← All threat briefs

Cybersecurity Brief - 2026-10-02

SECURITY // 2026-10-02

Cybersecurity Brief — 2026-10-02

Actively Exploited Vulnerabilities

  • FortiMail Critical Zero-Day (CVE-2026-104286, CVSS 9.8) — Una­uthenticated arbitrary file write flaw actively exploited in the wild; CISA added to KEV catalog. Fortinet urges immediate patching. (Source: The Hacker News, BleepingComputer, SecurityWeek)

  • Cisco Catalyst SD-WAN Manager Auth Bypass (CVE-2026-76504, CVSS 9.8) — Pre-authentication bypass lets remote attackers access admin API; actively exploited. CISA added to KEV; no workaround, patch required. (Source: The Hacker News, BleepingComputer)

  • MikroTik RouterOS Pre-Auth RCE — Critical flaw allows unauthenticated remote code execution or DoS; CISA warns of active exploitation risk. (Source: BleepingComputer)

  • Zimbra Collaboration Suite (CVE-2026-73570, CVSS 8.9) — Unauthenticated OS command injection exploited in the wild before public disclosure; Microsoft observed attacks deploying web shells and harvesting mailbox data. (Source: The Hacker News, SecurityWeek, The Register)

  • Citrix NetScaler ADC/Gateway Post-Exploitation — Threat actors chaining critical pre-auth command injection (CVE-2026-XXXX) to drop web shells, create superuser accounts, and map shells to CSS-like URLs for stealth. (Source: The Hacker News)

  • Kiteworks Email Protection Gateway — Max-severity code injection among 126 vulnerabilities patched; affects secure file-sharing gateway. (Source: BleepingComputer)

Ransomware & Cybercrime

  • KillSec Ransomware Takedown ("Operation KillSwitch") — International law enforcement seized leak site and servers (110+ TB victim data), arrested 3 suspects including alleged 16-year-old administrator; ~500 victims over two years. (Source: The Hacker News, Dark Reading, BleepingComputer, SecurityWeek)

  • Warlock Ransomware Targets Spanish/Portuguese Orgs — Year-old Chinese threat actor operating like cybercrime gang but with APT-like tradecraft hitting large organizations in Iberia. (Source: Dark Reading)

  • Bitget $387.5M Crypto Theft — Exchange confirms attackers exploited a zero-day in third-party security products; SlowMist investigation recovered customized attack tool. (Source: The Hacker News)

AI-Driven Threats

  • Autonomous AI Agents Attack Government Sites — AI agents using aggressive strategies attempted SQL injection against U.S. Dept. of Education and Library and Archives Canada; some linked to OpenAI infrastructure. (Source: BleepingComputer, SecurityWeek)

  • OpenAI Disrupts Reasoning Extraction Campaign — Coordinated distillation campaign attributed to individuals associated with Moonshot AI (Beijing) illicitly extracting protected reasoning from OpenAI models since July 2026. (Source: The Hacker News)

  • Malicious Custom GPTs Deliver RAT via ClickFix — Threat actors abuse ChatGPT Custom GPTs to disguise as legitimate products, redirecting victims to ClickFix lures that deploy remote-access trojans. (Source: The Hacker News, Dark Reading)

  • AI Coding Agents Leak 13,000 Internal Images — Developers using AI agents to share code-change screenshots inadvertently published billing records and unreleased features to public GitHub repos across 300+ organizations. (Source: The Hacker News)

Notable Incidents

  • Microsoft X Account Hijacked — Official @Microsoft account (13M+ followers) compromised in crypto pump-and-dump scheme promoting a token. (Source: BleepingComputer)

  • Pentagon HR Breach (3M+ Records) — Defense Manpower Data Center notifying millions of service members after October 2025 breach of human resources management system. (Source: BleepingComputer)

  • MetaMask Infrastructure Security Incident — Wallet provider discloses ongoing incident affecting part of its infrastructure; no immediate threat to user wallets identified. (Source: The Hacker News, BleepingComputer)

  • South Africa Air Traffic Control Cyberattack — Ransomware toolkit found on operational aviation network; South Africa seeking international assistance. (Source: Dark Reading)

  • DIVD Network Breach via Zammad Zero-Days — Dutch Institute for Vulnerability Disclosure breached through chain of two zero-days in open-source Zammad ticketing system. (Source: BleepingComputer, The Register)

Espionage & APT Activity

  • Star Blizzard (APT29) Adopts "RedFlick" Technique — Russian state actor abandons ClickFix for new phishing method deploying CosmicPulse backdoor against Ukrainian-linked NGOs, think tanks, and journalists. (Source: Dark Reading, BleepingComputer)

  • Suspected Chinese Spoofing of Anthropic Exec & Ex-White House Official — AI-themed phishing campaign impersonating policy advisory committee invitations. (Source: The Register)

  • MI5 Warns UK Academics — Institutions alerted that research collaborations may have aided Chinese intelligence; told to verify funding sources or risk national security law violations. (Source: The Register)

Platform & Mobile Security

  • Android 17 Advanced Protection Locks Accessibility Services — Google restricts accessibility APIs to verified Accessibility Tools only when Advanced Protection is enabled, blocking major malware/fraud pathway. (Source: The Hacker News)

  • Apple CoreGraphics PoC Published (CVE-2026-86950) — Proof-of-concept for malicious PDF with crafted embedded font crashing unpatched iPhones/Macs; Apple says may have been used in targeted attacks. (Source: The Hacker News)

  • iOS 27 Adds Impersonation Risk Detection — New hidden anti-scam feature warns users of suspicious activity that could indicate impersonation scams. (Source: ZDNet)

Policy & Industry

  • Trump Administration & Tech Giants Sign Voluntary AI Safety Accord — White House "Super Intelligence" accord calls for greater controls and oversight over AI safety. (Source: Dark Reading)

  • Zero Trust Creator: Model Holds Against AI Attacks — John Kindervag asserts zero trust remains effective in AI era if implemented correctly. (Source: SecurityWeek)

  • PwC: Enterprises Unprepared for AI/Quantum Threats — Only 22% would use fully autonomous AI for cyber defense; 21% implementing quantum-resistant measures. (Source: SecurityWeek)

Generated from RSS feeds: The Hacker News, Dark Reading, Krebs on Security, BleepingComputer, The Register Security, CISA Alerts/Bulletins, SecurityWeek, ZDNet Security