CVE-2026-73570 on DanSec Daily

Cybersecurity Brief – 2026-10-01

Thu, 01 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Cryptocurrency exchange Bitget confirmed that attackers stole $387.5 million by exploiting a zero-day vulnerability in a third-party security product. The investigation is ongoing to determine the full impact and attack vector ^[6].
MetaMask disclosed an ongoing security incident affecting part of its infrastructure, prompting the exit of affected Ethereum validators. The company is actively addressing and remediating the issue ^[7]^[18].
The Pentagon’s Defense Manpower Data Center (DMDC) suffered a breach of its human resources management system, resulting in the theft of personnel records and Social Security numbers of over 3 million military service members and their families ^[17]^[44].
The Dutch Institute for Vulnerability Disclosure (DIVD) reported that its network was breached via a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system, enabling attackers to hijack sessions, achieve remote code execution, and escalate privileges to root ^[20]^[39].
Hackers stole sensitive court records, including more than 150,000 foster care reports, from Arizona courts, raising privacy and safety concerns ^[46].

Newly Discovered Vulnerabilities

Cisco patched a critical authentication bypass vulnerability (CVE-2026-76504) in Catalyst SD-WAN Manager, which was being actively exploited to escalate attacker privileges to administrative level. The flaw has been added to CISA’s Known Exploited Vulnerabilities catalogue ^[3]^[11]^[23]^[41].
Security researchers published a public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw reportedly used in targeted attacks. There is speculation that WhatsApp PDF checks could be a potential delivery method ^[5].
Kiteworks released security updates to address 126 vulnerabilities, including a maximum severity code injection flaw in its Email Protection Gateway (EPG) security solution ^[15].
CISA issued a warning about a critical pre-authentication remote code execution vulnerability in MikroTik RouterOS that could enable attackers to execute code or cause denial-of-service conditions ^[22].
A now-patched Zimbra Collaboration Suite (ZCS) vulnerability (CVE-2026-73570) was exploited in the wild prior to public disclosure. The flaw could be triggered via specially crafted emails without user interaction, allowing attackers to deploy web shells and access mailbox data ^[9]^[36].
Threat actors exploited a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway, dropping web shells and attempting theft of configuration data ^[8].

Notable Threat Actor Activity

OpenAI disrupted a coordinated campaign linked to Moonshot AI Associates that attempted to illicitly extract protected reasoning from its AI models ^[2].
Russian state actor Star Blizzard deployed a new technique dubbed “RedFlick” to install the CosmicPulse backdoor via phishing against Ukrainian-linked targets, including NGOs, think tanks, and journalists. This marks a shift away from previous ClickFix tactics ^[19]^[28].
Threat actors abused ChatGPT Custom GPTs, disguising them as legitimate offerings to lure victims to malicious sites using ClickFix-style lures and deliver remote access trojans (RATs) ^[12]^[25].
Microsoft reported phishing campaigns distributing MSP360 Remote Monitoring and Management (RMM) installers, which then deploy ScreenConnect in dual-RMM attacks. These campaigns use meeting invitations and PDF-themed lures to trick users ^[10]^[30].
The Warlock ransomware group, believed to be Chinese and exhibiting both cybercrime and APT characteristics, targeted large organizations in Spain and Portugal ^[24].
Police, through Operation KillSwitch, dismantled the KillSec ransomware gang, seized its leak site and servers, and arrested three individuals, including the alleged 16-year-old leader. At least 110 terabytes of stolen victim data was secured ^[13]^[34].

Trends, Tools, or Tactics of Interest

Over 543,000 valid credentials were found exposed in public GitHub repositories as of July, despite platform security measures. Approximately 200,000 of these credentials were exposed after GitHub enabled push protections by default ^[21]^[40].
AI is accelerating both vulnerability discovery and exploitation, increasing the speed of attacks, while defensive fundamentals such as defense-in-depth remain critical ^[35].
AI is reshaping the Security Operations Center (SOC) career ladder. While 91 percent of security professionals report increased satisfaction due to AI-driven detection and response, nearly half find entry into the field more difficult, and one in four say AI limits skill development ^[27].
Enterprises are struggling to prepare for AI and quantum threats, with only 22 percent of leaders open to fully autonomous AI for cyber defense and just 21 percent implementing quantum-resistant security measures ^[33].

Regulatory or Policy Developments Affecting the Security Industry

The US Treasury blacklisted the most-wanted ATM malware developer and his network, continuing efforts to disrupt the Tren de Aragua ATM jackpotting scheme ^[38].
The White House announced a voluntary AI safety accord with major technology companies, including new controls and oversight requirements for “Super Intelligence” systems ^[26].

Sources

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft - thehackernews.com
MetaMask Security Incident Prompts Exit of Affected Ethereum Validators - thehackernews.com
Metamask discloses security incident affecting its infrastructure - bleepingcomputer.com
Hackers stole Pentagon personnel records of over 3 million people - bleepingcomputer.com
Pentagon breach exposes Social Security numbers and military records of millions - malwarebytes.com
DIVD says Zammad zero-days enabled AI-driven network breach - bleepingcomputer.com
Zammad Zero-Days Exploited in AI-Powered DIVD Hack - securityweek.com
Hackers steal protective order and foster care records from Arizona courts - malwarebytes.com
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV - thehackernews.com
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager - thehackernews.com
Cisco warns of new SD-WAN zero-day exploited in attacks - bleepingcomputer.com
Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability - securityweek.com
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path - thehackernews.com
Kiteworks patches max severity code injection vulnerability - bleepingcomputer.com
CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS - bleepingcomputer.com
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets - thehackernews.com
Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure - securityweek.com
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs - thehackernews.com
OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates - thehackernews.com
Russian state hackers use new RedFlick technique to push malware - bleepingcomputer.com
Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net - darkreading.com
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures - thehackernews.com
Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure - darkreading.com
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks - thehackernews.com
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st) - isc.sans.edu
Warlock Ransomware Hits Large Spanish, Portuguese Orgs - darkreading.com
Police dismantle KillSec ransomware gang allegedly led by 16-year-old - bleepingcomputer.com
Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader - securityweek.com
Over 543,000 valid credentials exposed in public GitHub repositories - bleepingcomputer.com
500,000 Active Credentials Left Exposed on GitHub - securityweek.com
AI Has Changed Attack Speed, Not Security Fundamentals - securityweek.com
As AI Reshapes the SOC Career Ladder, Satisfaction Rises for 91%, but Entry Gets Harder for Nearly Half - darkreading.com
Enterprises Struggle to Prepare for AI and Quantum Threats, PwC Says - securityweek.com
Treasury Blacklists Most-Wanted ATM Malware Developer and His Network - securityweek.com
Trump, Tech Giants Strike Voluntary AI Safety Accord - darkreading.com

Cybersecurity Brief – 2026-08-25

Tue, 25 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Iran-linked hackers were responsible for shutting down a UK power plant for four days, causing significant operational disruption and raising concerns about the resilience of the UK’s distributed energy infrastructure ^[35].
Apollo Global, a private equity firm, experienced a data breach that exposed personal information as part of a campaign targeting major financial companies ^[33].
ReliaQuest confirmed that an employee was targeted in a phishing attack following the ShinyHunters breach. Attackers gained access to a dashboard, but the impact was limited and no data theft occurred ^[15]^[28].
A breach at South Korea’s government-backed startup platform exposed encrypted personal data due to an encryption key being included in an API, highlighting key management failures ^[17].

Newly Discovered Vulnerabilities

A maximum-severity vulnerability (CVE-2026-21962) in Oracle HTTP Server and Oracle WebLogic Server is being actively exploited, allowing unauthenticated attackers to access critical data. CISA has added the flaw to its Known Exploited Vulnerabilities catalog ^[3]^[27].
The Zimbra Collaboration Suite is affected by an actively exploited vulnerability (CVE-2026-73570) that allows full takeover of user communications. CISA has mandated a three-day patch deadline for US government agencies ^[19]^[21].
Red Hat and the Keycloak project patched a critical password reset flaw that could allow unauthenticated remote attackers to take over any account on the open-source identity and access management server ^[8].
Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress are being targeted by attackers, enabling the forging of SAML responses and unauthorized admin access ^[13].
An unpatched flaw in Calix GS7 XGS (GS5239XG) residential routers allows remote attackers to bypass NAT and expose internal devices by creating port-forwarding rules ^[12].
The Spring Application Framework has received patches for 91 vulnerabilities, with more than 200 vulnerabilities patched so far this year, compared to 16 in 2025 and 22 in 2024 ^[31].

Notable Threat Actor Activity

The Chinese-speaking cybercrime group UAT-10147 is targeting Windows and Linux web servers globally across education, media, technology, and government sectors. The group uses AI to scale attacks, deploys SPECTRE malware with EDR bypass, and leverages a Linux rootkit ^[11].
Operation QUICSILVER is a cyber espionage campaign targeting Myanmar government and IT sectors using graduation ceremony invitation lures to deliver a Go-based backdoor called QUICAgent ^[9].
Threat actors are distributing the Weedhack malware to gamers by disguising it as fake Minecraft clients and leveraging SEO poisoning ^[5].
Multiple campaigns are using new malware families, including WordlistLoader and SynkLoader, to deliver infostealers and steal Windows credentials. These tools are being used to sell access to ransomware groups and employ techniques such as screen hijacking ^[7]^[22]^[23].

Trends, Tools, or Tactics of Interest

AI chatbots have been shown to be more effective than human scammers at building trust in social engineering attacks, particularly in romance scam scenarios ^[1].
AI-enabled social engineering is increasing the effectiveness of attacks, accounting for over 85 percent of cyber insurance losses in the first half of the year ^[2].
The rapid adoption of AI coding tools is increasing remediation debt as more code is shipped than can be effectively secured ^[4].
Only a small percentage of AI users present disproportionate security risks, particularly those using advanced AI tools for custom development and automation ^[10].
AI is accelerating vulnerability discovery, outpacing the rate of remediation, and tightening the window between disclosure and exploitation ^[25]^[34].
Malware campaigns are leveraging trending topics and fake software downloads, such as fake GTA 6 demo sites, to distribute infostealers targeting browser-stored credentials ^[39].
Fake Microsoft security scans are being used to trick victims into uninstalling antivirus software, facilitating refund scams ^[40].
The latest version of the ToxicPanda Android banking trojan has expanded capabilities to seize control of infected devices, block access to Google Play, and threaten enterprise environments ^[24]^[43].
AliExpress was found using silent audio processing as a browser fingerprinting technique, bypassing traditional cookie-based tracking ^[42].

Regulatory or Policy Developments Affecting the Security Industry

TikTok, ByteDance, and affiliates reached a $400 million settlement with the US Department of Justice over alleged violations of the Children’s Online Privacy Protection Act (COPPA) ^[14]^[36].
The Dutch Data Protection Authority fined Uber nearly $1 billion for violations of the EU’s General Data Protection Regulation related to automated suspensions of driver accounts ^[30].
Microsoft Teams introduced a policy allowing administrators to block all identified external bots from joining meetings, enhancing meeting security ^[16].

Sources

Iran-Linked Hackers Shut Down UK Power Plant for Four Days - securityweek.com
Personal Information Exposed in Apollo Global Data Breach - securityweek.com
ReliaQuest confirms failed data-theft attack after ShinyHunters breach - bleepingcomputer.com
ReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited - securityweek.com
South Korean startup platform breach exposes key management failures - bleepingcomputer.com
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data - thehackernews.com
CISA Warns of Exploited Oracle WebLogic Vulnerability - securityweek.com
CISA orders urgent patching of actively exploited Zimbra flaw - bleepingcomputer.com
Exploited Zimbra Flaw Highlights Shrinking Window to Patch - darkreading.com
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account - thehackernews.com
Hackers target WordPress sites in miniOrange auth bypass attacks - bleepingcomputer.com
Unpatched Calix flaw lets hackers bypass NAT to expose internal devices - bleepingcomputer.com
91 Vulnerabilities Patched in Spring Application Framework - securityweek.com
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit - thehackernews.com
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor - thehackernews.com
Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning - thehackernews.com
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords - thehackernews.com
Foul Language: WordlistLoader Disguises Malware as Ordinary Text - darkreading.com
Tricky 'SynkLoader' Multitool May Herald Ransomware - darkreading.com
Report: AI Chatbots Are More Effective at Building Trust Than Human Scammers - blog.knowbe4.com
Human Error Remains at the Core of AI-Enabled Social Engineering - blog.knowbe4.com
Shipping More AI Code Than You Can Secure? Watch How to Control Remediation Debt - thehackernews.com
The Outsized Shadow: Why 5% of AI Users Are Your Biggest Security Risk - thehackernews.com
The Vulnerability Gap: Why Discovery Is Outrunning Repair - darkreading.com
Rethinking Application Security for the AI Era - securityweek.com
Fake GTA 6 Extended Look and demo sites deliver an infostealer - malwarebytes.com
Fake Microsoft security scans trick victims into uninstalling their antivirus - malwarebytes.com
ToxicPanda Banking Trojan Matures Into Enterprise Threat - darkreading.com
ToxicPanda 2.0 can take over your Android phone and banking apps - malwarebytes.com
AliExpress caught using silent audio to fingerprint visitors’ browsers - malwarebytes.com
TikTok reaches $400M settlement with US over COPPA violations - bleepingcomputer.com
TikTok Reaches $400 Million Settlement With US Justice Department Over Children’s Privacy - securityweek.com
Uber Fined Nearly $1 Billion by Dutch Regulators Over Automated Suspensions of Driver Accounts - securityweek.com
Microsoft Teams now lets admins block external bots from meetings - bleepingcomputer.com