Security teams enter the new week with a familiar but increasingly difficult problem: several unrelated attack paths now converge on the same privileged systems. A maximum-severity Cisco Identity Services Engine flaw, an exploited Android modem bug and new research into hijacking browser-based AI agents all show how attackers can turn trusted control planes into shortcuts around ordinary defenses.

The latest weekly bulletin from Cyber Security News also highlights dangerous weaknesses in WordPress, Steam, Linux and enterprise management products. The stories differ technically, but their operational lesson is consistent. Systems that authenticate users, manage infrastructure or act on behalf of people deserve a faster response than their raw asset count might suggest.

Active exploitation puts Cisco ISE and Pixel devices first

Cisco disclosed CVE-2026-76460, an authentication-bypass vulnerability affecting Identity Services Engine and ISE-PIC. With a CVSS score of 10.0 and evidence of exploitation, the issue belongs at the top of patch queues. An unauthenticated attacker can reach a vulnerable API endpoint, bypass management authentication and execute commands with root privileges.

That level of access could expose credentials, alter network-access policy and create a launch point for lateral movement. Cisco has issued fixes across supported ISE branches, while version 3.0 is beyond maintenance and should be migrated. Organizations that cannot update immediately should tightly restrict management traffic, inspect access logs and treat suspicious nodes as potentially compromised rather than assuming a patch alone removes an established foothold.

Google separately confirmed limited, targeted exploitation of CVE-2026-58704 in the Pixel modem component. The privilege-escalation flaw requires radio proximity but no user interaction, characteristics that make baseband vulnerabilities attractive in highly targeted surveillance. Pixel owners should install the September 2026 update and verify that devices report the 2026-09-05 patch level.

Privileged software expands the blast radius

Several other disclosures show why local or pre-authentication flaws cannot be dismissed as narrow. A critical Check Point management-server buffer overflow can reportedly be triggered with an oversized username before login completes, potentially giving a remote attacker root access. Steam’s Windows service also faces an unpatched local privilege-escalation technique that abuses a gap between a signed manifest and an attacker-controlled installation path.

On Linux, the ZcopyReaper flaw affects memory cleanup in the Reliable Datagram Sockets zero-copy path. An unprivileged local user may be able to corrupt kernel memory and reach root even when unprivileged user namespaces are disabled. Vendor kernel updates and a reboot are the durable response; disabling unnecessary RDS modules can reduce exposure while maintenance is scheduled.

Trusted interfaces become attack delivery systems

The week also produced Click2Shell, a chain beginning with a crafted link sent to a logged-in WordPress administrator. A core theme-preview weakness could silently install a theme from the official directory. When combined with an unsafe pre-activation handler in a theme, that action could become remote code execution. WordPress 7.1.1 addresses the core issue, and administrators should review unexpected theme installations and relevant administrative requests.

BragJack research extended the trust problem to AI browser assistants. A malicious extension could attempt to communicate directly with privileged agent components and force actions without relying on conventional prompt injection. Reported impact included access to files, browsing data and device sensors, depending on the browser implementation. Most affected vendors issued fixes, but the research underlines that extensions and agent control channels need explicit authentication and least-privileged design.

A practical triage plan for defenders

The breadth of the bulletin can tempt teams into treating every advisory equally. A better approach is to rank weaknesses by exploitation evidence, privilege and reach:

• Patch actively exploited Cisco ISE and Pixel issues immediately.
• Restrict internet and user-network access to security-management interfaces.
• Update WordPress and inspect newly installed themes or plug-ins.
• Apply kernel and management-product fixes, then confirm deployment.
• Audit browser extensions and AI-agent integrations for unnecessary permissions.

This week’s incidents reinforce that identity engines, privileged services and automation agents are not ordinary endpoints. When compromised, they can authorize, execute or conceal the attacker’s next move. Giving those systems distinct patch deadlines, tighter network boundaries and better telemetry is the most direct way to reduce the combined risk.