Today’s lesson is painfully consistent: the fastest way into your environment is still the stuff you don’t own, don’t patch, and don’t monitor like production. Third-party platforms, SSO glue, and “it’s just an admin panel” services are doing all the heavy lifting for attackers.

Today's Top 5

1. OpenAI SSO misconfig + forum RCE: Bug bounty researchers used a single sign-on misconfiguration plus a Discourse RCE to get into an internal account and reach internal code. The proof is the part that should make you sweat. Tom's Hardware
2. WellSky EMR account hijacked: A hospice provider says an attacker used compromised credentials to access a single clinical user account in the WellSky EMR. If your vendor login can see PHI, it is not “just one account.” National Law Review
3. Four Linux local-root exploits go public: Working exploit code dropped for four kernel privilege escalation bugs. “Not exploited yet” is a countdown, not a comfort blanket. The Hacker News
4. Issabel hard-coded JWT key RCE: A hard-coded signing key turns auth into theater, and the result is remote code execution on PBX-linked systems. Shadowserver sightings mean this is already in the real world. SANS ISC Stormcast
5. Opportune LLP breach filing hits Vermont: A fresh regulator filing shows a commercial firm reporting exposure of SSNs affecting Vermont residents. Small counts are still big liabilities. Vermont AG

Why today matters: We are watching identity and “adjacent systems” merge into one attack surface. SSO misconfigurations, vendor logins, and embedded community software now sit on the same path to code and PHI. The nervous orgs this week are the ones that treat third-party services as separate from their threat model, and the ones that still cannot answer, quickly, “which external app can mint a session into what?”

Alright. Let’s get specific.

Data Breaches

1. Doctor’s Choice Home Care & Hospice: WellSky EMR account compromise: The provider says an unauthorized party accessed a single clinical user account in the WellSky EMR using compromised credentials, with access spanning June 5 to July 24, 2026. The practical risk is downstream PHI exposure and secondary fraud if demographics and insurance data were visible. Source: National Law Review
2. OpenAI: bug bounty intrusion reached internal code: Reports say researchers compromised an internal OpenAI ChatGPT account and accessed internal code on GitHub, chaining an SSO misconfiguration with an RCE in Discourse (a third-party community platform). The important part is not the brand, it is the pattern: identity plus vendor software equals “internal.” Source: Tom's Hardware
3. FiveWest: confirms document exfiltration: South Africa-based FiveWest says it concluded an investigation and determined an unauthorized third party exfiltrated certain documents from part of its environment. It claims no indication of compromised funds, balances, or authentication credentials, but document theft alone can still fuel targeted fraud. Source: FiveWest
4. Opportune LLP: Vermont breach notice lists SSNs: The Vermont Attorney General breach register shows a September 18, 2026 filing for Opportune LLP impacting 56 Vermont residents and listing Social Security numbers as affected data. These filings are often the first public signal that customers, employees, or partners will get letters next. Source: Vermont AG

Security Research

1. Linux kernel: four local-root PoCs published: Public exploit code is now available for four privilege escalation bugs, each enabling a local user to become root on affected kernels. The immediate takeaway for CISOs is operational: asset inventory for Linux versions matters again, because these become “post-phish to root” accelerants. Source: The Hacker News
2. China-linked exploitation chain: Chrome plus Windows bugs for GRIMWEDGE: Volexity attributed a campaign exploiting recently patched Chrome and Windows flaws to deploy a JavaScript backdoor, highlighting the patch-gap problem. Treat “patched last week” as “weaponized this week.” Source: The Hacker News
3. Issabel PBX: hard-coded JWT key enables RCE: A hard-coded JWT signing key allows attackers to forge tokens, bypass authentication, and reach code execution against Issabel-managed PBX environments. It is the kind of bug that keeps showing up because teams still treat secrets as configuration. Source: SANS ISC Stormcast
4. CISA: cyber decoys guidance is now a real playbook: CISA released guidance on deploying decoys to detect credential-driven, living-off-the-land intrusion patterns earlier in the kill chain. If you are drowning in identity alerts, decoys can turn “maybe suspicious” into “definitely touched.” Source: CISO Series
5. OpenAI bug bounty incident: SSO misconfig plus third-party forum weakness: Reporting on the OpenAI compromise frames a modern failure mode: identity misconfiguration paired with a vulnerable SaaS component. Security architecture diagrams rarely show community forums, but attackers do. Source: Tom's Hardware

Top CVEs

1. CVE-2026-76460: An unauthenticated authentication bypass in Cisco Identity Services Engine (ISE) that Cisco says is actively exploited. If ISE is your network admission brain, this is not a “patch window” item, it is a “clear the calendar” item. Source
2. CVE-2026-76461: Cisco Secure Email Gateway vulnerability reported as exploited in the wild, enabling root-level command execution on appliances in certain scenarios. Email security gateways are a tempting place to hide because they already process attacker-controlled content all day. Source
3. CVE-2026-85880: A Windows Advanced Local Procedure Call (ALPC) elevation of privilege flaw called out as actively exploited as part of September 2026 Patch Tuesday reporting. Local EoP still matters because it turns “one foothold” into “full endpoint control.” Source
4. CVE-2026-81963: A Windows Update Stack elevation of privilege issue also flagged as actively exploited in September 2026 patch coverage. Update mechanisms are high-value targets for persistence and stealth. Source
5. CVE-2026-89026: Issabel PBX hard-coded JWT key leading to authentication bypass and remote code execution potential. Any system that can pivot into voice and call routing is also a great place to live off the land. Source

Podcasts & Talks

1. SANS Stormcast (Sep 18, 2026): Issabel JWT RCE, Unbound, decoys: A tight rundown that connects the dots between PBX exploitation, resolver bugs, and why decoys can catch credential abuse earlier than your SIEM rules. Listen: SANS ISC
2. CISO Series, The Department of Know (Sep 18, 2026): passkeys phished, Cisco hits root, AI “red lines”: Useful for how leaders are framing AI security risk and identity compromise, and how that maps to board-level language. Watch: CISO Series
3. Risky Business Features (Sep 15, 2026): How to launder illicit Bitcoin: A CISO-relevant view of what happens after ransomware payments, including the laundering infrastructure that makes extortion economically stable. Listen: Risky Business

Final Words

The underlying pattern today is that “access” is no longer a single control, it is a supply chain. One SSO mistake plus one third-party weakness plus one token you can forge, and your blast radius becomes whatever that identity can see. The uncomfortable implication most coverage misses is that your vendor ecosystem is now part of your internal segmentation model, whether you designed it that way or not.

This week, do three things:

• Patch or mitigate Cisco ISE for CVE-2026-76460, then run an authentication-bypass focused hunt across ISE logs, TACACS, and downstream network access events.
• Audit every SSO-integrated third-party app for privilege scope and session issuance paths, specifically community platforms like Discourse, and require signed change control for SSO config changes.
• Queue emergency patching for Issabel and related PBX web frontends for CVE-2026-89026, then rotate JWT secrets and search for suspicious token issuance and API calls.

Your turn: If a “harmless” proof pull request landed in one of your internal repos tomorrow, would your detection stack catch the identity path that made it possible, or only the commit after the fact? Hit reply with your one-sentence answer, or drop it on the web version. I read every reply.

Know someone who still treats their community forum and SSO settings as “not production”? Forward them the OpenAI SSO plus Discourse story, it costs 30 seconds and the alternative costs a lot more. Subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!