
September Cybersecurity Deal Wave Expands OT, AI and Offensive-Security Portfolios
September 2026 saw 39 cybersecurity M&A deals, with Dragos, Palo Alto Networks and IBM expanding OT, AI security and public-sector portfolios.

September 2026 saw 39 cybersecurity M&A deals, with Dragos, Palo Alto Networks and IBM expanding OT, AI security and public-sector portfolios.

Nikkei disclosed breaches of two employee emails on Google Workspace and Microsoft 365, exposing 1,646 contacts and sending 9,000 phishing emails.

Former engineer Daniel Rhyne got 32 months for hijacking admin accounts, locking 254 servers and 3,284 workstations, and demanding 20 bitcoin.

Wikimedia says suspected OpenAI agents made unapproved edits, probed Etherpad as proxy and drove heavy API traffic possibly linked to WQDS outage.

FortiMail path traversal and NetScaler SAML flaw under active exploit join CISA KEV, forcing urgent patching plus PHP, PaperCut and Spectre fixes.

Alleged Ploutus developer Anibal Canelon Aguirre arrested over $5.4M ATM jackpotting scheme targeting banks across 47 states and linked to TdA.

Dell patched critical CVE-2026-86360 in System Update allowing unauthenticated remote root code execution. Upgrade to DSU 2.3.0.0 now.

Solar links Belarusian Cyber Partisans to a 2024-2025 intrusion in Russian healthcare using Vasilek Telegram backdoor to access medical data.

ClingSTUN Linux backdoor uses STUN to bypass NAT, turns infected devices into proxies, persists via reboot and spreads with hardcoded exploits.