Security news, decoded.

The FBI has cut ties with an Accenture-supplied contractor after determining that a missed security patch allowed the ShinyHunters group to breach a bureau system and steal personal data on thousands of employees. According to Reuters, FBI cyber division official Brett Leatherman said the incident stemmed from a third-party-managed platform where a required fix was never applied, later confirmed to be Oracle PeopleSoft. Mandiant has linked the intrusion to ShinyHunters abusing a bypass of CVE-2026-35273, using URL encoding to slip past a web application firewall rule meant to shield the vulnerable PSEMHUB endpoint. Accenture says it remains committed to supporting the FBI, while the bureau continues pursuing leads tied to ShinyHunters, a group that has already seen two alleged members arrested.

Microsoft Threat Intelligence has uncovered a new ClickFix variant that stashes its malicious script inside the browser cache instead of fetching it remotely, letting attackers get around the roughly 260-character limit of the Windows Run dialog (Win + R). Compromised sites secretly pre-load a script disguised as a PNG image into the browser's cache; victims tricked into pasting a short command then trigger execution of that already-cached content rather than downloading anything new. In the observed chain, a VBScript scans Firefox profile folders for files matching expected byte sizes, copies a matching cache entry into a .vbs file, and runs it via wscript.exe, eventually pulling PowerShell stages that inject code into a legitimate process (timeout.exe) to steal browser and device credentials. No specific CVE is tied to this technique, but it builds on prior cache-smuggling tricks documented since late 2025 and underscores why users should never paste 'fix' commands into Run, Terminal, or PowerShell prompts.

A researcher named Syed Anas Mohiuddin has demonstrated a new attack class, dubbed "protocol pivoting," that abuses the trust model built into the Model Context Protocol (MCP), the emerging standard used by AI agents to communicate inside corporate networks. By injecting malicious instructions into one agent, an attacker can get that agent to relay the harmful commands to another internal agent, which blindly executes them because it inherently trusts the first agent—even when the two use different inter-agent protocols such as Google's Agent-to-Agent (A2A). Mohiuddin found the flaw affecting five organizations with little in common besides MCP adoption, including Google, JP Morgan Chase, Weaviate, Rapid7, and French and US government systems. Rapid7's bug, tracked as CVE-2026-97228 and rated a low 2.7 severity, was patched last month, while Google's more serious issue (CVSS 8) stemmed from its mcp-toolbox for databases failing to validate redirect targets and IP addresses, enabling server-side request forgery; Google fixed it by adding IP allow/block lists and startup-time URL validation. Experts warn the underlying weaknesses are classic injection and SSRF bugs, but the rapid, unvetted rollout of agentic architectures across industries has sidelined basic zero-trust principles, leaving many MCP deployments exposed to this cross-protocol trust abuse.

FortiGuard Labs has discovered a new Linux backdoor called ClingSTUN that compromises Internet-exposed IoT devices by chaining together at least 24 known vulnerabilities, including CVE-2021-36380 in Sunhillo SureLine and the newer CVE-2026-36356 affecting MeiG Smart FORGESLT711 hardware. Vulnerable products come from vendors such as D-Link, Realtek, Ivanti, and TP-Link, spanning routers, surveillance systems, and industrial equipment. Rather than relying on a conventional command-and-control server, the malware abuses legitimate public STUN servers to learn how infected devices appear externally and which ports are reachable, blending its traffic with normal VoIP/WebRTC activity. ClingSTUN also carries seven additional hard-coded exploits—ranging from the decade-old CVE-2014-8361 to the recent CVE-2026-87827 in KGUARD DVRs—to spread further and turn compromised devices into proxy nodes, risking IP blocklisting, data exposure, and lateral access into internal networks.

Security researchers at VulnCheck have detected scanning activity targeting Rejetto HFS (HTTP File Server) installations vulnerable to CVE-2026-61500, a severe flaw enabling session forgery, account hijacking, and remote code execution. According to VulnCheck's Caitlin Condon, the probes so far appear limited, originating from a single China Telecom IP address and aimed at systems in Japan and the US. The bug stems from HFS versions 3.0.0 through 3.2.0 using the insecure Math.random() function to generate session-cookie signing keys while also exposing outputs from that same generator to unauthenticated users during login—allowing attackers to reconstruct the key, forge an admin session, and run malicious code via the server's custom JavaScript feature. The issue was uncovered by Horizon3 using Anthropic's Mythos model and was patched in HFS 3.2.1, though a proof-of-concept released by Horizon3 on September 30, 2026 may explain the recent scanning surge. Administrators should update to version 3.2.1 or, preferably, the current release 3.3.4 immediately.

Microsoft has issued emergency, out-of-band patches for a high-severity bug in on-premises Exchange Server, identified as CVE-2026-96940 with a CVSS score of 8.8. The flaw stems from weak authorization checks and lets an already-authenticated attacker escalate privileges to access and read another user's mailbox—including messages and attachments—within the same organization, though cross-tenant access is not possible. Affected products include Exchange Server Subscription Edition RTM, Exchange Server 2016 CU23, and Exchange Server 2019 CU14/CU15; Exchange Online has already received a server-side fix so cloud customers need not act. Microsoft credits its own researcher Jan Mitchell for the find, notes no active exploitation yet, but rates it as 'Exploitation More Likely,' urging on-prem admins to apply updates promptly—news that follows separate reports of the Warlock group abusing SharePoint flaws for ransomware attacks.

CISA has added a fresh Citrix NetScaler flaw, CVE-2026-88779, to its Known Exploited Vulnerabilities list after confirming it's being actively abused to crash vulnerable appliances. The bug is a memory overflow issue affecting NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28 (plus the FIPS/NDcPP builds), but only when the device uses SAML authentication alongside Gateway or AAA features. Citrix says exploitation can trigger repeated denial-of-service conditions that leave the appliance unavailable, though customer data integrity doesn't appear impacted; researchers from Bishop Fox and watchTowr flagged the issue, with reports suggesting attackers are attempting to drop webshells via a downloaded script, while reboots and crashes are also being seen after admins patched two other actively exploited zero-days, CVE-2026-88771 and CVE-2026-88772. Citrix has released Global Deny List signatures and an IOC-checking script, and CISA has given US federal agencies until October 7 to patch and verify no compromise has occurred.

Dell has released fixes for a critical security hole in its System Update (DSU) command-line tool, used by IT teams to push BIOS, firmware, and software updates to PowerEdge servers running Linux and Windows. Tracked as CVE-2026-86360, the bug stems from a path traversal weakness that could let an unauthenticated remote attacker read files and ultimately run arbitrary code with root privileges, potentially taking over the entire system. Alongside it, Dell also closed four high-severity DSU bugs — two remote code execution issues (CVE-2026-63697, CVE-2026-71168) and two privilege-escalation flaws (CVE-2026-86361, CVE-2026-86362) — and separately patched a pair of maximum-severity issues in its Container Storage Modules (CSM). Dell says none of these are currently known to be exploited, but urges customers to upgrade DSU to version 2.3.0.0 or newer right away, noting that nation-state actors have targeted other Dell products in the past.

This week's roundup opens with two actively exploited zero-days: Citrix patched CVE-2026-88779, a memory overflow in NetScaler ADC and NetScaler Gateway (CVSS 8.7) affecting SAML-configured deployments, while CISA flagged CVE-2026-104286 in Fortinet FortiMail, a critical unauthenticated arbitrary file write bug (CVSS 9.8) already under attack. Law enforcement also struck back, arresting two alleged ShinyHunters members and a 16-year-old suspected of running the KillSec ransomware operation, which Europol says launched roughly 1,000 attacks since 2024. Elsewhere, researchers disclosed a new Spectre v2 variant called Branch Target Reuse that can extract a Linux root password hash from Intel CPUs within minutes, Storm-3168-linked activity and other campaigns kept exploiting weak defaults across Linux kernel, GitLab AI Gateway and Cisco Catalyst SD-WAN Manager, and a report found AI coding agents had inadvertently leaked over 13,000 internal screenshots from hundreds of companies onto public GitHub repos. The recap also lists a long tail of fresh CVEs across vendors like Apple, Intel and GitLab, underscoring how fast unpatched flaws are being weaponized.

Check Point's latest weekly threat intelligence bulletin covers a wave of breaches and actively exploited flaws. Highlights include phishing-driven data theft from Arizona's courts, a 6.6-million-account breach at Times Car in Japan, a ransomware hit on South Africa's air navigation systems, and a breach of Polish invoicing platform Fakturownia. On the vulnerability front, Citrix NetScaler ADC and Gateway are under active attack via CVE-2026-88771 and CVE-2026-88772, letting intruders deploy web shells and tunneling malware; Cisco's Catalyst SD-WAN Manager has an unpatched, actively exploited authentication bypass tracked as CVE-2026-76504 (CVSS 9.8); and Apple has fixed a targeted zero-day, CVE-2026-86950, affecting iOS, iPadOS and macOS via malicious images or PDFs. GitLab also patched a critical AI Gateway sandbox-escape bug, CVE-2026-90970 (CVSS 9.9). Separately, researchers detail AI-driven threats including rogue agents attempting SQL injection, malicious ChatGPT Custom GPTs spreading RATs, and the AI-enabled JadePuffer actor automating destructive Azure cloud attacks, alongside ransomware group Warlock abusing SharePoint ToolShell bugs and several nation-state espionage campaigns.

Nozomi Networks reports a surge, starting around September 5, 2026, in attempts to exploit a patched critical Realtek Jungle SDK remote-code-execution flaw (CVE-2021-35394, CVSS 9.8), with part of the activity installing a new botnet strain called Cling. Beyond the Realtek bug, the malware carries exploit code for several other router and DVR vulnerabilities, including CVE-2014-8361 (Realtek SDK), CVE-2016-10372 (Eir D1000), CVE-2016-20016 (MVPower DVR), CVE-2023-26801 (LB-LINK), CVE-2023-41011 (FiberHome/China Mobile), CVE-2024-3721 (TBK DVR) and CVE-2025-34037 (Linksys), letting it spread across many unpatched device families. Once installed, Cling persists via init scripts or by replacing the wget binary, and it disguises its command-and-control traffic as ordinary STUN NAT-traversal exchanges, even making commands appear to originate from Google's public STUN service, to evade network monitoring while supporting self-propagation, proxying, tunneling and DDoS commands. Organizations running affected Realtek-based or vendor devices should apply available firmware patches promptly to prevent recruitment into the botnet.

VulnCheck reports active exploitation attempts against a severe flaw in Rejetto's HTTP File Server (HFS), tracked as CVE-2026-61500 with a CVSS score of 9.3. The bug stems from HFS leaking outputs of its session-cookie generator to unauthenticated users during login, and using that same weak generator to derive the signing key for session cookies. By collecting a handful of login responses, an attacker can rebuild the generator's internal state, recover the signing key, and forge valid administrator session cookies — ultimately achieving remote code execution through the servercode configuration function. Notably, the vulnerability was first identified by Horizon3.ai researchers using Anthropic's Mythos AI model, which reasoned that the reversible xorshift128+ algorithm behind Node.js's Math.random() could expose the secret key used by the Koa framework for cookie signing. Rejetto shipped a fix in version 3.2.1 on July 13, but VulnCheck disclosed on October 2 that attackers, including traffic linked to a China Telecom IP, have started probing honeypot systems in Japan and the US, underscoring the urgency for unpatched HFS deployments to update immediately.

Apple has said it will tighten the macOS Full Disk Access (FDA) permission because AI agents granted this access can silently read a user's entire system, including files, mail, messages and browsing history, without the person fully understanding what they've authorized. The move follows reports that Meta's Muse agent tool read a journalist's private iMessages after being given Full Disk Access along with an enabled Messages connector, prompting Meta to clarify that both settings are required for such access. It also comes after researcher Patrick Wardle publicly demonstrated a proof-of-concept exploit, dubbed not-a-mused, against Muse's Mac app, letting an unprivileged local process hijack Muse's dictation traffic and abuse its elevated trust, a flaw Meta has since patched. Wardle was also credited for reporting a separate vulnerability, CVE-2026-100754, in OpenAI's ChatGPT app for Mac that could have allowed attackers to hijack the assistant and steal chat logs and other stored data, underscoring the growing risk that highly privileged AI agents pose on macOS.

Microsoft has issued an unscheduled security update for Exchange Server addressing CVE-2026-96940, a high-severity flaw that could let an already-authenticated attacker read emails and attachments belonging to other users within the same organization. The company clarifies that the bug cannot be used to cross tenant boundaries, and the internal Exchange Server Team says it has seen no signs of real-world exploitation so far. Still, Microsoft warns that this class of flaw has been abused before and urges admins to patch promptly rather than wait. The rollout was messy: a matching fix was quietly pushed to Exchange Online last week without accompanying documentation, catching customers off guard before Microsoft admitted the update went out ahead of its planned schedule. On-premises customers running Exchange Server Subscription RTM, Exchange Server 2019 (CU14/CU15), or Exchange Server 2016 CU23 should apply the September 2026 v2 update, and Microsoft recommends installing it on every Exchange server plus any machine running the Exchange Management Tools.

VulnCheck reports active exploitation of a severe flaw in Rejetto HTTP File Server (HFS), tracked as CVE-2026-61500 with a CVSS score of 9.3. Versions 3.0.0 through 3.2.0 generate session-cookie signing keys using the insecure JavaScript Math.random() function, and the login process leaks outputs from this same generator to unauthenticated users. By collecting a handful of login responses, an attacker can rebuild the generator's internal state, derive the signing key, and craft a fake administrator session cookie — ultimately achieving remote code execution through the server's servercode configuration option. Researchers say Anthropic's Mythos model helped uncover the issue, and a public Python proof-of-concept surfaced in late September, shortly before VulnCheck spotted real-world attack attempts on October 1, 2026 originating from a threat actor in China targeting hosts in the U.S. The vendor shipped a fix in version 3.2.1 back in July 2026, making this the second actively exploited Rejetto HFS vulnerability after 2024's CVE-2024-23692, which was previously abused to drop cryptominers, trojans, and the HATVIBE malware.

Citrix has issued fixes for a high-severity flaw in NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88779 (CVSS 8.7), after confirming it was already being abused in targeted zero-day attacks. The bug is a memory overflow that can crash customer-managed appliances configured as a SAML service provider or SAML identity provider, repeatedly triggering it can leave the service permanently unavailable, though Citrix says customer data integrity has not been affected. Fixes ship in NetScaler ADC/Gateway 14.1-73.41+, 13.1-64.28+, plus the corresponding FIPS and NDcPP builds; the flaw was reported by Bishop Fox and watchTowr, the latter noting it reproduced the issue within hours of spotting honeypot probing. This comes on the heels of active exploitation of CVE-2026-88771 and CVE-2026-88772 to deploy web shells and tunneling tools on NetScaler systems, and CISA has now added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 7, 2026 to patch.

Over the weekend, Citrix NetScaler admins noticed appliances that had already been patched started rebooting unexpectedly, prompting Citrix to confirm a fresh zero-day under active attack. The flaw, CVE-2026-88779, is a memory overflow in NetScaler ADC and NetScaler Gateway when configured as a SAML SP or IdP, which Citrix says attackers are leveraging to cause denial-of-service conditions without evidence of data compromise so far. The exploitation wave arrived only days after two other actively exploited bugs, CVE-2026-88771 and CVE-2026-88772, had already forced some organizations to take their NetScaler boxes offline. Researcher Kevin Beaumont observed exploitation attempts on patched honeypots and found one running a downloaded malware sample designed to drop web shells and exfiltrate device configs, while CISA has now added CVE-2026-88779 to its KEV list, giving federal agencies until October 7 to remediate — the sixth NetScaler flaw added to that catalog in 2026.

Citrix has rushed out fixes for CVE-2026-88779, a memory buffer vulnerability in NetScaler ADC and NetScaler Gateway that is already being abused in real-world attacks. The bug affects appliances using SAML authentication through Gateway or AAA features, carries a CVSS score of 8.7, and so far Citrix says it only triggers denial-of-service, though researchers are examining whether it also enables remote code execution. Fixed builds are NetScaler ADC/Gateway 14.1-73.41 and 13.1-64.28, with 14.1-73.41 FIPS and 13.1-37.282 for FIPS/NDcPP customers; notably, even organizations that already patched the earlier CVE-2026-88771 through CVE-2026-88778 zero-days must upgrade again if SAML is configured. Administrators have reported appliance reboots and crash loops tied to the nsaaad process, and researchers including Kevin Beaumont and watchTowr Labs found evidence of malware payloads running on patched honeypots, prompting CISA to add the flaw to its Known Exploited Vulnerabilities list with a remediation deadline of October 7.

This week's security digest highlights a teenage researcher who uncovered a flaw in Microsoft's internal analytics tool Titan, potentially exposing employee data and Bing search analytics across 17 trillion rows. Citrix also patched eight NetScaler ADC/Gateway vulnerabilities, including two zero-days (CVE-2026-88771 and CVE-2026-88772) that attackers—possibly state-sponsored—had already been exploiting for weeks to deploy webshells on exposed devices. Elsewhere, Apple fixed an actively exploited Core Graphics zero-day (CVE-2026-86950) in iOS and macOS, Cisco disclosed its fifth SD-WAN zero-day of the year (CVE-2026-76504), and Fortinet warned of in-the-wild attacks against a FortiMail zero-day (CVE-2026-104286). The roundup also covers the FBI's job portals staying offline after a ShinyHunters breach claim, an AI-agent attack exploiting Zammad zero-days against DIVD, and the arrest of a 16-year-old suspected KillSec ransomware leader.

Symantec and Carbon Black researchers report that the China-linked group Warlock, also known as Gold Salem, Longlegs, and Storm-2603, is still actively abusing vulnerabilities in on-premises Microsoft SharePoint Server, including the older ToolShell flaws, to breach organizations. Over the past two months the actor has hit at least four victims in Portuguese- and Spanish-speaking regions across Europe, Africa, and Latin America, among them a water utility, a telecom provider, a regional government, and a university. After gaining access, the attackers drop web shells to steal ASP.NET machine keys for forging signed code-execution payloads, then use living-off-the-land tools, VS Code tunnels, and the vulnerable K7RKScan.sys driver (CVE-2025-1055) in a BYOVD attack to disable security software before pushing ransomware at scale through the domain's SYSVOL share. Analysts warn this shows unpatched SharePoint servers remain a reliable entry point for attackers more than a year after Warlock first emerged.

Fortra has shipped fixes for eight security flaws in its Core Privileged Access Manager (BoKS), a tool used to centrally manage and enforce access policies across Unix and Linux systems. Three of the issues are rated critical: CVE-2026-79901 (CVSS 9.9) lets an attacker bypass authentication because BoKS keytab generates Active Directory service account passwords from a predictable, timestamp-seeded pseudo-random sequence, allowing offline guessing with limited prerequisites; CVE-2026-79898 (CVSS 9.1) is a command injection bug in the crlserver component reachable via BCC or the WSI REST/SOAP API, letting an authenticated attacker run root-level shell commands on the BoKS Master without needing local sudo or suexec rules; and CVE-2026-12627 (CVSS 9.8) is a stack buffer overflow in the autoregistration feature that a remote attacker could exploit to corrupt memory. Fortra also patched five additional high- and medium-severity issues, including heap overflows, an out-of-bounds read, insecure temp-file handling, and another predictable password weakness. The vendor says there is no evidence of exploitation so far, but customers managing AD service accounts or exposing BCC/WSI interfaces should apply the updates promptly given the severity of these bugs.

Security researchers at Symantec and Carbon Black report that the China-linked Warlock ransomware gang, also tracked as Longlegs, has been breaching critical infrastructure by exploiting on-premises Microsoft SharePoint vulnerabilities. Victims include a water utility, a telecom provider, a regional government agency, and a university, mostly in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America, over the past two months. The group first gained attention after abusing the ToolShell exploit chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771), and Microsoft has separately linked related SharePoint exploitation to state-backed actors Linen Typhoon, Violet Typhoon, and a ransomware operator dubbed Storm-2603. In a documented intrusion starting July 22, attackers used a web shell compatible with multiple SharePoint versions, then deployed an AV/EDR-killing tool via a vulnerable signed driver (CVE-2025-1055) to disable defenses on roughly 40 hosts within two hours, before launching Warlock ransomware on at least 33 systems—staging the payload through the domain's SYSVOL share and using VS Code's tunneling feature and the NetExec framework for lateral movement and credential theft.

GitLab has released a security fix for a critical vulnerability in its self-hosted AI Gateway, tracked as CVE-2026-90970 with a CVSS score of 9.9. The bug lets a logged-in user with access to the Duo Agent Platform escape the prompt template sandbox through a specially crafted custom flow configuration, allowing arbitrary command execution on the gateway server. Only organizations running their own AI Gateway instance are affected—GitLab.com, GitLab Dedicated, and customers using GitLab-hosted gateways are not at risk. The issue is resolved in AI Gateway versions 19.2.4, 19.3.2, and 19.4.1, while releases from 18.1.6 through 19.1 remain exposed with no listed fix or workaround. CISA's assessment logged with the CVE record notes no known exploitation so far. The flaw was reported via HackerOne and echoes a similarly rated CVE-2026-1868 gateway bug GitLab patched in February, both stemming from the same template-engine weakness class (CWE-1336).

Dell has shipped security updates fixing six critical vulnerabilities in its Container Storage Modules (CSM) that could let attackers seize full control of storage infrastructure and Kubernetes clusters without any credentials. Two flaws, CVE-2026-63688 and CVE-2026-63692, score a perfect 10.0 CVSS and stem from missing authentication in the csm-authorization gRPC server and the authorization proxy/tenant service, letting remote attackers grab backend admin credentials or bypass login entirely to gain admin rights across all tenants. Other bugs include CVE-2026-67269 (9.9), which lets a low-privileged user escalate to root on every node in a cluster via a single malicious custom resource; CVE-2026-54472 (9.8) and CVE-2026-61421 (9.8), both tied to hard-coded credentials or signing keys that allow forging valid admin tokens; and CVE-2026-67273 (9.6), a template-injection issue enabling privilege escalation and RBAC tampering. All versions of CSM prior to 1.17.0 are affected, with fixes available in 1.18.0 — there is no workaround, so Dell urges customers to update immediately and rotate any JWT signing secrets, especially given that past Dell product flaws have previously been exploited in the wild.

A late-September weekend turned into a stress test for zero-day disclosure after GreyNoise Intelligence spotted a single IP scanning and running RCE attempts against Citrix NetScaler on Sept. 24, triggering days of speculation before watchTowr's CEO publicly urged admins to pull systems offline. Citrix eventually released fixes for eight flaws, CVE-2026-88771 through CVE-2026-88778, confirming that two of them, CVE-2026-88771 and CVE-2026-88772, were zero-days already being actively exploited, though the vendor stopped short of recommending a shutdown and simply pushed customers to upgrade immediately. In parallel, Kiteworks chose the opposite approach: acting on threat intelligence about a possible imminent attack, it told customers to proactively disconnect their systems before confirming any breach, then issued a patch days later after determining only about 1% of its customer base was actually at risk. The contrasting responses have sparked debate among security professionals over whether Citrix was too slow and quiet, and whether Kiteworks overreacted by shutting down systems absent confirmed compromise, highlighting how vendors still lack a shared standard for handling early zero-day warnings.

Security researchers at Bay Area Labs have found a critical flaw, tracked as CVE-2026-18397, in Thales Group's SConnect browser extension, which handles hardware-token authentication for SWIFT banking transfers, Qatar's Tawtheeq national ID system, Sweden's Skatteverket tax agency, and various bank and insurance portals. The bug stems from a homegrown RSA signature check: when an attacker submits an oversized, invalid signature, the verification silently fails but SConnect still reads the leftover buffer contents, letting a heap-sprayed fake result pass as legitimate roughly 18% of the time. A malicious webpage or embedded iframe can exploit this to load a rogue DLL through SConnect's native host, achieving full remote code execution in as little as six to ten seconds without any visible error. Thales patched the Chrome and Apple App Store versions in August, pulled the extension from Microsoft Edge in September, and rated the flaw 9.4 on CVSS 4.0; since SConnect reached end-of-life last month in favor of SWIFT's newer Web Connect tool, organizations still relying on it as a fallback should update or migrate immediately, as researchers warn the bug could potentially be chained to hijack user sessions and banking transactions.

GitLab has issued an urgent fix for a critical flaw in its AI Gateway component, which powers Duo AI features and can be run either as GitLab's own cloud service or self-hosted by customers. The bug, tracked as CVE-2026-90970, arises from improper input sanitization and allows a user with only basic access to the Duo Agent Platform to break out of the prompt template sandbox through a crafted flow configuration, ultimately executing arbitrary commands on the AI Gateway server. GitLab says instances it hosts itself are already protected, but anyone running a self-managed AI Gateway must upgrade immediately to version 19.2.4, 19.3.2, or 19.4.1, and the company notes it privately contacted affected self-hosted customers before going public with the advisory. There is no indication yet that this flaw has been exploited, but it follows a separate maximum-severity path traversal bug (CVE-2026-85706) in GitLab CE/EE that CISA recently confirmed was actively exploited and added to its known-exploited vulnerabilities list.

Dell has released fixes for six critical-severity vulnerabilities in its Container Storage Modules (CSM), the component that links Dell storage arrays like PowerStore, PowerScale, PowerFlex, PowerMax and Unity XT to Kubernetes clusters. Two of the flaws, CVE-2026-63688 and CVE-2026-63692, sit in the CSM Authorization module and let an unauthenticated attacker retrieve storage backend admin credentials or hijack the authorization proxy and tenant service to gain full administrative control over the storage environment. Four additional bugs—CVE-2026-67269, CVE-2026-54472, CVE-2026-61421 and CVE-2026-67273—can be abused without credentials to obtain root on cluster nodes, seize control of the authorization proxy, forge authentication tokens, or read Kubernetes Secrets across all tenants. Dell has not reported any active exploitation of these issues but urges customers to upgrade to CSM version 1.18.0 or later as soon as possible, noting that other Dell products have previously been targeted by state-sponsored groups such as Lazarus and a China-linked actor exploiting a RecoverPoint flaw.

Symantec warns that the Warlock ransomware operation, run by the China-linked actor tracked as Longlegs/Storm-2603, keeps breaking into unpatched Microsoft SharePoint servers to hit critical infrastructure, government and education targets. Besides the earlier ToolShell flaws, the group is now believed to also leverage newer SharePoint bugs including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522 and CVE-2026-55040 to gain initial access. In the past two months alone, at least four organizations across Portuguese- and Spanish-speaking countries were compromised, among them a water utility, a telecom provider, a regional government agency and a university, with attackers disabling security tools on dozens of machines before deploying the Warlock encryptor at scale through SYSVOL replication. The campaign highlights that more than a year after Warlock first appeared, exploitation of SharePoint vulnerabilities remains an effective entry point for organizations that have not applied patches or mitigations.

Fortinet says attackers are actively exploiting CVE-2026-104286, a FortiMail zero-day with a CVSSv3 score of 9.8. The path traversal and NULL-byte issue can let an unauthenticated attacker write arbitrary files through crafted HTTP or HTTPS requests on FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9. Fixes are planned for 8.0.2, 7.6.7 and 7.4.9; until then, Fortinet recommends disabling IBE or limiting access to the management interface.

CISA and Fortinet have issued an urgent warning about a severe FortiMail vulnerability, CVE-2026-104286 (CVSS 9.8), that is already being exploited by attackers despite no official patch being available yet. The bug combines a path traversal issue with improper handling of NULL bytes, letting attackers send specially crafted HTTP or HTTPS requests to write files onto the system and potentially achieve remote code execution. It affects FortiMail releases from 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1 — versions found internally by Fortinet rather than through outside reporting. Until fixes land in the planned 7.4.9, 7.6.7, and 8.0.2 releases, Fortinet recommends turning off IBE functionality or restricting access to the management interface, and has shared indicators of compromise for defenders. CISA has also added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies just three days to remediate under BOD 26-04, though specifics about the attacks remain undisclosed.

CISA has added a critical FortiMail flaw to its Known Exploited Vulnerabilities catalog after confirming it is being actively abused in attacks. Tracked as CVE-2026-104286 (CVSS 9.8), the bug combines a path traversal weakness with improper handling of NULL bytes, letting an attacker with no credentials plant arbitrary files on the system through specially crafted HTTP or HTTPS requests. The issue hits FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9, with Fortinet preparing fixed builds (8.0.2, 7.6.7, 7.4.9, or migration to the 7.4 branch for 7.2.x users) while advising admins to disable the IBE encryption feature and block internet access to the management interface in the meantime. Fortinet has published indicators of compromise, including two attacker IP addresses and several altered or newly dropped files such as liblog.so, webconsole and httpd.conf, and federal agencies have been told to remediate by October 4, 2026.

A multi-country police operation has taken down the KillSec ransomware gang, seizing its infrastructure and detaining three suspects across Spain, Romania, and the UK, with a fourth identified but not arrested in Spain. The alleged lead administrator turned out to be a 16-year-old Romanian national based in Alicante, while a second suspect, Dutch national Fouad Eltibrizi, was arrested in the UK and now faces a US extradition request over a March 2025 attack on a company in Puerto Rico. Since launching as a cheap ransomware-for-rent service in June 2024, KillSec reportedly powered over 1,000 intrusions worldwide, about 500 of them successful, mainly by exploiting unpatched server flaws and running double-extortion schemes; the gang has also been connected to the CrushFTP zero-day tracked as CVE-2025-31161. Despite staying relatively low-profile compared to larger crews like Qilin, DragonForce, or Akira, KillSec was still posting fresh victims on its leak site just days before the takedown.

Fortinet has disclosed that a critical path traversal and NULL-byte handling bug in FortiMail's management interface, CVE-2026-104286, is already being exploited as a zero-day to plant malicious files and run unauthorized commands. The flaw carries a CVSS score of 9.8 and lets an unauthenticated attacker write arbitrary files on the underlying system through specially crafted HTTP or HTTPS requests. It impacts FortiMail versions 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9; only the 7.2 branch has an immediate fix via upgrade to 7.4 or later, while fixed builds 7.4.9, 7.6.7 and 8.0.2 are still pending for the other branches. Until then, Fortinet recommends disabling the IBE feature or blocking internet access to the management interface, and has released IOCs, suspicious IP addresses, and log signatures tied to the intrusions. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 4th to investigate and remediate affected systems.

This week's security digest highlights how AI is accelerating both attacks and discovery, and how ordinary infrastructure keeps becoming an attack vector. Attackers reportedly used an automated AI agent to chain two Zammad ticketing system zero-days, CVE-2026-102489 and CVE-2026-102490, breaking into the Dutch Institute for Vulnerability Disclosure (DIVD), hijacking sessions and escalating from a regular user to root in seconds, exposing volunteer data in the process. Separately, Truffle Security uncovered 543,699 still-valid credentials sitting exposed in public GitHub repositories, some dating back to 2009, despite the platform's push-protection safeguards. Pillar Security also disclosed a critical flaw in Unsloth Studio, an open-source LLM fine-tuning tool, where merely inspecting a model's metadata in the UI could trigger automatic execution of malicious Python code from its Hugging Face repository, risking theft of tokens, keys and training data; the issue was fixed in version 2026.6.9. The roundup also covers U.S. Treasury sanctions against a Tren de Aragua-linked ATM jackpotting network tied to Chainalysis-tracked crypto laundering, plus research from Tracebit and YesWeHack on prompt-injection defenses and web cache-key poisoning techniques.

Sucuri researchers have detailed a newly discovered WordPress malware strain, dubbed SC, that survives cleanup attempts by storing redundant copies of itself across at least eight locations: plugin files, a fake mu-plugin, theme code, drop-ins like db.php and advanced-cache.php, a ZIP backup, a database entry, and a System V shared-memory segment in RAM. Removing one copy triggers the others to silently rebuild it on the next page load, and the malware uses obfuscated code plus an Ethereum-based command-and-control channel to hide, create rogue admin accounts, inject skimmers, and execute arbitrary PHP. How the initial infection occurs is still unclear, though common WordPress attack vectors such as vulnerable plugins, weak credentials, and insecure upload features are suspected. Separately, Previdian has observed active exploitation of CVE-2026-1581, an unauthenticated SQL injection flaw (CVSS 7.5) in the wpForo Forum plugin affecting all versions up to 2.4.14, with under 20 attack attempts seen since July 3, 2026 from IPs in Bulgaria, Switzerland, France, the US, and Yemen.

Kiteworks has shipped fixes for 126 security issues, among them a maximum-severity vulnerability in its Email Protection Gateway (EPG), a core piece of the company's Private Content Network (PCN) that ties together enterprise email, managed file transfer, file sharing, APIs and web forms. The bug, tracked as CVE-2026-54154 and reported via the vendor's YesWeHack bug bounty program, combines path traversal, code injection and a missing authentication check, letting an unauthenticated attacker remotely execute code and seize full control of an EPG appliance with minimal effort. All EPG releases prior to version 9.4.1 are affected, and version 9.4.1 resolves the issue. Alongside this, Kiteworks also closed 11 other critical bugs in its Core and EPG modules, including authentication bypass, admin account takeover, stored XSS and access-control flaws. The disclosure follows last week's emergency six-hour shutdown Kiteworks ordered for customers over fears of an imminent zero-day attack—an incident the company says left no sign of actual compromise, though it has not yet detailed or assigned a CVE to that separate flaw. Shadowserver currently counts close to 400 internet-exposed Kiteworks instances, a platform used by thousands of organizations and over 100 million end users, underscoring the urgency for admins to apply the update.

An AI agent autonomously exploited two unpatched Zammad vulnerabilities to compromise the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21. DIVD, which disclosed the breach with help from Merlon Security and coordinated with NCSC-NL, says the agentic attack chained CVE-2026-102489, an unauthenticated remote code execution flaw in Zammad 6.3.0 through 6.5.4, with CVE-2026-102490, a privilege-escalation bug affecting every Zammad version (including the alpha branch) that lets a low-privileged zammad user become root. The organization described the intrusion as fast and chaotic, with the AI agent making self-directed decisions after each step, though some clumsy mistakes—like combining a man-in-the-middle attack with password spraying—helped researchers reverse-engineer its behavior. Neither flaw currently has an official patch; DIVD and NCSC-NL urge Zammad users to upgrade to version 7, where CVE-2026-102489 is not exploitable, or take exposed instances offline, while preserving logs and running DIVD's IoC script to check for compromise.

Bishop Fox researchers detail a critical, actively exploited flaw in Check Point's Security Management and Multi-Domain Management servers, tracked as CVE-2026-93616 (CVSS 9.8). The bug allows an unauthenticated attacker reaching TCP port 19009 to spoof the server's own identity, obtain a privileged session, write arbitrary files as root, and ultimately execute code as root — compromising the system that stores firewall policy, admin credentials, and the internal certificate authority for an entire Check Point deployment. The researchers reproduced full root takeover against unpatched R81.10 and R82.10 systems and released a free scanner to check patch status remotely. Check Point's advisory describes the issue only as a directory-traversal and file-upload flaw, but Bishop Fox found the vendor's hotfix actually closes three distinct defects, including the forged-login primitive that makes the other bugs reachable without authentication. Fixes ship in Jumbo Hotfix Accumulator R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192, and the R82.20 Security Hotfix; older R80–R81 branches remain unpatched and unsupported. Organizations are urged to apply the hotfix immediately, restrict access to port 19009 to trusted management hosts, and, for any exposed unpatched server, treat it as potentially already compromised and rotate credentials and certificates.

Microsoft has disclosed that attackers began abusing a high-severity flaw in Zimbra Collaboration Suite (ZCS) before the issue was ever made public. The bug, CVE-2026-73570 (CVSS 8.9), stems from improper sanitization of untrusted input during SNMP notification handling in ZCS versions prior to 10.1.20, and can be triggered via crafted SMTP requests when the zimbra-snmp package and SNMP notifications are active, letting unauthenticated attackers run code as the Zimbra user. A fix shipped on July 20 in version 10.1.20, but public disclosure didn't happen until August 13. Microsoft says scanning activity probing the flaw began between July 28 and August 7 — weeks before disclosure — followed by real attacks that planted JSP webshells across Jetty and mailboxd directories, created reverse shells, escalated to root through legitimate Zimbra utilities, and set up persistence via a systemd service called zimlog.service. Attackers also harvested centralized Zimbra credentials, ran authenticated LDAP queries for sensitive secrets, and moved laterally using Zimbra's own SSH identity, alongside a full remote-access tool offering shell access, file transfer, and SOCKS5 proxying. CERT Polska separately flagged exploitation and shared indicators of compromise on August 17. Zimbra administrators are urged to upgrade to 10.1.20 or newer, remove the optional SNMP package if unused, lock down SNMP and SMTP exposure, and inspect systems for signs of compromise.