Microsoft 974 patches, GitLab CVSS 10 exploited, Russia weaponizes Claude

Microsoft shipped 974 patches in its largest-ever batch; GitLab CVSS 10 flaw saw in-the-wild probes within hours of disclosure; Anthropic disrupted seven China-based labs running industrial-scale Claude distillation attacks, while separately detecting Russia-linked cyber-espionage targeting 20+ government entities.

Microsoft released 974 security patches, its largest single batch ever, addressing Windows and related software vulnerabilities; AI is accelerating vulnerability discovery but experts warn coverage remains incomplete.

GitLab path-traversal flaw CVE-2026-85706 (CVSS 10.0) saw in-the-wild exploitation attempts within hours of public disclosure, now listed in CISA's KEV catalog.

Anthropic identified and disrupted industrial-scale illicit distillation attacks against Claude from seven China-based AI labs including Alibaba, DeepSeek, and Moonshot. ⚠

Russia-linked cyber-espionage group deployed Claude to target 20+ government, intelligence, diplomatic, and defense organizations; Anthropic detected and disrupted the campaign.

CISA added five actively exploited vulnerabilities to its KEV catalog, affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS.

1. Microsoft’s Record Patch Batch Addresses 974 Vulnerabilities

Severity: HIGH Affected: Government , Technology

Microsoft released updates to address at least 974 security holes in Windows operating systems and related software, marking the largest single patch batch in company history [1] . Microsoft states that artificial intelligence is helping accelerate vulnerability discovery, though security experts caution that many vulnerabilities may remain unpatched [1] . Specific CVE details from this batch include CVE-2026-69730, CVE-2026-69829, CVE-2026-81963 , and CVE-2026-85880 [1] . Sources: [1] Krebs on Security

Prioritize deployment of the Microsoft September 2026 patches across all Windows systems, with particular focus on mission-critical infrastructure

Monitor patch deployment logs and validate installation across your estate within 72 hours

Review Microsoft’s advisory for any CVEs affecting your specific software versions and deploy in priority order

2. GitLab CVSS 10.0 Path Traversal Exploited Within Hours of Disclosure

Severity: HIGH Affected: Technology

GitLab Community Edition and Enterprise Edition contain a path traversal vulnerability (CVE-2026-85706, CVSS 10.0) that allows unauthenticated attackers to read arbitrary files from the GitLab server [3] . The flaw exists in the repository commits API due to improper path confinement and missing authentication enforcement [3] . In-the-wild probes began within hours of public disclosure [2] , and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 11, 2026, with federal remediation required by September 14, 2026 [3] . Sources: [1] The Hacker News [2] The Hacker News [3] CISA KEV

Apply GitLab security patches immediately if you operate Community or Enterprise Edition instances

Audit GitLab access logs for suspicious repository commits API requests from unauthenticated sources

If patching is delayed, restrict network access to GitLab instances to authenticated users only

Review any files accessed via the repository commits API for potential exposure

3. Anthropic Disrupts Industrial-Scale Claude Distillation Attacks from Seven China-Based Labs

Severity: HIGH Affected: Technology

Anthropic identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (also known as Zhipu), and MiniMax [1] . Knowledge distillation is a legitimate training technique, but in this case the attacks were conducted at scale without authorization to extract Claude’s model capabilities [1] . Sources: [1] The Hacker News

Review API usage logs for abnormal query patterns or volumetric anomalies that could indicate model extraction attempts

Implement rate-limiting and behavioral analysis on API endpoints to detect distillation activity

Monitor for unauthorized access tokens or credential misuse tied to AI service accounts

4. Russia-Linked Cyber-Espionage Campaign Weaponizes Claude Against 20+ Government Entities

Severity: HIGH Affected: Government , Defense

Anthropic detected and disrupted a Russia-linked cyber-espionage group that deployed Claude as a tool in hacking operations targeting more than 20 government, intelligence, diplomatic, and defense organizations [1] . The campaign was successfully disrupted by Anthropic before broad impact could be achieved ⚠ [1] . Sources: [1] The Record

Alert government and defense personnel to the risk of state- AI tool abuse in spear-phishing and reconnaissance

Review inbound communications (email, messaging) for unusual requests that may have been AI-generated or optimized

Implement additional authentication and verification protocols for sensitive requests, particularly those asking for access, credentials, or systems information

5. CISA Adds Five Actively Exploited Flaws to KEV Catalog

Severity: HIGH Affected: Technology

CISA added five vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities catalog [1] . These include CVE-2026-84869 in ConnectWise ScreenConnect (improper privilege management and missing authorization, allowing file transfer and execution without authorization) [2] ; CVE-2026-42016 and CVE-2026-42018 in JFrog Artifactory (incorrect authorization and improper authentication, respectively, both leading to privilege escalation or exposure of sensitive resources) [3] [4] ; and CVE-2026-86060 in MikroTik RouterOS (improper neutralization of argument delimiters allowing privilege escalation) [5] . Federal remediation deadlines range from September 13 to September 25, 2026 [2] [3] [4] [5] . Sources: [1] The Hacker News [2] CISA KEV [3] CISA KEV [4] CISA KEV [5] CISA KEV

Identify and inventory all instances of ConnectWise ScreenConnect, JFrog Artifactory, and MikroTik RouterOS in your environment

Apply patches or workarounds by the federal remediation deadline for your sector

For ScreenConnect, restrict access to remote sessions and review file transfer logs for suspicious activity

For Artifactory, audit token usage and authentication mechanisms, ensuring proper scope validation

For RouterOS, review policy masks and access controls for unauthorized modifications

Today’s Action Checklist

☐ URGENT: Deploy Microsoft September 2026 patches across Windows infrastructure within 72 hours

☐ URGENT: Patch GitLab Community/Enterprise Edition immediately to remediate CVE-2026-85706

☐ URGENT: Identify and remediate ConnectWise ScreenConnect, JFrog Artifactory, and MikroTik RouterOS instances by CISA federal deadlines

☐ Review GitLab access logs for unauthorized commits API requests; audit files accessed

☐ Alert security teams and government partners to Russia-linked AI-assisted cyber-espionage targeting government/defense sectors