246) and FMC admin sessions around your last unpatched window — both vendors report post-exploitation activity, not just scanning.
Threat watch: A third Windows Defender zero-day bypass drops the day after Patch Tuesday
The researcher known as Nightmare Eclipse (also Chaotic Eclipse, MSNightmare) published ShieldCrash on September 9 — a proof-of-concept that grants SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server hosts via an arbitrary file read as SYSTEM, and works against systems that already applied this week’s Patch Tuesday updates. ShieldCrash is a bypass for ShieldBreak, the Defender privilege-escalation exploit the same researcher dropped in August as a bypass for RoguePlanet, a race-condition zero-day from June. That’s three Defender bypasses in a row, each one landing after Microsoft closed the previous one. No CVE or official patch exists yet for ShieldCrash. SecurityWeek · The Register
There’s no fix to apply yet, so treat this as a detection problem rather than a patch problem for now: alert on unexpected SYSTEM-level file reads outside Defender’s normal scan paths, and watch for the pattern repeating — this researcher has now turned three consecutive Microsoft patches into new zero-days within days of release.
Also noted
JSCeal, a compiled-V8-JavaScript malware family with credential-harvesting and surveillance features, can now bypass Google authentication entirely by stealing active session cookies from Chromium-based browsers (Chrome, Edge, Brave, Opera, and others) and replaying them — since a valid session cookie already reflects a completed login and MFA challenge, the attacker never needs a password or a second factor. The campaign has been running since late 2024 across 12 countries in 25 languages, concentrated in Asia-Pacific and Latin America, and layers RC4-encrypted strings and control-flow flattening on top of the compiled-JS delivery to dodge signature detection. The Hacker News
Session-cookie theft defeats MFA by design — the login already happened. If you can, shorten session lifetimes on high-value SaaS accounts and enable device-bound or IP-bound session tokens where your identity provider supports it; a stolen cookie replayed from a new device or ASN is the signal to alert on.
Final thought
Today’s throughline is access, not exploitation sophistication: a password-reset flaw, an alternate auth path, a leftover boot-time session, a stolen cookie. None of these require novel tradecraft — they require someone to notice the door was left open before an attacker does. If you want help verifying your logging actually catches credential-reset abuse or session-cookie replay before it becomes a breach notice, see our how-to guides or book a discovery call.