Security.io Daily Headlines — Monday, September 14, 2026
Five equally weighted developments: what happened and the leadership decision each creates.
Episode transcript
602 words · Sponsor after story threeThis is Max Vogal from Security.io with today’s Daily Headlines for Monday, September 14, 2026. Here are the top five security developments shaping today’s decisions—what happened, why each matters now, and the leadership action to consider.
The CRA reporting clock is running — and the weekend exposed an operational caveat
What happened
Manufacturers of products with digital elements made available in the EU must now operationalise a 24-hour early warning, a 72-hour notification and subsequent final reporting through ENISA’s Single Reporting Platform. The scope covers mandatory notification of actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements.
The leadership decision
Security leaders should name an accountable CRA reporting owner and deputy. Treat the moment reliable exploitation or severe-incident evidence reaches any relevant product, security or engineering function as a controlled governance event. Define who records that timestamp, who determines scope and who can authorise an early warning with incomplete facts.
GitLab file-read flaw enters KEV with Monday’s deadline
What happened
GitLab fixed CVE-2026-85706 in 19.1.8, 19.2.6 and 19.3.2. CISA added the unauthenticated repository-API file-read vulnerability to KEV on Friday, placing patch verification and compromise assessment on Monday’s agenda. On 10 September 2026, GitLab released versions 19.3.2, 19.2.6 and 19.1.8 to address CVE-2026-85706 and other security issues.
The leadership decision
Security leaders should inventory all self-managed GitLab CE and EE instances. Separate the deployment decision from the compromise decision. Platform engineering should patch every affected instance, but incident response must independently assess pre-patch reachability, suspicious repository-API requests and files accessible under the GitLab service account.
Revolut released customer records after fraudulent government requests
What happened
Revolut confirmed that an unauthorised third party used a legitimate government agency email domain to obtain sensitive customer information. The company says systems and funds were unaffected, while the agency, affected count, markets and technical route remain undisclosed.
The leadership decision
Security leaders should require out-of-band verification for sensitive government data requests. Treat government and law-enforcement disclosure workflows as privileged data-access systems. Require independent verification using a pre-established agency directory or known contact, validate legal authority and minimise each response to the approved customer and data scope.
ScreenConnect joins KEV: check clients and remote-session evidence
What happened
ConnectWise released ScreenConnect 26.6.5 for CVE-2026-84869 after an earlier mitigation notice. CISA added the flaw to KEV on Friday, changing the Monday task from advisory tracking to version proof and session-level compromise review. On 3 September 2026, ConnectWise published interim mitigation guidance before a security update was generally available.
The leadership decision
Security leaders should inventory cloud and on-premises ScreenConnect deployments. Assign remote-support platform ownership at control-plane level. Require an inventory spanning internal instances, MSP-managed tenants, embedded RMM integrations and off-maintenance deployments. Cloud-hosted status should be verified rather than assumed, while every on-premises deployment needs authenticated version evidence from the instance owner.
Brevo SSO boundary failure turned Trezor email into a phishing channel
What happened
Brevo says a SAML SSO boundary failure exposed 138 customer accounts; six sent phishing and 43 had contacts exported. Trezor says roughly 347,000 newsletter addresses were targeted and 2,500 recipients clicked before the malicious destination was disabled.
The leadership decision
Security leaders should ask communications vendors to attest to post-SSO tenant isolation. Require evidence that SaaS identity federation binds every authenticated session to the organisation that owns the identity-provider configuration. A generic statement that SSO is supported is insufficient. Treat outbound customer communications as a privileged channel.
That’s Security.io Daily Headlines for Monday, September 14, 2026. Full reporting, sources, executive actions and today’s comic are available in the complete edition at Security.io. I’m Max Vogal. Thanks for listening.