GitLab CVSS-10 Flaw Under Active Exploit; U.S. Agencies Name Six Chinese AI Firms

GitLab CVSS 10.0 Flaw Sees Active Exploitation Within Hours

CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on September 11 after observing active probing starting at 06:00 UTC that morning, less than 24 hours after GitLab patched the flaw. The path traversal vulnerability in the repository commits API allows unauthenticated attackers to read arbitrary files from self-managed GitLab servers through a single HTTP request. Federal agencies have until September 14 to remediate, and CISA flagged the issue for forensic triage given the possibility systems were accessed before public disclosure. [1]

NSA, FBI, CISA Accuse Six Chinese AI Firms of Industrial-Scale Model Distillation

U.S. intelligence agencies released a joint advisory on September 8 naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as conducting systematic knowledge distillation campaigns against American AI models since late 2024. The agencies say the firms extracted billions of tokens across millions of requests from Claude, GPT, Gemini, and Grok models, likely with Chinese government awareness. Z.AI alone distilled billions of tokens from GPT-5.5 and Claude Opus 4.8 by mid-2026 to develop chain-of-thought reasoning capabilities, according to the advisory. [2]

Microsoft September Patch Tuesday Addresses 973 Vulnerabilities, Two Exploited Zero-Days

Microsoft released security updates on September 8 addressing 973 vulnerabilities, including two zero-days already exploited in attacks and 113 rated Critical. The release includes CVE-2026-73009, a critical remote code execution flaw in Windows SSTP with a CVSS score of 9.8 that requires no authentication and typically affects internet-exposed VPN endpoints. The patch set spans Windows, Office, SQL Server, Exchange, SharePoint, Azure, and developer tools. [3]

Thomson Reuters Court Software Breach Exposed Records in 12 U.S. Jurisdictions

Thomson Reuters disclosed on September 2 that unauthorized access to its C-Track court case management platform exposed appellate court records across 12 U.S. jurisdictions and Ontario between March and June 2026. The breach potentially exposed names, Social Security numbers, medical information, and sealed court filings, with discovery occurring on June 30—three months after initial access. The company has not disclosed the attack vector or attribution, and affected courts face notification obligations for a vendor breach they could not independently detect. [4]