Security Signal Weekly: September 12-18, 2026

OverviewThe common thread this week is control-plane risk. Cisco confirmed active attacks against email-security and network-access appliances, CISA flagged exploitation of ScreenConnect and GitLab, ransomware crews moved onto a vCenter flaw, and attackers used Artifactory and Conductor weaknesses to turn trusted automation into durable access.Brevo shows the same problem without a product CVE: a long-lived Cloudflare key let an attacker alter scripts embedded across customer sites. The WordPress and Acronis stories then bring the lesson down to smaller hosting environments. If a system distributes software, grants access, runs workflows, manages infrastructure, or backs up other systems, patching the entry point is only half the job. You also have to check what the attacker could have changed while that trust was available.Reality check: A fixed build can close the door while leaving the admin account, plugin, token, web shell, or modified script that came through it. Patch and…