The Technology Briefing

• CISA's Known Exploited Vulnerabilities catalog lists flaws with confirmed real-world exploitation, distinct from vulnerabilities that are merely disclosed.
• Three vulnerabilities were added this week, spanning Cisco, Citrix and Fortinet products.
• CVE-2026-20079 affects Cisco Secure Firewall Management Center and carries the maximum CVSS score of 10.0.
• It is an authentication bypass that lets a remote, unauthenticated attacker execute script files on the device.
• Successful exploitation can grant the attacker root access to the firewall management system itself.
• Cisco says it first became aware of active exploitation attempts against the flaw in August 2026.
• CVE-2026-19490, scored CVSS 9.3, is an authentication bypass in Citrix NetScaler ADC and NetScaler Gateway.
• It applies when the NetScaler appliance is configured as an AAA virtual server or as an SSL VPN or RDP proxy gateway.
• CVE-2025-25249, scored CVSS 7.3, is a heap-based buffer overflow in Fortinet FortiOS, FortiSwitchManager and FortiSASE.
• Federal civilian agencies must patch all three by September 12, 2026 under CISA's binding operational directive.

10-point recap written from the linked reporting. The article itself is the source.

• MikroTik makes networking hardware and RouterOS, the operating system running on its routers.
• CISA added two RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalog this week.
• CVE-2026-67277 is described as a missing-authentication-for-critical-function vulnerability.
• That class of flaw lets an attacker reach a sensitive function without first proving who they are.
• CVE-2026-86060 involves improper handling of command argument delimiters, letting an attacker inject unintended commands.
• CISA's addition to the KEV catalog is based on confirmed evidence of active exploitation in the wild.
• MikroTik devices are widely used by small internet service providers and small businesses.
• That install base has historically made MikroTik routers an attractive target for botnet recruitment.
• CISA's alert does not name the threat actors behind the exploitation it observed.

9-point recap written from the linked reporting. The article itself is the source.

• Microsoft's September 2026 Patch Tuesday fixed close to 1,000 vulnerabilities, among the largest monthly totals it has shipped.
• Vulnerability counts from different security vendors range from about 966 to 974, reflecting different counting methodologies for the same release.
• Two of the fixed flaws were already being exploited as zero-days before patches were available.
• CVE-2026-81963 is an elevation-of-privilege vulnerability in the Windows Update Stack.
• Exploiting it lets an attacker who already has limited access escalate to SYSTEM-level privileges.
• CVE-2026-85880 is a separate elevation-of-privilege flaw in the Windows Advanced Local Procedure Call component.
• Both zero-days carry a CVSS score of 7.8, rated Important rather than Critical.
• CISA confirmed active exploitation of both flaws, prompting federal patch deadlines.
• Elevation-of-privilege bugs are typically used as a second stage after an attacker has already gained initial, limited access.

9-point recap written from the linked reporting. The article itself is the source.

• An Advance Passenger Information System database was found exposed to the open internet by researchers at Kinryū Labs.
• The exposed cluster used Elasticsearch, a database system commonly used for large-scale search and analytics.
• It held 210,318,069 passenger records and 10,465,631 crew records, a combined total above 220 million.
• Exposed fields included names, dates of birth, sex, nationality, and passport or travel-document numbers and expiration dates.
• The records span flights from January 2017 through April 2026, covering nine years of travel data.
• Researchers reached the database by chaining two separate security misconfigurations rather than exploiting one obvious flaw.
• The first layer initially returned an HTTP 401 Unauthorized response, blocking direct access from the open internet.
• A second, cloud-based access path bypassed that block and reached a cluster still using default credentials.
• Investigators traced the server's IP address to a range assigned to Viettel, a Hanoi-based telecommunications provider.
• No government authority or company has publicly confirmed ownership of the database as of this report.

10-point recap written from the linked reporting. The article itself is the source.

• Mathspace is an online mathematics learning platform used by schools in Australia and New Zealand.
• The breach affected 1,079,819 students, staff and parents, all located in Australia and New Zealand.
• Attackers exploited a vulnerability in Metabase, a self-hosted business intelligence and reporting tool Mathspace used internally.
• The flaw, CVE-2026-72898, was an SQL injection vulnerability that received the maximum CVSS score of 10.
• Metabase's developers patched the vulnerability on August 6, before Mathspace's systems were actually compromised.
• Unauthorized access to Mathspace's reporting system was first identified as having begun on August 10.
• Attackers downloaded data from the Australian reporting database on August 27, three weeks after the patch was available.
• Mathspace did not upgrade its own Metabase instance until August 29, after the download had already occurred.
• Exposed data included names, usernames, email addresses and account metadata, not passwords or academic records.
• Mathspace says no records linking user accounts to specific schools were included in the exposed data.

10-point recap written from the linked reporting. The article itself is the source.

• IDScan.net is an identity-verification company whose technology businesses use to scan and authenticate government-issued IDs.
• KrebsOnSecurity first reported the breach after being alerted to a new dark web identity-theft service.
• The service advertised digital scans of more than 153 million U.S. and Canadian driver's licenses.
• It also included 10 million ID cards, 3 million travel documents and 579,000 medical cards.
• Buyers of the service could search the database by name to retrieve a person's license photo and personal details.
• Krebs traced the data trove back to IDScan's identity-verification technology and infrastructure.
• IDScan.net has since confirmed that it experienced a data breach, according to TechCrunch's reporting.
• The FBI's New Orleans field office has opened a formal investigation into the apparent breach.
• The incident is separate from, but similar in scale to, other 2026 identity-document breaches reported this year.

9-point recap written from the linked reporting. The article itself is the source.

• Trezor is a maker of hardware cryptocurrency wallets used to store private keys offline.
• Attackers breached Brevo, a third-party email marketing platform Trezor uses to send customer newsletters.
• Using data from that breach, attackers sent phishing emails to 347,000 addresses starting September 9.
• The phishing emails impersonated Trezor and attempted to trick recipients into revealing sensitive wallet information.
• Trezor says approximately 2,500 recipients clicked the malicious link embedded in the phishing emails.
• The specific goal of this style of phishing attack is typically to obtain a victim's wallet recovery seed phrase.
• A recovery seed phrase, if obtained by an attacker, gives full access to drain the associated cryptocurrency wallet.
• This incident is separate from an earlier 2026 breach at ShipMonk, Trezor's shipping and logistics provider.
• That earlier ShipMonk breach exposed order data on 81,000 Trezor customers who ordered between May and August 2026.

9-point recap written from the linked reporting. The article itself is the source.

• Microsoft's current global data center capacity is estimated at about 12 gigawatts.
• Internal planning reported by Bloomberg targets more than 38 gigawatts of capacity by 2032.
• That would be more than triple Microsoft's current footprint over roughly six years.
• Bloomberg says the projected capacity would exceed the electricity New York State uses at peak demand.
• The report is based on people familiar with Microsoft's internal plans, not a public company announcement.
• Microsoft has not confirmed the 38-gigawatt figure in an official statement.
• The expansion would span Microsoft's global network of data centers, not a single site or region.
• Long-range infrastructure targets set six years out are routinely revised as costs, power availability and demand evolve.

8-point recap written from the linked reporting. The article itself is the source.

• Hscale is a data center developer backed by private equity firm Bain Capital.
• The company secured a contract worth more than $1 billion for hyperscale cloud capacity.
• The customer receiving that capacity has not been publicly named by either party.
• The specific data center site within Spain has also not been disclosed.
• Hscale has data centers in development in both Barcelona and Zaragoza, either of which could host the deal.
• Capacity under the contract is expected to become available to the client starting in 2027.
• The agreement could be extended to cover additional Hscale sites across the broader EMEA region.
• Reporting on the deal has specifically noted the unusual lack of disclosure around both customer and location.

8-point recap written from the linked reporting. The article itself is the source.

• Artemis III is NASA's planned mission to land astronauts on the Moon using the Space Launch System and Orion spacecraft.
• Teams at Kennedy Space Center's Vehicle Assembly Building stacked another pair of solid rocket booster segments.
• Four of the five segments on each twin booster are now stacked, leaving only the forward assemblies.
• Core Stage-3 engine work is proceeding in parallel with the booster stacking.
• Early processing work for the follow-on Artemis IV mission has also begun.
• NASA's Aerospace Safety Advisory Panel reviewed post-flight data from the Artemis II Orion capsule's return.
• That review confirmed a modified reentry profile sharply reduced Avcoat heat-shield char loss compared with Artemis I.
• Heat-shield char loss on Artemis I had been the central technical problem delaying the Artemis program for more than two years.
• Photos from the launch pad show some interfaces on the Tail Service Mast Umbilicals missing quick-disconnect plates.
• That configuration may reflect a design change addressing leaks found during Artemis II processing, though NASA has not confirmed the reason.

10-point recap written from the linked reporting. The article itself is the source.

• Starship Flight 15 hardware, Booster 22 and Ship 42, is already undergoing cryogenic proof testing at Starbase.
• Cryogenic proof testing loads a vehicle's tanks with liquid oxygen and liquid nitrogen to confirm structural integrity under flight-like pressure and temperature loads.
• Ship 42 completed two earlier cryo-proof campaigns before this latest round of testing.
• Flight 15 could launch roughly a month after Flight 14, contingent on Flight 14's results.
• Flight 14's hardware, Booster 21 and Ship 41, has not yet received a confirmed launch date.
• SpaceX is targeting a Flight 14 launch around mid-September 2026.
• Both Flight 14 vehicles remain at SpaceX's Starbase Production Site awaiting rollout to Pad 2.
• If Flight 14 meets its objectives, SpaceX could attempt to catch the booster, the ship, or both on Flight 15.
• Any Pad 2 catch attempt would remain contingent on vehicle health and regulatory approval.

9-point recap written from the linked reporting. The article itself is the source.

• USSF-153 is a classified national security satellite mission for the U.S. Space Force.
• It launched aboard a SpaceX Falcon 9 from Space Launch Complex 4 East at Vandenberg Space Force Base.
• The Falcon 9's first stage, booster B1081, was flying for its 27th mission.
• Space Systems Command says specific mission and payload details remain classified.
• An undisclosed number of satellites were carried to low Earth orbit.
• The booster landed successfully on the SpaceX droneship Of Course I Still Love You.
• That landing was the 224th successful booster recovery on that specific droneship.
• It was also the 660th successful Falcon booster landing across SpaceX's entire fleet.
• Booster B1081's prior flight history includes four NASA missions and two each for the National Reconnaissance Office and European Space Agency.

9-point recap written from the linked reporting. The article itself is the source.

• C-Infinity is a Mountain View, California-based manufacturing software company.
• AutoAssembler v4 will be introduced at IMTS 2026, a major manufacturing technology trade show.
• The software uses artificial intelligence combined with physics-based reasoning to analyze product designs.
• It converts CAD models directly into manufacturing process plans without manual translation by engineers.
• The system checks for interference, misalignment, infeasible configurations and tool-access problems before production begins.
• It can also flag assembly-sequencing problems and suggest design-for-assembly improvements.
• AutoAssembler can automatically generate bills of materials and bills of process directly from the product model.
• When a product design changes, the software updates affected production plans rather than requiring a full manual re-evaluation.
• The platform connects to existing CAD and product lifecycle management systems used by manufacturers.

9-point recap written from the linked reporting. The article itself is the source.

• TSMC is the world's largest contract chip manufacturer, fabricating chips designed by companies like Nvidia and Apple.
• August 2026 revenue came in at approximately NT$514.8 billion.
• That figure is up 53.3% compared with August of the prior year.
• It marks the first time TSMC's monthly revenue has broken the NT$500 billion threshold.
• Revenue was also up 10.1% compared with the preceding month, July 2026.
• Cumulative revenue for January through August 2026 totaled NT$3.39 trillion.
• That year-to-date figure represents 39.3% growth compared with the same period in 2025.
• TSMC has raised its full-year 2026 revenue guidance to slightly above 40% growth in U.S. dollar terms.
• The company attributed the growth specifically to continued strong demand tied to AI chip manufacturing.

9-point recap written from the linked reporting. The article itself is the source.

• Deep ultraviolet, or DUV, lithography is the older of the two major chip-patterning technologies, a generation behind extreme ultraviolet.
• ASML of the Netherlands is currently the dominant global supplier of advanced lithography systems, including EUV tools.
• U.S. export restrictions have limited China's access to the most advanced ASML equipment.
• TrendForce reports that Huawei is backing a domestic effort to build Chinese-made DUV lithography systems.
• SMIC, China's largest chip foundry, is reportedly now testing these domestically built systems on its production lines.
• Industry sources cited by TrendForce target roughly 12 domestic DUV systems completed by the end of 2026.
• The effort is part of a broader Chinese push to reduce dependence on foreign semiconductor equipment makers.
• DUV tools remain sufficient for many mature chip processes and some advanced nodes, even though they trail EUV capability.
• Neither Huawei nor SMIC has issued an on-the-record public statement confirming the specific systems or timeline.

9-point recap written from the linked reporting. The article itself is the source.

• Qualcomm is best known as a fabless designer of mobile and PC chips, including its Snapdragon line.
• Amazon Web Services operates the cloud infrastructure and data centers behind Amazon's cloud computing business.
• The two companies announced a multi-generational product collaboration on September 8, 2026.
• The deal is reported at roughly $4 billion, covering multiple future product generations.
• The initial focus is optical connectivity solutions for AI data centers, scaling up to 1.6 terabits per second.
• Future generations of the collaboration are expected to extend beyond that 1.6T connectivity standard.
• Qualcomm says it will deepen its own use of AWS AI infrastructure, including Amazon Bedrock, as part of the deal.
• That AWS infrastructure will be applied to Qualcomm's own electronic design automation workloads.
• Qualcomm's stated goal for that use is to shorten its internal chip design cycles.
• The partnership extends Qualcomm's chip business beyond its traditional mobile and PC markets into data center interconnects.

10-point recap written from the linked reporting. The article itself is the source.

• Samsung Electronics shares fell 3.5% in Seoul trading on Friday, September 11.
• SK Hynix shares fell 2.2% in the same session.
• The trigger was DeepSeek saying it has reduced the amount of high-bandwidth memory its AI models require.
• Local retail traders have sold about $10 billion of Samsung and SK Hynix shares so far in September.
• Both stocks remain more than 25% below their all-time highs.
• Samsung trades at about 2.7 times book value and SK Hynix at about 5 times, against about 11 times for the Philadelphia Semiconductor Index.
• Korean memory stocks trade at roughly 4 times forward earnings, compared with about 19 times for a gauge of global chipmakers.
• Daily swings of 5% or more remain common in both stocks.
• Bloomberg's report weighs the selloff against how cheaply the two stocks already trade compared with global peers.

9-point recap written from the linked reporting. The article itself is the source.