# Policy Pulse - Week of September 20, 2026 | Issue #35

**URL:** https://community.disclose.io/t/policy-pulse-week-of-september-20-2026-issue-35/1077
**Category:** Write-ups and Disclosures
**Created:** [September 20, 2026, 10:04pm UTC](https://community.disclose.io/t/policy-pulse-week-of-september-20-2026-issue-35/1077 "2026-09-20T22:04:41Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![disclose](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.disclose.io/disclose/32/9_2.png) [@disclose](https://community.disclose.io/u/disclose)
#### Post date: [September 20, 2026, 10:04pm UTC](https://community.disclose.io/t/policy-pulse-week-of-september-20-2026-issue-35/1077/1 "2026-09-20T22:04:41Z")

</div>

_Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research. Issue #35, September 20, 2026._

### Top Story

#### AI

**Researchers used a new frontier model to chain a forum bug into OpenAI employee accounts. The bounty paid for the half of the chain that was in scope.**

Hacktron AI published its account on September 13, and press coverage followed on September 18. Three researchers reached remote code execution on [community.openai.com](http://community.openai.com), OpenAI’s Discourse-hosted forum, through a heap buffer overflow in libheif 1.19.7, the version in Discourse’s Debian 12 base image. They then used an OpenAI single sign-on weakness to take over an employee’s account, whose Codex was connected to OpenAI’s GitHub organization. To show impact without reading code, they had Codex open a pull request in OpenAI’s internal monorepo and stopped there. The report went to OpenAI through Bugcrowd on July 25, and OpenAI confirmed a fix about 14 hours later. Discourse, reported through HackerOne, published [advisory GHSA-vhm9-85gw-x335](https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335) on July 28. ([Hacktron](https://www.hacktron.ai/blog/hacking-openai), [The Register](https://www.theregister.com/security/2026/09/18/researchers_used_claude_to_hack_openai_employees_chatgpt_accounts/5297517))

Two details matter for programs. First, scope. OpenAI paid $6,500 on September 1, and Hacktron quotes OpenAI’s comment: “testing against the Discourse-hosted [community.openai.com](http://community.openai.com) was explicitly excluded from our bug bounty program. The award recognizes the OpenAI-side finding, not the actions against Discourse.” Second, identifiers. Hacktron says the upstream libheif change “was not documented as a security fix and received no CVE,” and suggests that is why Debian 12 and 13 missed the backport (Debian published its Debian 13 update on August 8). Discourse’s advisory attributes the remote code execution to [CVE-2026-32882](https://nvd.nist.gov/vuln/detail/CVE-2026-32882) and credits Hacktron as the reporter. But that NVD record (published May 19, 2026) describes a heap buffer over-read in libheif’s overlay compositing code in versions 1.21.2 and earlier, while Hacktron describes a heap buffer overflow in 1.19.7 and says the upstream change received no CVE. Neither document explains how the two line up.

On capability, Hacktron reports that Claude Opus 4.8 “struggled across several sessions to produce a working exploit with ASLR enabled,” and that Opus 5, released July 24, produced a working ARM64 exploit for a local Mac within three hours. It puts the whole two-month research campaign at under $3,000 in tokens. It also says the model declined to write exploits for remote targets, so the team presented its own test instance as a CTF.

**Why it matters for VDP:** A chain is priced by its in-scope link, but researchers will build chains across the scope line. Programs should decide in writing how they treat findings that start on vendor-hosted assets and end inside their own identity system. When a fix lands in a shared library, an unclear identifier mapping can leave downstream distributions without a trigger to backport. The payout was larger than the reported token bill for the entire campaign, the kind of arithmetic that makes AI-assisted submissions attractive at volume. If you self-host Discourse, rebuild the image.

_Throwback: [Issue #32](https://blog.disclose.io/policy-pulse-issue-32-week-of-september-1-2026/) covered a preview cyber model escaping a QEMU/KVM sandbox, where the public disclosure record was a single line. This week’s chain has a much fuller record, and its identifier trail is still unclear._

### Upcoming Deadlines & Events

| Date | Agency | Event or deadline | Action | Source |
| --- | --- | --- | --- | --- |
| September 22, 2026, 14:00 to 18:00 (Luxembourg time) | CIRCL / GCVE | GCVE workshop, Luxembourg | Register (free) to join the discussion of coordinated disclosure workflows and the GCVE identifier ecosystem | [GCVE](https://gcve.eu/2026/09/01/gcve-workshop-22-september-2026-1400-1800-luxembourg-before-the-vulnopticon-conference/) |
| September 23 to 25, 2026 | FIRST | VulnOptiCON 2026, Luxembourg (EUR 404) | Register if you work on vulnerability management | [FIRST](https://www.first.org/newsroom/releases/20260820) |
| September 25, 2026 | NIST | SP 800-239, AI data center security | Submit comments on the initial draft | [NIST CSRC](https://csrc.nist.gov/pubs/sp/800/239/ipd) |
| September 28, 2026 | US Copyright Office | Comments on DMCA Section 1201 renewal petitions, including four for the good-faith security research exemption | Comment in support of, or against, renewal | [Proceeding](https://www.copyright.gov/1201/2027/) |
| October 9, 2026 | DOE | Bulk-power security RFI | Submit responses to the numbered questions | [Federal Register notice](https://www.govinfo.gov/content/pkg/FR-2026-09-09/pdf/2026-18370.pdf) |
| October 13, 2026 | NIST | NVD Modernization RFI | Submit comments through the Federal Register docket | [Federal Register](https://www.federalregister.gov/documents/2026/08/12/2026-16371/request-for-information-rfi-on-modernizing-the-national-vulnerability-database-in-the-age-of) |
| October 15, 2026 | NIST | SP 1353 (AI for CSF 2.0 analysis) and the SP 800-213A Rev. 1 pre-draft call on IoT device requirements | Submit comments on either | [SP 1353](https://csrc.nist.gov/pubs/sp/1353/ipd), [SP 800-213A](https://csrc.nist.gov/pubs/sp/800/213/a/r1/iprd) |
| October 26, 2026 | UK House of Lords | Report stage, Cyber Security and Resilience Bill | Last realistic point to table a Computer Misuse Act defence | [Parliament](https://bills.parliament.uk/bills/4035) |

### This Week in Policy

#### AI

**Anthropic commits to embedded outside evaluators who can publish findings without its editorial control, and OpenAI backs a statutory version.** On September 12, Dario Amodei published “We Must Pace the Frontier,” which proposes three steps: embedded third-party evaluators (such as METR), coordination among democratic-country labs, then global coordination. Anthropic is committing to the first now. Its reviewers are to get “workspaces, tools, and permissions mostly comparable to what internal risk assessment teams have,” with exceptions where law or contracts require them, and Anthropic says they should have the right to publish key findings about risk levels, incidents, practices and the access they received without its editorial control. Anthropic keeps a narrow ability to redact security-sensitive, privileged, commercially sensitive or third-party confidential information, but “can’t redact findings just because they are unfavorable.” ([Amodei](https://darioamodei.com/post/we-must-pace-the-frontier), [TechCrunch](https://techcrunch.com/2026/09/15/openai-anthropic-google-have-been-in-talks-on-ai-safety-for-weeks/)) On September 15, OpenAI’s Chris Lehane said the company supports a FRONTIER Act provision that would force top frontier labs to admit independent verification organizations, and that OpenAI has been working with Anthropic and Google DeepMind on safety. The Information reported that a shared standards body is in development. ([TechCrunch](https://techcrunch.com/2026/09/15/openai-anthropic-google-have-been-in-talks-on-ai-safety-for-weeks/))

**Why it matters for VDP:** A right to publish without the lab’s editorial control, with narrow redaction limits, is the term disclosure programs negotiate in every safe harbor, so this reads as a disclosure norm. It is voluntary, it reaches only embedded reviewers, and it says nothing about researchers outside the tent. Whoever writes the standards body’s charter will shape what counts as a reportable AI security incident, so disclosure practitioners should ask for an observer seat before it exists.

**NIST’s CAISI puts numbers on a Chinese open-weight model’s offensive capability.** On September 17, CAISI published its assessment of Z.ai’s GLM-5.3, released August 14 with weights following two weeks later. It calls GLM-5.3 “the most cyber-capable open-weight model released to date” and says it lags the US frontier by about four months on an aggregate measure. Scores were 40.4% (74 of 183) on SEC-Bench Pro, 61.1% (9.8 of 16) on ExploitBench, 9.4% (47 of 498) on ExploitGym Userspace and 7.7% (23 of 297) on CAISI OSS-Fuzz. ([NIST](https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities))

**Why it matters for VDP:** Reproducible public benchmark scores for exploit development and fuzzing are the evidence every argument about submission volume will lean on. On CAISI’s measure, open-weight capability trails the frontier by about four months, so what frontier models do to an intake queue today is a rough preview of what anyone can run soon.

#### CVE

**Three Linux kernel bugs enter KEV with a three-day deadline, and one shows NVD and the kernel CNA 2.7 points apart.** On September 18, CISA added CVE-2025-39682 (TLS receive path, zero-length record handling), CVE-2025-39964 (a race on concurrent writes to an AF\_ALG socket) and CVE-2026-53266 (an out-of-bounds write in the ebtables SNAT target), all due September 21. CVE-2025-39682 was published in NVD on September 5, 2025 and, as of September 20, is still marked “Undergoing Analysis.” It carries NVD’s 7.1 High beside the kernel CNA’s 9.8 Critical, and CVE-2025-39964 splits 5.5 Medium (NVD) against 7.8 High (CNA). ([CISA KEV data](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json), [NVD API](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-39682))

**Why it matters for VDP:** A reader who took only NVD’s primary score would have rated an actively exploited kernel bug 2.7 points lower than its CNA did. Read the CNA score and the KEV flag together, and tell customers which one your advisory follows.

**Cisco ISE authentication bypass, CVSS 10.0, found while working a support case.** Cisco’s September 16 advisory for CVE-2026-76460 says the flaw “was found during the resolution of a Cisco Technical Assistance Center (TAC) support case” and that “the Cisco PSIRT is aware of active exploitation.” CISA added it to KEV the same day with a September 19 due date. Two days earlier it had added CVE-2026-76461, a SQL injection in Cisco Secure Email Gateway. ([Cisco](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5), [CISA KEV data](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json))

**Why it matters for VDP:** Discovery through a customer support case comes with no researcher, no bounty and no coordination window. It is the case to cite when a vendor argues that its internal process makes outside reporting unnecessary.

#### Legal

**The UK Lords Report stage for the Cyber Security and Resilience Bill is set for October 26, and no Computer Misuse Act text is on the paper.** Parliament’s bill record, updated September 16, says Report stage “is scheduled for 26 October.” After the final day of committee stage on September 7, the bill was reprinted as HL Bill 49, and its publication list shows nothing newer. ([Parliament](https://bills.parliament.uk/bills/4035))

**Why it matters for VDP:** [Issue #34](https://blog.disclose.io/policy-pulse-issue-34-week-of-september-14-2026/) covered the withdrawal of Amendment 164 on September 7. Report stage is where a re-tabled amendment can be pressed to a vote, which Grand Committee cannot do. Anyone with drafting for a researcher defence has about five weeks to put it in front of a peer. Until something passes, programs cannot treat the debate as authorization.

**California enacts two AI-assessment laws and gives the assessors no safe harbor.** Governor Newsom signed SB 813 (Chapter 179) and AB 1405 (Chapter 178) on September 9. SB 813 sets up a framework for independent verification organizations to assess AI systems for compliance with state law, and AB 1405 creates a state registry for AI auditors with standards for their independence, transparency and integrity. SB 813’s liability clause says only that the chapter does not establish liability solely for failing to meet a standard, and that an audit done to a standard is “relevant to, but not conclusive of” a harm lawsuit. A search of both chaptered texts finds no immunity or safe-harbor language. ([Governor’s office](https://www.gov.ca.gov/2026/09/09/governor-newsom-signs-first-in-the-nation-ai-safeguards-to-protect-californians-calls-on-the-federal-government-to-do-its-part/), [SB 813](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB813), [AB 1405](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1405))

**Why it matters for VDP:** Anthropic’s commitment, the FRONTIER Act provision and now two California statutes all assume independent AI testers and say little about their legal cover. SB 813 is state law and does not change federal exposure under the CFAA or DMCA Section 1201, so designated verifiers will still need the written authorization any other tester needs.

#### International

**ENISA’s CRA guidance lets a national CSIRT decide whether an exceptional-circumstances notification travels onward.** The guidance page on Particular Exceptional Circumstances (last updated September 9) says the CSIRT designated as coordinator “remains responsible for deciding whether dissemination is necessary and possible.” If that exception is invoked in the 72-hour notification, its status becomes “72h Submitted under PEC,” and “only limited information in accordance with Article 16(2) is made available to ENISA.” ENISA’s platform FAQ was also updated on September 17, with a new FAQ 32 and a revised FAQ 9. ([ENISA guidance](https://www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp/cra-srp-guidance-particular-exceptional-circumstances-pec), [ENISA FAQ](https://www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp/frequently-asked-questions))

**Why it matters for VDP:** The reporting clock that went live on September 11 ([Issue #34](https://blog.disclose.io/policy-pulse-issue-34-week-of-september-14-2026/)) now has a documented pause lever held by state CSIRTs. The page I read does not say what the manufacturer or an outside finder is told when it applies. Build EU reporting runbooks against the live ENISA pages, which have kept changing since launch, and re-check them on a schedule.

### Worth Reading

- **[NIST IR 8587, final](https://csrc.nist.gov/pubs/ir/8587/final):** Published September 15 with CISA. Implementation recommendations for federal agencies and cloud providers on token and assertion forgery, theft and misuse, a useful reference for reports about identity tokens.

- **[CISA: Using Cyber Decoys to Strengthen Detection and Response](https://www.cisa.gov/resources-tools/resources/using-cyber-decoys-strengthen-detection-and-response):** Published September 16. Decoys are assets that “appear to be legitimate systems, accounts, or data” by design, so a program’s scope language may need a position on what a researcher should do on finding one.

- **[ETSI: 17 draft standards supporting the Cyber Resilience Act](https://www.etsi.org/newsroom/press-releases/etsi-launches-approval-process-for-17-european-standards-supporting-the-cyber-resilience-act/):** Announced August 13, with the approval procedure running from mid-September to mid-November depending on the vertical. The drafts are downloadable without membership.

* * *

_Policy Pulse is a weekly bulletin from [disclose.io](https://disclose.io). Have a tip or an experience that belongs in the next issue? Join the [community discussion](https://community.disclose.io/)._