Major Incidents or Breaches

  • Cryptocurrency exchange Bitget confirmed that attackers stole $387.5 million by exploiting a zero-day vulnerability in a third-party security product. The investigation is ongoing to determine the full impact and attack vector [6].
  • MetaMask disclosed an ongoing security incident affecting part of its infrastructure, prompting the exit of affected Ethereum validators. The company is actively addressing and remediating the issue [7][18].
  • The Pentagon’s Defense Manpower Data Center (DMDC) suffered a breach of its human resources management system, resulting in the theft of personnel records and Social Security numbers of over 3 million military service members and their families [17][44].
  • The Dutch Institute for Vulnerability Disclosure (DIVD) reported that its network was breached via a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system, enabling attackers to hijack sessions, achieve remote code execution, and escalate privileges to root [20][39].
  • Hackers stole sensitive court records, including more than 150,000 foster care reports, from Arizona courts, raising privacy and safety concerns [46].

Newly Discovered Vulnerabilities

  • Cisco patched a critical authentication bypass vulnerability (CVE-2026-76504) in Catalyst SD-WAN Manager, which was being actively exploited to escalate attacker privileges to administrative level. The flaw has been added to CISA’s Known Exploited Vulnerabilities catalogue [3][11][23][41].
  • Security researchers published a public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw reportedly used in targeted attacks. There is speculation that WhatsApp PDF checks could be a potential delivery method [5].
  • Kiteworks released security updates to address 126 vulnerabilities, including a maximum severity code injection flaw in its Email Protection Gateway (EPG) security solution [15].
  • CISA issued a warning about a critical pre-authentication remote code execution vulnerability in MikroTik RouterOS that could enable attackers to execute code or cause denial-of-service conditions [22].
  • A now-patched Zimbra Collaboration Suite (ZCS) vulnerability (CVE-2026-73570) was exploited in the wild prior to public disclosure. The flaw could be triggered via specially crafted emails without user interaction, allowing attackers to deploy web shells and access mailbox data [9][36].
  • Threat actors exploited a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway, dropping web shells and attempting theft of configuration data [8].

Notable Threat Actor Activity

  • OpenAI disrupted a coordinated campaign linked to Moonshot AI Associates that attempted to illicitly extract protected reasoning from its AI models [2].
  • Russian state actor Star Blizzard deployed a new technique dubbed “RedFlick” to install the CosmicPulse backdoor via phishing against Ukrainian-linked targets, including NGOs, think tanks, and journalists. This marks a shift away from previous ClickFix tactics [19][28].
  • Threat actors abused ChatGPT Custom GPTs, disguising them as legitimate offerings to lure victims to malicious sites using ClickFix-style lures and deliver remote access trojans (RATs) [12][25].
  • Microsoft reported phishing campaigns distributing MSP360 Remote Monitoring and Management (RMM) installers, which then deploy ScreenConnect in dual-RMM attacks. These campaigns use meeting invitations and PDF-themed lures to trick users [10][30].
  • The Warlock ransomware group, believed to be Chinese and exhibiting both cybercrime and APT characteristics, targeted large organizations in Spain and Portugal [24].
  • Police, through Operation KillSwitch, dismantled the KillSec ransomware gang, seized its leak site and servers, and arrested three individuals, including the alleged 16-year-old leader. At least 110 terabytes of stolen victim data was secured [13][34].

Trends, Tools, or Tactics of Interest

  • Over 543,000 valid credentials were found exposed in public GitHub repositories as of July, despite platform security measures. Approximately 200,000 of these credentials were exposed after GitHub enabled push protections by default [21][40].
  • AI is accelerating both vulnerability discovery and exploitation, increasing the speed of attacks, while defensive fundamentals such as defense-in-depth remain critical [35].
  • AI is reshaping the Security Operations Center (SOC) career ladder. While 91 percent of security professionals report increased satisfaction due to AI-driven detection and response, nearly half find entry into the field more difficult, and one in four say AI limits skill development [27].
  • Enterprises are struggling to prepare for AI and quantum threats, with only 22 percent of leaders open to fully autonomous AI for cyber defense and just 21 percent implementing quantum-resistant security measures [33].

Regulatory or Policy Developments Affecting the Security Industry

  • The US Treasury blacklisted the most-wanted ATM malware developer and his network, continuing efforts to disrupt the Tren de Aragua ATM jackpotting scheme [38].
  • The White House announced a voluntary AI safety accord with major technology companies, including new controls and oversight requirements for “Super Intelligence” systems [26].

Sources#

  1. Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft - thehackernews.com
  2. MetaMask Security Incident Prompts Exit of Affected Ethereum Validators - thehackernews.com
  3. Metamask discloses security incident affecting its infrastructure - bleepingcomputer.com
  4. Hackers stole Pentagon personnel records of over 3 million people - bleepingcomputer.com
  5. Pentagon breach exposes Social Security numbers and military records of millions - malwarebytes.com
  6. DIVD says Zammad zero-days enabled AI-driven network breach - bleepingcomputer.com
  7. Zammad Zero-Days Exploited in AI-Powered DIVD Hack - securityweek.com
  8. Hackers steal protective order and foster care records from Arizona courts - malwarebytes.com
  9. CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV - thehackernews.com
  10. Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager - thehackernews.com
  11. Cisco warns of new SD-WAN zero-day exploited in attacks - bleepingcomputer.com
  12. Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability - securityweek.com
  13. Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path - thehackernews.com
  14. Kiteworks patches max severity code injection vulnerability - bleepingcomputer.com
  15. CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS - bleepingcomputer.com
  16. Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets - thehackernews.com
  17. Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure - securityweek.com
  18. Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs - thehackernews.com
  19. OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates - thehackernews.com
  20. Russian state hackers use new RedFlick technique to push malware - bleepingcomputer.com
  21. Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net - darkreading.com
  22. Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures - thehackernews.com
  23. Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure - darkreading.com
  24. Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks - thehackernews.com
  25. ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st) - isc.sans.edu
  26. Warlock Ransomware Hits Large Spanish, Portuguese Orgs - darkreading.com
  27. Police dismantle KillSec ransomware gang allegedly led by 16-year-old - bleepingcomputer.com
  28. Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader - securityweek.com
  29. Over 543,000 valid credentials exposed in public GitHub repositories - bleepingcomputer.com
  30. 500,000 Active Credentials Left Exposed on GitHub - securityweek.com
  31. AI Has Changed Attack Speed, Not Security Fundamentals - securityweek.com
  32. As AI Reshapes the SOC Career Ladder, Satisfaction Rises for 91%, but Entry Gets Harder for Nearly Half - darkreading.com
  33. Enterprises Struggle to Prepare for AI and Quantum Threats, PwC Says - securityweek.com
  34. Treasury Blacklists Most-Wanted ATM Malware Developer and His Network - securityweek.com
  35. Trump, Tech Giants Strike Voluntary AI Safety Accord - darkreading.com