RF Wave

Revolut breached and more - Sept 20, 2026

Revolut breached and more - weekly security news and updates roundup for Sept 13-20, 2026

  • vulnerability
  • data breach

Revolut has revealed they were victim of a data breach

The attacker impersonated a government agency, and tricked Revolut into disclosing customer financial information and passport data

This Week’s Updates

Breaches

  1. Japan’s Digital Agency confirms a VPN flaw exposed roughly 246,000 personnel records of government employees
  2. CenterPoint Energy confirms customer personal information was stolen after an attacker leaked data allegedly taken from the utility
  3. Admin Menu Editor Pro’s developer confirms a compromised update server pushed a backdoored WordPress plugin update to roughly 1,500 sites
  4. Brevo confirms attackers stole a Cloudflare API key and used it to inject ClickFix malware scripts into its site and customer-embedded JavaScript
  5. Gyazo confirms a server vulnerability let hackers steal 23.6 million user records from the image-sharing platform

Vulnerabilities

  1. Hackers exploit a critical Tencent Sogou Input Method flaw tracked as CVE-2026-51990 to deploy the GrayRabbit backdoor
  2. CISA warns hackers are now exploiting GitLab’s patched max-severity path traversal flaw, CVE-2026-85706
  3. Cisco patches a critical Secure Email Gateway zero-day that attackers were already exploiting to execute commands as root
  4. CISA warns ransomware gangs have joined attacks exploiting a critical VMware vCenter RCE flaw patched in July
  5. Hackers actively exploit a patched WooCommerce Wholesale Lead Capture plugin flaw, CVE-2026-27540, to upload PHP backdoors to WordPress sites
  6. Acronis discloses a high-severity, actively exploited Linux privilege escalation flaw in its cPanel, WHM, and Plesk backup plugin
  7. Google patches an actively exploited Android zero-day among 110 flaws fixed in its September Pixel security update
  8. CISA warns a critical ConnectWise ScreenConnect vulnerability is now being actively exploited in attacks
  9. Cisco releases patches for a max-severity Identity Services Engine zero-day that attackers are actively exploiting
  10. Check Point patches a critical flaw that let attackers execute code with root privileges on its management systems
  11. Researcher’s BragJack attacks earn two CVEs and over $20,000 in bounties after hijacking AI agents in five browsers, since patched by Google and Microsoft