Major Incidents or Breaches

  • Cryptocurrency exchange Bitget suffered a breach resulting in a $387.5 million loss after attackers exploited a zero-day vulnerability in a third-party security product used by the company [15].
  • The French tax administration experienced a data breach in which an attacker used stolen staff credentials to exfiltrate tax data belonging to hundreds of thousands of individuals and businesses. The compromise went undetected for seven weeks [9].
  • The Dutch Institute for Vulnerability Disclosure (DIVD) was breached via an automated AI agent in an attack described as “loud and very, very messy” [24].
  • South Africa’s air traffic control systems were targeted by a cyberattack that deployed a ransomware toolkit on at least one operational network [25].
  • AI coding agents inadvertently exposed more than 13,000 internal company images, including billing records, by uploading screenshots to public GitHub repositories [4].

Newly Discovered Vulnerabilities

  • Multiple critical vulnerabilities have been disclosed and patched in Citrix NetScaler ADC and Gateway products, including CVE-2026-88772 and CVE-2026-88771. These flaws allow pre-authentication code execution and have been actively exploited to gain root access, deploy web shells, steal credentials, and move laterally within victim networks. Government and finance organizations are among those affected [6][8][20][30][36].
  • OpenSSL released fixes for a high-severity DTLS flaw that can leak heap memory to the other side of a DTLS connection or cause a crash. WolfSSL also patched several high-severity vulnerabilities [7][41].
  • TeamViewer warned users to urgently patch a set of high-severity vulnerabilities in its client and host software [14].
  • A newly disclosed Spectre-v2 Branch Target Reuse (BTR) attack variant enables attackers to recover Linux root password hashes in minutes, bypassing existing mitigations [10][23].
  • Apple reported that CVE-2026-86950, an out-of-bounds write vulnerability, is being actively weaponized in targeted attacks [26].
  • WatchGuard issued patches for 15 vulnerabilities in Fireware OS, including code execution, denial of service, authorization, and path traversal bugs [35].
  • Unsloth Studio patched a vulnerability allowing malicious AI models to execute arbitrary Python code during model inspection if the trust_remote_code setting is enabled [27].
  • Chrome and Firefox released updates addressing over 100 vulnerabilities, some of which could allow remote code execution or sandbox escape [37].

Notable Threat Actor Activity

  • Russian state-sponsored group Star Blizzard (also known as APT29) has conducted large-scale phishing campaigns using fake event invitations and the ‘RedFlick’ infection chain to deliver the CosmicPulse backdoor, targeting over 100 organizations [11][39].
  • Microsoft observed a China-based actor, dubbed ‘NeedyMantis’, using a previously unidentified malware framework for long-term access in targeted intrusions against telecommunications, universities, medical, and government-related organizations [29].
  • The ShinyHunters extortion group was addressed by the FBI following the arrest of an alleged leader, with the FBI urging remaining members to turn themselves in. ShinyHunters responded defiantly [19][40].

Trends, Tools, or Tactics of Interest

  • Social engineering attacks are increasingly leveraging audio and video deepfakes, with 41 percent of CISOs reporting an audio deepfake attack against their organization in the past year and 36 percent reporting deepfake targeting of employees [1].
  • Custom malicious ChatGPT variants promoted via sponsored Google results are being used to lure victims to sites that deploy RAT malware through ClickFix attacks [18].
  • Recent US-focused phishing campaigns targeting C-suite executives have been observed stealing Microsoft 365 sessions and deploying remote monitoring and management (RMM) tools for persistent remote access. The campaigns predominantly targeted technology, manufacturing, government, and consulting sectors [5].
  • Browser-based attacks remain a significant initial vector for breaches, with many attacks contained entirely within browser sessions [3].
  • AI agent security is being addressed with new tools such as KnowBe4’s Agent Risk Manager, which integrates with the Claude Compliance API to monitor and detect AI agent risks in real time [2].
  • Anthropic and other industry voices are raising concerns over liability risks associated with autonomous AI agents, as lawsuits emerge following incidents involving AI-driven attacks [33][38].

Regulatory or Policy Developments Affecting the Security Industry

  • Microsoft will implement new protections in Entra ID to block external script injection attacks starting in October [13].
  • Cloudflare announced a public certificate authority designed for post-quantum cryptography, offering automated certificates intended to be resistant to quantum computing threats [28].
  • A group of major technology firms has signed a voluntary accord to self-police AI development, focusing on four key steps and signaling the possibility of future regulation [42].
  • DARPA selected Xint to use AI for identifying vulnerabilities in military messaging apps, with potential commercial applications [44].

Sources#

  1. Bitget hacked via zero-day in third-party security products - bleepingcomputer.com
  2. French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks - thehackernews.com
  3. Automated AI agent used to breach cybersecurity nonprofit DIVD - bleepingcomputer.com
  4. South Africa Seeks Help After Cyberattack Targets Air Traffic Control - darkreading.com
  5. AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub - thehackernews.com
  6. Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT - thehackernews.com
  7. Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution - thehackernews.com
  8. Hackers exploit Citrix NetScaler zero-day to deploy web shells - bleepingcomputer.com
  9. Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers - darkreading.com
  10. Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks - securityweek.com
  11. OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted - thehackernews.com
  12. High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL - securityweek.com
  13. TeamViewer urges users to patch severe flaws “as soon as possible” - bleepingcomputer.com
  14. New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses - thehackernews.com
  15. New Spectre v2 attack variant leaks Linux root password hash in minutes - bleepingcomputer.com
  16. Apple Zero-Day Vulnerability Weaponized in Targeted Attacks - darkreading.com
  17. WatchGuard Patches Critical Fireware OS Code Injection Vulnerability - securityweek.com
  18. Unsloth Studio Flaw Turns Routine Model Inspection Into Code Execution - darkreading.com
  19. Chrome, Firefox Updates Patch Over 100 Vulnerabilities - securityweek.com
  20. Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor - thehackernews.com
  21. Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks - securityweek.com
  22. 'NeedyMantis' Provides Long-Term Access to Compromised Networks - darkreading.com
  23. FBI tells ShinyHunters members to turn themselves in after recent arrest - bleepingcomputer.com
  24. ShinyHunters Defiant After FBI Calls on Members to Come Forward - securityweek.com
  25. Report: Social Engineering Attacks Are Increasingly Using Audio and Video Deepfakes - blog.knowbe4.com
  26. Custom ChatGPTs push ClickFix attacks to deploy RAT malware - bleepingcomputer.com
  27. US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access - thehackernews.com
  28. Know Your Enemy: Browser-Based Attack Techniques in 2026 - thehackernews.com
  29. Govern Claude AI with KnowBe4’s Agent Risk Manager - blog.knowbe4.com
  30. OpenAI Gets Sued Over the Hugging Face Hack - wired.com
  31. Anthropic Flags AI Agent Liability Risks as OpenAI Faces Hacking Lawsuit - securityweek.com
  32. Microsoft to block Entra ID script injection attacks starting October - bleepingcomputer.com
  33. Cloudflare Announces Public Certificate Authority for the Post-Quantum Web - darkreading.com
  34. Trump Says Top Tech Firms Have Signed Accord to ‘Self-Police’ AI Development - securityweek.com
  35. DARPA Selects Xint to Use AI in Securing Military Messaging Apps - securityweek.com