The Week in 60 Seconds

The week’s highest-consequence reporting spans an alleged open-source supply-chain campaign that Google says it monitored and disrupted, and a zero-day chain Volexity said was used against Asian government entities before disclosure or patches. [1][2]

AI-assistant risk centered on Muse’s service authentication and macOS permissions alongside a reported local weakness that can redirect dictated audio and prompts to an attacker-controlled endpoint. [3][4]

Claims involving FBI recruitment infrastructure remain under investigation, with reporting describing an alleged previously unknown bug and theft of personal data belonging to current and former employees. [5]

Security & Exploitation

Supply Chain · Arstechnica Security

What happened

TeamPCP allegedly tainted hundreds of open-source programs with malware, stole developer accounts, used a self-spreading worm, and ultimately breached more than a thousand companies. [1]

Google Threat Intelligence says an undercover researcher infiltrated TeamPCP during its campaign, enabling Google to monitor the activity, warn breach targets, and help disrupt attempted exploitation. [1]

Why it matters

According to Larsen, Google traced operational-security mistakes allegedly made by one accused TeamPCP leader and passed identifying details to law enforcement. [1]

Exploitation · Cyberscoop

What happened

Volexity reported that the China-aligned group UTA0565 exploited a three-vulnerability zero-day chain affecting Chrome and Microsoft before the defects were disclosed or patched, during September 3–4. [2]

The chain included CVE-2026-85046 and CVE-2026-87491, remote-code-execution defects in Chromium-based browser JavaScript engines, and CVE-2026-85880, a Windows Advanced Local Procedure Call privilege-escalation zero-day. [2]

Why it matters

Volexity said UTA0565 used multiple fake websites, phishing emails targeting Asian government entities, and spoofed domains impersonating the Center for American Progress and China Digital Times. [2]

AI & Agent Security

AI & Agents · Arstechnica Security

What happened

Muse is a macOS AI assistant that can book appointments, fill forms, handle customer service, make purchases, generate content, create documents, and connect to apps and services including WhatsApp, email, calendars, and social media. [3]

Using Muse requires authenticating it to services and granting macOS permissions to resources such as disk files, the microphone, camera, location, and calendars. [3]

Why it matters

The article states that Muse’s privileges undo macOS’s default protections intended to prevent installed applications or terminal commands from accessing restricted resources. [3]

AI & Agents · Theregister Security

What happened

Security researcher Patrick Wardle described a proof of concept for a local zero-day in Meta’s Muse macOS app that lets an unprivileged local process redirect the app’s dictation traffic and potentially abuse its granted access. [4]

The issue involves Muse’s undocumented endo_voyager_dictation_endpoint setting, which local code can modify without special privileges to redirect dictated audio and prompts to an attacker-controlled endpoint. [4]

Why it matters

The reported effects include prompt injection, theft of authentication material, and abuse of access granted to Muse; Wardle characterized the issue as a privilege-escalation vulnerability. [4]

Cloud & Platform

Cloud · Securityaffairs

What happened

A 2017 UK assessment reviewed 15 risks of moving police data—including criminal records, victim statements, police-force information and some potentially secret-level material—to Microsoft Azure. [6]

The assessment identified Microsoft software vulnerabilities that could eventually be exploited by cybercriminals or other attackers, and specifically identified possible access by US government insiders. [6]

Why it matters

Five specialists who reviewed the assessment for The Guardian said the identified risks remain relevant today; the article also states that every UK police force now uses Microsoft’s cloud wholly or partly. [6]

Vulnerability · Certcc Vulnotes

What happened

ViewSonic vCast software, included with ViewBoard smartboards, contains multiple vulnerabilities that can be chained to achieve full device compromise. [7]

CVE-2026-82989 allows a remote attacker to exfiltrate JPEG images of screen content through unauthenticated /snapshot or /screen GET endpoints. [7]

Why it matters

Potential impact includes unauthorized access to displayed content, persistent installation and execution of arbitrary applications, full device compromise, and possible lateral movement through the connected network. [7]

Research & Emerging Techniques

Identity · Cyberscoop

What happened

SpyCloud analyzed 10,000 EPA-registered water and wastewater organizations and found 1,787 with active infostealer exposure, meaning identity data from stolen credentials was exposed. [8]

Among the 1,787 organizations with active infostealer exposure, 258 carried credentials for operational-technology or remote-access systems. [8]

Why it matters

In one reported case, a single infected device at an unnamed smart-meter technology provider contained saved logins linked to about 167 U.S. utility-metering tenants, creating a reported cascading supply-chain exposure. [8]

Policy & Industry

AI & Agents · Arstechnica Security

What happened

The FBI is investigating ShinyHunters’ claims that the group exploited a previously unknown bug on FBIJobs.gov and stole personal data belonging to thousands of current and former employees. [5]

The reported incident involved taking down FBIJobs.gov and posting a banner claiming the site had been seized; ShinyHunters told The New York Times that approximately two to three terabytes of data were taken. [5]

Why it matters

The data reportedly included names, home addresses, phone numbers, spouses’ names, certain medical information and other information concerning current and former agents and applicants. [5]

Heimdall's Read

Muse’s access to authenticated services and protected macOS resources raises the consequences of the reported local dictation-endpoint manipulation, which could redirect prompts and audio to an attacker-controlled endpoint. [3][4]

Both reports concern Meta’s Muse macOS app: one describes privileged integrations, while the other describes a local setting that can redirect dictation traffic. [3][4]

Sources (8)
  1. [1] An undercover Google analyst infiltrated a notorious supply-chain hacking gang

    arstechnica security · September 20, 2026

  2. [2] Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects

    cyberscoop · September 22, 2026

  3. [3] Muse, Meta's extraordinarily privileged AI assistant, has a serious 0-day

    arstechnica security · September 21, 2026

  4. [4] Meta Muse AI app flaw lets local malware redirect dictation traffic

    theregister security · September 21, 2026

  5. [5] FBI rushes to investigate if ShinyHunters hack of thousands of employees is real

    arstechnica security · September 23, 2026

  6. [6] UK Police Data Faces Long-Standing Microsoft Cloud Security Concerns

    securityaffairs · September 21, 2026

  7. [7] VU#234131: ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise

    certcc vulnotes · September 24, 2026

  8. [8] Another worry for water systems: infostealer exposure

    cyberscoop · September 22, 2026