Today’s vibe: attackers are not “stealing data,” they are stealing context. OCR text, EXIF locations, session IDs, and API auth bypasses turn boring records into real-world leverage.

Today's Top 5

1. 490M Gyazo images exposed: Gyazo says metadata for ~490 million images leaked, including OCR text and EXIF, plus 23.62M user records. If you ever screenshotted something you regret, you know what’s coming. Source
2. Cisco ISE auth bypass in the wild: A CVSS 10.0 bug (CVE-2026-76460) lets an unauthenticated attacker bypass the web management interface. No workarounds, just patches and log-hunting. Source
3. Unbound DNSSEC can go RCE: NLnet Labs patched multiple Unbound issues, including a critical heap overflow (CVE-2026-81642) that can be triggered via a malicious DNS zone. Recursive resolvers just became an attack surface again. Source
4. Issabel PBX hard-coded JWT RCE: CVE-2026-89026 is a pre-auth RCE path built on a hard-coded JWT key in Issabel Framework’s pbxapi, with exploitation observed in the wild. Your phone system is a server, not a phone. Source
5. CISA says “use decoys”: New CISA guidance makes deception practical, from honeytokens to breadcrumbs, aimed at catching credentialed, living-off-the-land intruders after they are already inside. Source

Why today matters: The common thread is control-plane exposure. When the API you forgot about becomes the auth bypass, or when “only metadata” contains OCR and location clues, incidents stop being theoretical and start being personal. CISOs in regulated industries should be nervous, but so should anyone running identity infrastructure, DNS, or collaboration tooling that quietly became critical path.

Alright. Let’s get into the receipts.

Data Breaches

1. Gyazo server flaw exploited to steal 23.6M user records: Gyazo confirmed a breach tied to a server vulnerability, with attackers accessing its database and exposing ~23.62M user records. The spill also includes ~490M image metadata records, which can include upload IPs, User-Agent strings, OCR text, EXIF location data, and hashed passphrases for private images. Source: BleepingComputer
2. Gyazo incident details and what was exposed: Gyazo’s own notice outlines the breadth of user data (email, password hashes, session IDs, tokens) and clarifies that metadata for hundreds of millions of older images was exposed, with a separate subset of additional image metadata records under narrower conditions. This is your reminder that “screen capture tooling” is data handling. Source: Gyazo Help Center
3. Helpfeel follow-up on Gyazo impact: Helpfeel published an update stating it has not confirmed data leakage or attack traces in its other services (Helpfeel, Cosense), and describes a preventative emergency security review. If your comms playbook includes “separate systems,” this is what good follow-up looks like. Source: Helpfeel
4. Opportune LLP files breach notice in California: Opportune LLP appears on the California Attorney General’s breach list with a reported date of September 18, 2026 and breach date June 22, 2026. Another quiet vendor in a sensitive industry holding identity data for people who never chose them. Source: California DOJ (OAG) breach notifications
5. Accela listed by EndZone (unverified extortion claim): Leak-site monitoring shows Accela.com listed by the EndZone group on Sep 18, 2026. Treat as a claim until corroborated, but note the target class: gov-tech platforms have high secondary impact. Source: CyberThreatIntelligence ransomware victims tracker

Security Research

1. Cisco ISE auth bypass, actively exploited (CVE-2026-76460): Cisco says an API endpoint has insufficient authentication control, enabling an unauthenticated remote attacker to bypass the web-based management interface. Cisco provides fixed releases and points defenders to access.log review for suspicious usernames. Source: Cisco PSIRT
2. Gyazo breach: the “metadata is the data” lesson: Reporting highlights the risk of exposed image IDs and metadata fields like OCR text and EXIF. This is the kind of spill that fuels targeted extortion and convincing spearphish because it contains actual human behavior, not just identifiers. Source: TechRadar
3. Unbound ships critical DNSSEC fixes: NLnet Labs published multiple Unbound advisories, including a critical heap overflow with possible RCE (CVE-2026-81642) and additional high-severity buffer issues. If you run recursive DNS resolvers inside your estate, this is not “someone else’s problem.” Source: NLnet Labs
4. Issabel PBX hard-coded JWT key enables pre-auth RCE: CVE-2026-89026 is a clean example of “one secret shipped everywhere.” A forged token can hit pbxapi manager originate with the System application parameter, leading to OS command execution as the asterisk user. Source: CVE.report
5. CISA publishes practical decoy guidance: CISA released a focused playbook on cyber decoys, positioning them as a way to get high-fidelity signals when attackers use valid creds and native tools. This is one of the few documents that translates deception from “cool demo” into an ops plan. Source: CISA

Top CVEs

1. CVE-2026-76460: Cisco Identity Services Engine authentication bypass via an insufficiently protected API endpoint, with active exploitation acknowledged by Cisco. The impact is unauthorized access to the management interface and potential follow-on control-plane compromise. Source
2. CVE-2026-81642: Unbound DNSSEC validator heap buffer overflow with possible remote code execution when digesting DNSKEYs, exploitable via a malicious zone and query patterns. Patch to Unbound 1.26.1 is available. Source
3. CVE-2026-82717: Unbound heap corruption path tied to CNAME synthesis and TTL rewriting, which can eventually crash and in some environments may lead to RCE depending on heap layout and compilation options. Included in Unbound 1.26.1 fixes. Source
4. CVE-2026-81634: Unbound heap buffer overflow during DNSSEC canonicalization, potentially triggerable by a malicious name server or response tampering. It is “only” DoS in the advisory, but it is still a DNS choke point. Source
5. CVE-2026-89026: Issabel Framework pbxapi hard-coded HS256 JWT signing key lets attackers forge bearer tokens and reach OS command execution through the Asterisk originate path. Exploitation was observed by Shadowserver (per the CVE record). Source

Podcasts & Talks

1. Risky Business #853, “We’re all gonna die, apparently” (Sep 16, 2026): A useful listen for how the industry is framing agentic tooling misuse and the constant drip of high-impact patching. The discussion is messy in a good way, which is how your Monday morning will feel. Listen: Risky Business
2. SANS Stormcast, Friday Sep 18, 2026: Tight roundup that hits Unbound, PBX JWT key RCE, and a note about CISA’s vulnerability bulletin changes. Good for staying patch-prioritized when your brain is already in weekend mode. Listen: SANS ISC
3. CISO Series “Cybersecurity Headlines” (Sep 18, 2026): Covers CISA decoy guidance and AI safety governance items. Worth it if you need a fast exec-friendly framing for why deception is back on the table. Listen: CISO Series

Final Words

The uncomfortable pattern today is that “critical systems” are no longer just your crown-jewel apps. They are your screenshot tool, your DNS resolver, your PBX web framework, and the NAC brain that decides who gets on the network. Attackers keep winning by living in the control plane, and defenders keep budgeting like the control plane is a footnote.

This week, do three things:

• Patch Cisco ISE and ISE-PIC for CVE-2026-76460, then hunt the specific ISE access.log paths Cisco calls out for suspicious usernames across every node.
• Inventory every Unbound deployment and upgrade to 1.26.1 or apply NLnet Labs patches for CVE-2026-81642, CVE-2026-81634, and CVE-2026-82717, especially anywhere DNSSEC validation is enabled.
• Search externally for exposed Issabel pbxapi endpoints, then patch or block access for CVE-2026-89026 and rotate the JWT secret as part of the fix, not as a separate “later” task.

Your turn: If your org’s most sensitive screenshots were indexed by OCR and tied to upload IPs tomorrow, would you even know which tool produced them, or who owns that risk? Hit reply with your answer, or drop a comment on the web version. I read every reply.

Know someone who still thinks “only metadata leaked” is fine? Forward them today’s Gyazo story. It costs 30 seconds, and the alternative costs incident-retainer money. For forwarded and web readers: subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!