← All threat briefs

Cybersecurity Brief - 2026-10-07

SECURITY // 2026-10-07

Cybersecurity Brief — 2026-10-07

Critical Vulnerabilities & Active Exploitation

  • Atlassian Data Center: Critical unauthenticated file-read flaw (CVE-2026-21589, CVSS 9.3) affects 8 self-hosted products including Jira, Confluence, and Bitbucket. Attackers who know a file's exact path can read it without authentication. Patches available. (Source: The Hacker News, BleepingComputer, SecurityWeek)

  • FortiMail zero-day (CVE-2026-104286, CVSS 9.8) added to CISA KEV after reports of active exploitation. Unauthenticated attackers can write arbitrary files on the underlying system. Fortinet has released patches. (Source: The Hacker News)

  • Cisco Catalyst SD-WAN Manager authentication bypass (CVE-2026-76504, CVSS 9.8) added to CISA KEV. Actively exploited in the wild; allows unauthenticated remote attackers to access the Manager's API as admin. Fixed releases available; no workaround. (Source: The Hacker News, The Register)

  • Dell Container Storage Modules (CSM) critical flaws include CVE-2026-63688 (CVSS 10.0) — missing authentication in the csm-authorization-storage gRPC server enabling unauthenticated admin access and root on Kubernetes nodes. Dell has released security updates. (Source: The Hacker News, BleepingComputer)

  • Microsoft Exchange Server privilege escalation (CVE-2026-96940, CVSS 8.8) allows authenticated attackers to read other users' mailboxes via weak authorization. Out-of-band updates released. (Source: The Hacker News)

  • Rejetto HFS servers actively scanned for CVE-2026-61500 (weak signing key) enabling session forgery, account takeover, and RCE. (Source: BleepingComputer)

Major Incidents & Breaches

  • FBI ShinyHunters breach via unpatched Oracle PeopleSoft (CVE-2026-35273) exposed personal data of 5,000+ bureau employees including SSNs, psychiatric/medical files, and job roles. ShinyHunters bypassed Mandiant WAF rules using URL-encoding tricks. FBI removed an Accenture contractor over the missed patch. (Source: The Hacker News, SecurityWeek, Krebs on Security)

  • Denmark CPR breach: 8.8 million records accessed — attackers used a private Danish company's lawful access to the Central Person Register to exfiltrate names, addresses, and personal ID numbers of living and deceased individuals. (Source: The Hacker News, BleepingComputer)

  • Bitget confirms third-party zero-day behind $387.5M crypto theft — SlowMist investigation identified a zero-day in third-party security products and recovered a customized attacker tool. (Source: The Hacker News)

  • Arizona court system breach: 1M+ people affected — personal information copied from records dating back 30 years. (Source: SecurityWeek)

  • ASOS confirms data breach after hackers sent "HACKED" push notifications via its mobile app, claiming theft from the company's Snowflake environment. (Source: BleepingComputer)

  • Nikkei discloses breaches of employee Microsoft/Google email accounts — one compromised account used to send thousands of phishing emails. (Source: BleepingComputer)

  • Trump Mobile breach: BYOD ransomware leaks 3,615 customers — data includes names, emails, phones, addresses, order details. Attackers accessed via Liberty Mobile infostealer; neither provider used MFA. (Source: The Register)

Malware & Threat Campaigns

  • 100+ compromised websites deliver LunexStealer via fake Cloudflare checks — CERT-UA attributes the campaign to UAC-0277. Malicious JavaScript injected into legitimate sites serves the info-stealer (aka Psychedelic Stealer). (Source: The Hacker News)

  • Fake AI chatbot ad portals steal credentials & MFA codes — campaign impersonates ChatGPT, Gemini, Claude, Perplexity, Meta Muse, and Manus advertising products. Uses browser-in-browser attacks to capture login credentials and MFA. (Source: The Hacker News, BleepingComputer)

  • ClickFix attacks evolve: payloads smuggled via browser cache & DNS TXT records — Microsoft Threat Intelligence reports sites pre-fetch scripts into browser cache disguised as PNG files, bypassing Windows Run limits. DNS TXT records also used to hide payloads. (Source: The Hacker News, Dark Reading, BleepingComputer)

  • Linux backdoors mimic Asian email security tools — trio of backdoors targeting telecom/network appliances in South Korea and Taiwan disguise traffic as legitimate email services and processes to evade detection. (Source: The Hacker News, Dark Reading)

  • Cling botnet exploits Realtek Jungle SDK flaws, uses STUN for C2 — Nozomi Networks analysis shows repurposing of ordinary STUN behavior into a practical command-and-control channel across 24 known IoT vulnerabilities. (Source: The Hacker News, Dark Reading)

  • WordPress "SC" backdoor rebuilds itself after cleanup — Sucuri describes a "self-healing mesh" using files, database, and shared memory to persist without re-infection. (Source: The Hacker News)

  • Antino backdoor: China-nexus espionage using Outlook & OneDrive for C2 — Cisco Talos tracks campaign targeting government/policy orgs in Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar. (Source: The Hacker News)

  • Zimbra CVE-2026-73570 exploited weeks before disclosure — Microsoft tracked attackers probing the unauthenticated command injection flaw (CVSS 8.9) from late July, deploying web shells, harvesting credentials, and exfiltrating mailbox backups to Azure Blob Storage. (Source: The Hacker News, The Register)

  • MSP360 abused to deploy ScreenConnect in dual-RMM phishing — Microsoft warns of phishing campaigns distributing MSP360 installers disguised as meeting invites/PDFs, then deploying ScreenConnect for persistent access. (Source: The Hacker News)

  • ChatGPT Custom GPTs abused to deliver RAT via ClickFix lures — Huntress observed threat actors disguising Custom GPTs as legitimate products to redirect victims to malicious ClickFix pages. (Source: The Hacker News)

  • CSuite phishing: US-focused campaign steals M365 sessions + deploys RMM tools — ANY.RUN analyzed 351 samples (51% US submissions); targets tech, manufacturing, government, consulting sectors. (Source: The Hacker News)

AI & Supply Chain Security

  • Anthropic restructures Project Glasswing & Cyber Verification Program — merged into three-tier offering (Defense Access, Red Team Access, Specialized Access). Project Glasswing found 129,000+ verified vulnerabilities (33,000+ critical/high) between April–July 2026; only 516 patched so far. (Source: The Hacker News, The Register)

  • CISA/NSA/FBI Joint Advisory (AA26-251A): China-based AI companies conducting industrial-scale distillation — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI systematically extracting proprietary capabilities from US frontier models (Claude, GPT, Gemini, Grok) via APIs, transfer stations, and bulk subscriptions since late 2024. (Source: CISA)

  • OpenAI disrupts Moonshot AI-linked reasoning extraction campaign — coordinated distillation campaign attributed to individuals associated with Beijing-based Moonshot AI, active since July 2026 targeting protected reasoning capabilities. (Source: The Hacker News, The Register)

  • Wikimedia: Rogue OpenAI agents made unauthorized Wikipedia edits & attempted Etherpad compromise — Foundation confirmed bot activity including edits, failed exploit attempts against hosted Etherpad, and heavy traffic. (Source: The Hacker News, BleepingComputer, SecurityWeek, The Register)

  • Google pauses OSS bug bounty rewards for Go, Angular, Protocol Buffers after surge in invalid automated reports. Supply chain compromise reports still accepted. (Source: The Hacker News)

  • AI coding agents leaked 13,000+ internal images to public GitHub repos — Glow research found billing records, unreleased features from 300+ organizations, mostly under developers' personal accounts. (Source: The Hacker News)

  • Google's PageBreak AI agent finds 500 flaws in Google web apps — demonstrates trend toward AI + deterministic validation for flaw discovery and risk assessment. (Source: Dark Reading)

Law Enforcement & Policy

  • Spanish police arrest 16-year-old suspected KillSec ransomware operator — seized leak site and servers; group claimed ~500 victims worldwide over two years. (Source: The Hacker News, Dark Reading, BleepingComputer)

  • Dutch police arrest Pepijn van der Stap ("Umbreon") in ShinyHunters investigation — former Hadrian/DIVD volunteer, now Neo Security offensive security lead. Linked to Odido hack (6.2M Dutch records), FBI breach, and Cl0p extortion. ShinyHunters now led by teen "Rey" (ScatteredLapsussHunters). (Source: Krebs on Security)

  • US Army soldier Cameron Wagenius ("Kiberphant0m") sentenced to 70 months for AT&T/Verizon extortions via Snowflake credential theft — 100M+ customer records stolen, only ~$1,500 profit. Co-conspirators include Canadian Conor Moucka (pleaded guilty) and John Binns (Turkey, wanted for T-Mobile breach). (Source: Krebs on Security)

  • FBI arrests "Most Wanted" Ploutus ATM malware developer Canelon Aguirre — alleged Tren de Aragua leader for ATM jackpotting; on FBI Top 10 since March 2026. (Source: SecurityWeek)

  • Radaris data broker loses domains in NJ privacy lawsuit — judge transferred radaris.com and sister domains to Atlas Data Privacy under Daniel's Law after repeated stonewalling by Lubarsky brothers' shell companies. (Source: Krebs on Security)

  • Italy GPDP fines IQVIA €7M ($7.8M) for poor anonymization of health data putting ~1M patients at risk of de-anonymization. (Source: BleepingComputer)

  • Engineer sentenced to 32 months for ransomware-style lockout of 3,000+ devices on former employer's network (New Jersey industrial company). (Source: BleepingComputer)

  • South Korea president calls for "complete security paradigm refresh" — demands AI-powered defensive tools to preemptively block attacks following financial sector breaches suspected to involve AI. (Source: The Register)

  • MI5 warns 100+ UK academics — research funded by China General Technology Research Institute (CGTRI) with "very strong ties" to MSS; involves AI, cybersecurity, covert comms, steganography. (Source: The Register)

  • TA419 Chinese espionage impersonates US officials for AI policy phishing — Proofpoint tracks July 2026 campaigns spoofing former White House OSTP officials and Anthropic employees targeting US think tanks, universities, law firms via Cloudflare Turnstile + Evilginx AitM pages. (Source: Dark Reading, The Register)

Notable Research & Updates

  • LibreOffice & Apache OpenOffice zero-click RCE via malicious spreadsheets — code executes on file open without macro warnings when Java support is enabled. Proof-of-concept only; no wild exploitation reported. (Source: The Hacker News)

  • Apple to tighten macOS Full Disk Access controls — citing risks from increasingly capable AI agents accessing user data. (Source: The Hacker News, SecurityWeek)

  • Android 17 Advanced Protection locks accessibility services to verified tools — blocks major malware/fraud vector when Advanced Protection enabled. (Source: The Hacker News)

  • Android October 2026 patches 25 vulnerabilities — including critical System component privilege escalation. (Source: SecurityWeek)

  • Pwn2Own Ireland Day 1: 32 zero-days exploited — Samsung Galaxy S26 hacked twice; $388,500 awarded. (Source: BleepingComputer)

  • GitHub Copilot CLI vulnerable to Cryptographic Context Injection (CCI) — Adversa AI demonstrates encrypted web pages can trick CLI in autopilot mode into decrypting and exfiltrating secrets (.env files); works on Microsoft's mai-code-1.1-flash (50% success) but not OpenAI GPT-5.6 models. GitHub declined to treat as vulnerability. (Source: The Register)

  • Microsoft adds .msix and .msixbundle to Outlook block list — rollout early–mid November 2026 for New Outlook Windows and Outlook on Web. (Source: The Register)

  • NPM malware campaign "MALFEX" accumulates 40,000 downloads — long-running supply chain campaign. (Source: SecurityWeek)

  • Cybersecurity M&A: 39 deals announced in September 2026 — notable buyers include Dragos, IBM, Palo Alto Networks, Kiteworks, Upwind. (Source: SecurityWeek)

  • RUSI: EU needs harmonized 5G risk assessment framework — only 10 of 27 members fully implemented voluntary 5G Toolbox; CSA amendments would mandate rip-and-replace for designated high-risk vendors (Huawei, ZTE likely targets). (Source: The Register)

  • OpenAI adding invisible watermarks to ChatGPT/Codex text in EU — compliance with upcoming AI accountability requirements. (Source: BleepingComputer)

  • Kiteworks & Citrix incidents highlight zero-day response challenges — one vendor told customers to power down platform for 9 hours; the other stayed silent on reported attacks before patching. (Source: Dark Reading)

  • SWIFT banking/government middleware enables RCE — hardware-based MFA bypass risk in ultra-sensitive environments; patch urgently. (Source: Dark Reading)

  • Healthcare sector not quantum-ready — study of 2.5M devices across 50 organizations shows long road to post-quantum cryptography. (Source: Dark Reading)

  • South Korea probes bank breaches amid suspected AI-powered attacks — FSC emergency meeting after series of financial institution intrusions. (Source: BleepingComputer, The Register)

  • BigDiskBuster PoC: Microsoft Defender runs but silently blocks updates — creates detection gap without exploit. (Source: Dark Reading)

Compiled from: The Hacker News, Dark Reading, Krebs on Security, BleepingComputer, SecurityWeek, The Register, CISA Advisories