CVE-2014-8361, CVE-2016-10372, CVE-2016-20016, CVE-2021-35394, CVE-2021-36380, CVE-2023-26801, CVE-2023-41011, CVE-2024-3721, CVE-2025-34037, CVE-2026-100754, CVE-2026-104286, CVE-2026-21589, CVE-2026-35273, CVE-2026-36356, CVE-2026-61500, CVE-2026-76504, CVE-2026-86950, CVE-2026-87827, CVE-2026-88771, CVE-2026-88779, CVE-2026-96940
Domains:
fbijobs[.]gov, 115[.]184., cocojambo[.]us, capsysnet[.]vg, ciliabula[.]cc., vercel[.]app, server[.]na-2.action1
Get tomorrow's brief in your inbox
Today: Citrix confirms a third NetScaler zero-day in under two weeks (CVE-2026-88779, CISA deadline October 7). Atlassian disclosed CVE-2026-21589, a 9.3-rated path traversal in eight Data Center products. Microsoft patched an Exchange mailbox access vulnerability, and FortiMail's CVE-2026-104286 remains under active exploitation with CISA's deadline passed.
Citrix NetScaler Zero-Day CVE-2026-88779 Under Active Exploitation
Citrix disclosed a third actively exploited zero-day in NetScaler ADC and Gateway products within a two-week window. CVE-2026-88779 (CVSS 8.7) is a memory overflow vulnerability that triggers denial of service in appliances configured as SAML service providers or identity providers. CISA added it to the KEV catalog (October 6) with a remediation deadline of October 7, 2026. EPSS score is 0.005 (43rd percentile). Exploitation began October 4, according to watchTowr, and can accelerate exploitation of CVE-2026-88771 by intentionally crashing machines.
Atlassian CVE-2026-21589 Path Traversal in Eight Data Center Products
Atlassian published an emergency advisory for CVE-2026-21589 (CVSS 9.3), a path traversal flaw in eight Data Center products (Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, Fisheye) allowing unauthenticated attackers to read specific files in the web application root directory. Attackers must know exact filenames and paths but do not need authentication. Sensitive files may be present depending on configuration. Atlassian Cloud instances were patched automatically; no customer action required. On-premises customers must upgrade immediately.
Cisco Catalyst SD-WAN Manager CVE-2026-76504 (CVSS 9.8) - No Fix Available
Cisco confirmed active exploitation of CVE-2026-76504 (CISA-KEV, due October 3, 2026, EPSS 0.016/75th percentile), a critical authentication bypass in Catalyst SD-WAN Manager. Unauthenticated attackers can send crafted requests to gain administrator access. No patches are available. Check Point IPS provides protection (signature: Cisco Catalyst SD-WAN Manager Authentication Bypass).
KillSec Ransomware Leader Arrested, 16-Year-Old Mastermind in Custody
Spanish authorities arrested a 16-year-old suspected of leading KillSec (Kill Security Ransomware Group), responsible for approximately 1,000 attacks since 2024, with at least half successful. Operation KillSwitch (Europol coordination) resulted in three arrests across Spain, Greece, Romania, and the U.K., and seizure of the group's leak site on September 30, 2026. Authorities secured 110 terabytes of stolen data. The group exploited software vulnerabilities and poorly secured cloud storage access. KillSec's U.K. member Fouad Eltibrizi awaits extradition to the U.S. Group-IB identified 274 publicly claimed victims, primarily in the U.S., India, and Brazil.
ShinyHunters Members Arrested, Two in Custody
Law enforcement arrested two ShinyHunters members: a 24-year-old Amsterdam man believed to be Pepijn van der Stap, and Saif al-Din Khader, detained by Jordanian authorities last week. ShinyHunters previously hijacked the Cl0p darknet site and breached the FBI's "apply.fbijobs[.]gov" portal. The FBI removed an Accenture contractor after the contractor failed to implement a security patch for Oracle PeopleSoft, leading to ShinyHunters exploiting CVE-2026-35273 (CISA-KEV, ransomware-linked, due June 15, 2026, EPSS 0.094/95th percentile). The FBI is actively investigating additional leads, and more arrests are expected.
Gentlemen Group Threatens to Leak Data from South African Insurance Companies
The Gentlemen ransomware-as-a-service group threatened to leak data from South African insurers LegalWise and Samwumed after breaching MIP Holdings, a South African insurtech company, in June 2026. MIP provides software to major insurers including Hollard Insurance. The Gentlemen accounted for 17% of global ransomware attacks in July 2026 (Check Point). The group is now extorting third-party firms whose data was stolen during the MIP breach.
Nueva EPS Colombia Healthcare System Breach: $15M Extortion Demand
A threat actor claims to have exfiltrated data on 11.3 million members of Nueva EPS, Colombia's largest health-promoting entity. The leaked dataset allegedly contains names, national ID numbers, dates of birth, addresses, contact information, ethnic identity, healthcare provider information, medical conditions, disabilities, mental health data, pregnancy data, alcohol/tobacco use, clinical measurements (weight, height, BMI, blood pressure), diagnostic codes, vaccination records, and risk classifications. The attacker used compromised credentials to gain access approximately one week ago, did not deploy ransomware, and demanded $15 million in Bitcoin. Nueva EPS states it found no evidence of unauthorized access to its systems but continues investigating.
Cling Botnet Exploits Realtek Jungle SDK (CVE-2021-35394, CISA-KEV)
Nozomi Networks observed exploitation of CVE-2021-35394 (CVSS 9.8, CISA-KEV due December 24, 2021, EPSS 0.999/100th percentile) in Realtek Jungle SDK starting September 5, 2026, deploying Cling botnet malware. Cling uses legitimate public STUN servers for command-and-control (C2) communications, making malicious traffic resemble NAT-traversal activity. The malware embeds exploit logic for CVE-2014-8361 (Realtek SDK), CVE-2016-10372 (Eir D1000 router), CVE-2016-20016 (MVPower DVR), CVE-2023-26801 (LB-LINK routers), CVE-2023-41011 (FiberHome SR1041F), CVE-2024-3721 (TBK DVR), and CVE-2025-34037 (Linksys). Cling copies itself to /root/.cling and /usr/local/bin/.cling with persistence via /etc/inittab, /etc/init.d/rcS, /etc/rc.d/rc.boot. It registers infected devices by sending STUN Binding Requests to 13 hard-coded STUN servers, including 145.249.115[.]184.
ClingSTUN IoT Botnet Abuses 24 Known Vulnerabilities
Fortinet's FortiGuard Labs identified ClingSTUN, a Linux malware exploiting 24 known IoT vulnerabilities from 2021 to 2026, including CVE-2021-36380 (Sunhillo SureLine), CVE-2026-36356 (MeiG Smart FORGE_SLT711), CVE-2026-87827 (KGUARD DVR), and CVE-2014-8361 (Realtek). ClingSTUN uses legitimate public STUN servers to determine external device mappings and obscure C2 traffic. Compromised devices serve as proxy nodes, potentially causing IP blocklisting, reputational damage, bandwidth consumption, and internal network access. Monitor outbound communications from IoT devices and maintain firmware updates.
ClickFix Campaign Leverages Browser Cache for Payload Delivery
Microsoft Threat Intelligence observed ClickFix attacks pre-fetching script payloads into browser cache disguised as PNG files, then executing cached content when victims paste and run malicious commands. This approach bypasses Windows Run dialog character limits (approximately 260 characters) and conceals payload scripts. The attack enumerates Firefox profile folders (%LOCALAPPDATA%\Mozilla\Firefox\Profiles) for files starting with "f_", copies matching cache entries to %LOCALAPPDATA%\Temp\t.vbs, then executes with wscript.exe. Payloads connect to cocojambo[.]us[.]com/alfa, capsysnet[.]vg, and ciliabula[.]cc. Huntress documented at least 40 incidents, including two confirmed infections beginning through Custom GPTs.
RMM Tool Action1 Abused in Phishing Campaign
SANS Internet Storm Center identified a phishing campaign delivering Action1 RMM tool (action1.msi) via VBS script downloaded from up-theta-rose.vercel[.]app/adobe_new_update.vbs. The MSI installs four files signed with an expired "Action1 Corporation" certificate (expired May 2026), establishing A1Agent service (C:\Windows\Action1\action1_agent.exe). The tool connects to server[.]na-2.action1[.]com using CustomerID 49b18106-681d-456a-b098-092e2818c09a. The campaign started with a phishing email delivering a fake PDF invoice that redirects to the malicious VBS file. Threat actors are abusing Action1's cloud infrastructure, likely using free/test accounts.
Warlock Ransomware Exploits SharePoint Vulnerabilities
Symantec warned that China-linked Warlock actor is exploiting multiple SharePoint vulnerabilities to deploy Warlock ransomware in attacks targeting Portuguese- and Spanish-speaking countries. The campaign focuses on critical infrastructure organizations. Specific CVE details not provided in available reporting.
Denmark CPR Register: 8.8 Million Records Accessed via Compromised Company Account
Unauthorized parties accessed names, addresses, and personal identification numbers (CPR numbers) for approximately 8.8 million people (living and deceased) in Denmark's Central Person Register through a compromised Polish company's legitimate access rights. The access lasted approximately 10 days in September 2026 through a small Polish company using compromised credentials. The activity was detected October 2, 2026. Attackers made a very large number of automated lookups to identify valid CPR numbers. Name-and-address protected individuals' locations were not exposed, but their CPR numbers may have been accessed. No information on attacker identity or whether data was retained.
U.S.-Bound Oil Tanker Propulsion System Breached by Hackers
FBI and U.S. Coast Guard investigators confirmed hackers accessed the propulsion system of the oil supertanker VL Prosperity as it approached the Texas coast in summer 2026. The breach gave attackers temporary access to the ship's digital systems. Investigation continues to determine breach method, duration of access, attacker identity, and extent of control. The vessel was boarded by U.S. authorities in August 2026.
Microsoft Exchange CVE-2026-96940 Mailbox Access Vulnerability
Microsoft released out-of-band updates for CVE-2026-96940 (CVSS 8.8, EPSS 0.005/40th percentile), a weak authorization flaw in Exchange Server allowing authenticated attackers to escalate privileges and access other users' mailboxes within the same organization. Attackers can read email messages and attachments but cannot access mailboxes across tenants. Exchange Online already patched via service-side fix; no customer action required. Affected on-premises versions: Exchange Server Subscription Edition RTM, 2016 CU23, 2019 CU15, 2019 CU14. Microsoft assesses exploitation as "More Likely" but reports no evidence of in-the-wild attacks. Discovered by Microsoft researcher Jan Mitchell.
AI-Driven Attacks Accelerating Exploitation Timelines
Dark Reading poll results show 50% of respondents consider "AI-driven attacks vs. AI-powered defenses in the SOC" the most important security theme. Exploitation windows are shrinking from days/weeks to hours as LLMs accelerate vulnerability analysis and exploit development. Recent NetScaler zero-days and September Patch Tuesday vulnerabilities demonstrate AI-assisted rapid weaponization. Researchers note AI has lowered the barrier for understanding patches even when vendors don't provide full disclosure. Threat actors are automating campaigns using AI models, creating relentless adversaries operating at machine speed. Coalition's Joe Toomey confirms "AI has 100% increased the pace of exploitation." Open-weight models make guardrails ineffective against sophisticated attackers.
Chinese APT TA419 Impersonates U.S. Officials to Target AI Policy Experts
Proofpoint discovered China-aligned TA419 conducting adversary-in-the-middle (AiTM) phishing campaigns targeting AI policy experts at U.S. think tanks, universities, and law firms. The campaign (July 2026) involved impersonating Lynne Edwards Parker (former White House Office of Science and Technology Policy) and Heidi Crebo-Rediker (economist/foreign policy expert). Attackers established benign outreach before introducing phishing links to fake OneDrive pages. Earlier activity (February 2026) impersonated an Anthropic employee. The campaign supports Chinese intelligence objectives to understand U.S. AI policy and regulatory developments amid strategic competition and export controls. TA419 has conducted regular targeted campaigns since at least April 2025 against U.S./Japan think tanks, defense contractors, universities, and law firms.
Rejetto HFS CVE-2026-61500 Under Active Exploitation
VulnCheck warns of active exploitation of CVE-2026-61500 (CVSS 9.3, EPSS 0.010/61st percentile) in Rejetto HTTP File Server (HFS). The vulnerability, discovered using Anthropic's Mythos AI model, allows attackers to bypass authentication and achieve remote code execution by reconstructing the session cookie generator's state and recovering the signing key. The flaw exists because HFS discloses outputs of its Math.random() xorshift128+ algorithm during login, allowing reversal of the PRNG to forge valid administrator session cookies. Patched in HFS 3.2.1 (July 13, 2026). Exploitation attempts observed October 2, 2026, originating from China Telecom IPs targeting canaries in Japan and the U.S.
Apple Muse and ChatGPT Mac Apps Had Privilege Escalation Vulnerabilities
Security researcher Patrick Wardle disclosed proof-of-concept exploits for Meta's Muse Mac app (not-a-mused) and OpenAI's ChatGPT Mac app (CVE-2026-100754). The Muse vulnerability allows unprivileged local processes to redirect Muse's dictation traffic and abuse the app's Full Disk Access (FDA) permissions by exploiting an undocumented "endo_voyager_dictation_endpoint" setting. This enables attackers to capture dictated audio, inject malicious prompts, and abuse Muse's extensive system access. The ChatGPT Mac vulnerability could enable AI assistant takeover and unauthorized access to chat logs. Both vulnerabilities are now patched. Apple announced plans to tighten FDA controls in response to concerns about agentic tools accessing private data, including iMessages, Mail, Safari history, and Time Machine backups. RemoveMacAI, an open-source tool, allows users to remove Apple Intelligence and reclaim up to 12GB of storage.
Windows 11 Market Share Reaches 71.5% as Windows 10 ESU Costs Double
Statcounter data shows Windows 11 market share reached 71.5% while Windows 10 dropped to 27.77%. The first year of Windows 10 Extended Security Updates (ESU) ends this month, with year-two pricing doubling from $61 to $122 per device for commercial customers. EEA consumers continue receiving free security updates. Lansweeper's Esben Dochy suggests remaining Windows 10 devices are "stickier" and paying ESU is cheaper than replacement for machines where the business case doesn't support upgrade. A "small bump" in migrations is expected around renewal date.
KVM Hypervisor Guest-Host Escape Zero-Day Claimed
Security researcher Paulos Yibelo disclosed a "Full VM escape zeroday (guest>host root)" in KVM hypervisor through Vercel's bug bounty program. Vercel CEO Guillermo Rauch confirmed the vulnerability affects "the industry's gold standard solution for Linux virtualization." KVM is used by AWS, Google Cloud, Nutanix, HPE, Proxmox, and powers Firecracker MicroVMs. No public disclosure or patch details available yet. Guest-host escapes allow VM guests to take over entire servers and potentially control other guests. Responsible disclosure process is ongoing. This would be the second serious KVM bug in 2026 after the Januscape flaw.
FortiMail CVE-2026-104286 (CVSS 9.8) - Active Exploitation Confirmed
CISA added Fortinet FortiMail CVE-2026-104286 (CISA-KEV due October 4, 2026, EPSS 0.022/82nd percentile) to the KEV catalog. The critical unauthenticated arbitrary file write vulnerability allows attackers to write files via crafted HTTP/HTTPS requests. Fortinet released patches; Check Point IPS provides protection.
Apple CoreGraphics CVE-2026-86950 Memory Corruption (CISA-KEV)
Apple patched CVE-2026-86950 (CISA-KEV due October 2, 2026, EPSS 0.012/68th percentile), a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs. Processing malicious images or PDFs can trigger arbitrary code execution. Apple reported exploitation in highly targeted attacks. Fixed through improved bounds checking.
Windows 11 26H2 AC-3 Audio Decoder Issue
Microsoft confirmed Windows 11 26H2 (and 25H2, 24H2) contains a bug causing applications using Windows built-in AC-3 (Dolby Digital) audio decoding to crash or fail to start. The issue affects legacy applications relying on Windows for audio decoding. Modern applications with native audio decoders are unaffected. No fix available; uninstalling the update is the only mitigation. Microsoft is working on a resolution for a future update.
UK Education Provider Bromcom SSO Data Breach
Bromcom, a UK education software provider used by 5,000+ schools and 390 multi-academy trusts, disclosed a breach of legacy single sign-on functionality. Unauthorized third parties accessed email addresses, SSO provider information (Microsoft/Google), registration dates, last sign-in dates, and internal reference numbers. The incident occurred September 6, 2026. No passwords, authentication tokens, or school MIS data compromised. Microsoft/Google accounts remain unaffected. Bromcom withdrew legacy SSO functionality from production and is conducting forensic investigation.
Daiwa Securities Vendor Breach: 110,000 Clients Affected
Japan's second-largest brokerage Daiwa Securities disclosed that up to 110,000 client records may have been stolen after vendor Scala Communications servers were hacked. Exposed data includes names and account numbers. Payment details and transaction capabilities were not affected. Daiwa's own systems were not compromised. The breach was reported to Daiwa on October 4, 2026.
Exploitation timelines continue compressing as AI-assisted vulnerability analysis accelerates weaponization. The third Citrix NetScaler zero-day in two weeks demonstrates persistent targeting of edge infrastructure. Multiple CISA-KEV additions with past deadlines (FortiMail October 4, Cisco SD-WAN October 3) highlight the gap between disclosure and remediation. Ransomware operations face increased law enforcement pressure (KillSec arrests, ShinyHunters takedowns), but new extortion models persist (Gentlemen's third-party targeting, Nueva EPS direct extortion). ClickFix attacks evolving to abuse browser cache, complicating traditional file-based detection. RMM tool abuse continues as attackers leverage legitimate cloud infrastructure.