THE BOTTOM LINE

This week, attackers again went after the equipment companies use to protect their networks: SD-WAN controllers, email security gateways and remote-access appliances. Another Citrix flaw was exploited, and the Pentagon records breach grew clearer.

CRITICAL

Cisco network controller bypassed

Attackers logged in to Cisco’s SD-WAN manager as administrator without a password. Federal agencies were given three days to fix it.

CRITICAL

Email security gateway attacked

Fortinet’s FortiMail was exploited before a fix existed. Attackers wrote files onto the appliances, and finished patches are still on the way.

CRITICAL

Citrix hit again

A new Citrix NetScaler flaw is being exploited in targeted attacks, including against devices that had been patched only days earlier.

BREACH

Pentagon records breach clarified

More than three million people, living and deceased, had Social Security numbers and service details stolen from a Defense Department file-sharing system.

THREAT

AI attacker broke into a security nonprofit

An autonomous AI agent chained two unknown flaws to take over a Dutch security group’s systems within seconds.

REGULATORY

Overlapping cyber rules, industry says

Industry told a government watchdog that duplicate federal cyber rules make it hard to meet every reporting deadline.

Technical Scope

CISA added CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, to the Known Exploited Vulnerabilities catalog on 30 September, with a 3 October deadline for federal civilian agencies. A hex-encoding flaw in URI handling lets an unauthenticated remote attacker send crafted HTTP requests and gain the privileges of the admin user. CISA published indicators in the service-proxy and vManage log files, and eight Cisco SD-WAN flaws have now reached the catalog in 2026.

Forensics / Compliance Impact

The SD-WAN manager is the control plane for every branch and plant connection it orchestrates, so administrator access to it is administrator access to the wide-area network itself. Cisco has not disclosed who is exploiting the flaw or how many systems were compromised, which leaves operators unable to judge exposure from the advisory alone. The three-day federal deadline again sets the pace that assessors and primes will expect of suppliers running the same product.

SOURCE: The Hacker News — CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV

Technical Scope

Fortinet disclosed CVE-2026-104286, a CVSS 9.8 path traversal and null-byte handling flaw in the FortiMail management interface that lets an unauthenticated attacker write arbitrary files through crafted HTTP or HTTPS requests. It affects FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8 and 7.2.0-7.2.9, and fixed releases 7.4.9, 7.6.7 and 8.0.2 were still listed as upcoming at disclosure. Indicators show attackers adding malicious files, modifying system binaries and configuring remote archive accounts that send data to two named IP addresses; CISA added the flaw to the KEV catalog with a 4 October federal deadline.

Forensics / Compliance Impact

A mail security gateway sees and stores the organization’s inbound and outbound email, so file-write access on the appliance exposes message content and credentials passing through it. The remote archive accounts show data theft was part of the observed activity, not just access. Fortinet’s only interim measures were disabling a feature or limiting management access, which means exposed appliances carried risk for the whole pre-patch window.

SOURCE: BleepingComputer — Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Technical Scope

Citrix released emergency patches on 4 October for CVE-2026-88779, a CVSS 8.7 memory buffer flaw in NetScaler ADC and Gateway appliances configured for SAML authentication, which is being exploited in targeted attacks. Citrix describes it as a denial-of-service flaw, but researchers observed attackers placing shell commands in authentication usernames to download and run payloads, and repeated crashes of the nsaaad process force appliance reboots. Fixed builds are 14.1-73.41 and 13.1-64.28 plus the FIPS variants, and CISA added the flaw to the KEV catalog with a 7 October federal deadline.

Forensics / Compliance Impact

This is the third NetScaler flaw exploited in roughly a week, following two remote-code-execution zero-days that were attacked for weeks before disclosure. SecurityWeek reports the new flaw is hitting appliances that had been upgraded days earlier for the previous problems, so a recent patch level does not show an appliance is safe. Remote-access gateways like this front employee and contractor access, which makes repeated exploitation a continuity risk as well as a security one.

SOURCE: BleepingComputer — Citrix patches NetScaler SAML zero-day exploited in attacks

Technical Scope

CVE-2026-61500 is a CVSS 9.3 flaw in Rejetto HFS 3.0.0 through 3.2.0 in which the session-cookie signing key is derived from a non-cryptographic random number generator whose outputs are exposed to unauthenticated clients at login. An attacker can rebuild the generator state, forge an administrator cookie and run arbitrary code through the server_code feature. Horizon3.ai published details on 30 September, a public proof-of-concept followed, and exploitation attempts from an unnamed Chinese threat actor against U.S. hosts were detected on 1 October; version 3.2.1 fixed the flaw in July.

Forensics / Compliance Impact

The attack window opened within a day of the public proof-of-concept, even though the fix had been available since July, which is the familiar gap between a vendor patch and its deployment. Lightweight file-sharing tools are often installed outside formal change control, so they tend to be missing from asset inventories that audits and incident scoping depend on. Horizon3.ai credits the discovery to an AI model, another sign that the interval between disclosure and exploitation is shrinking.

SOURCE: The Hacker News — Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE

Technical Scope

Dell disclosed two maximum-severity flaws, CVE-2026-63688 and CVE-2026-63692, in the Authorization module of Container Storage Modules (CSM), caused by missing authentication on critical functions that lets an unauthenticated remote attacker obtain storage-backend administrator credentials and bypass authorization. Four further critical flaws enable root access on cluster nodes, administrative access bypass, token forgery and access to Kubernetes Secrets. CSM versions before 1.18.0 are affected, and no exploitation had been reported as of 2 October.

Forensics / Compliance Impact

CSM sits between Kubernetes workloads and the storage arrays that hold their data, so control of this module reaches the storage layer, not just a single container. Dell notes that state-sponsored actors have exploited other Dell products in the past, which is why a maximum-severity, unauthenticated flaw is watched even before exploitation is reported. Organizations running containerized workloads on Dell storage will need to confirm their version to know whether they are in scope.

SOURCE: BleepingComputer — Dell asks admins to patch max severity CSM flaws as soon as possible

Technical Scope

GitLab patched CVE-2026-90970, rated 9.9, in the self-hosted GitLab AI Gateway, where an authenticated user with Duo Agent Platform access can escape the prompt template sandbox through a crafted flow configuration and execute arbitrary commands. Versions before 19.2.4, 19.3.2 and 19.4.1 are affected; GitLab-hosted instances were already patched and GitLab contacted affected customers before public disclosure. No exploitation was reported.

Forensics / Compliance Impact

The AI Gateway connects the development platform to model services and typically holds the credentials and code context that make it useful, so command execution there reaches source code and build pipelines. The flaw requires an authenticated user, which narrows the exposure but treats any compromised developer account as a path to the server. GitLab also noted it is one of five of its vulnerabilities that CISA has tracked as exploited since 2021, which puts the platform in the group attackers revisit.

SOURCE: The Hacker News — GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

Technical Scope

Kiteworks released version 9.4.1 on 1 October, fixing CVE-2026-54154, a maximum-severity flaw in the Email Protection Gateway (EPG) that chains path traversal, code injection and missing authentication into unauthenticated remote code execution and full administrative control. The release fixed 126 vulnerabilities in total, including 11 critical flaws in the Core and EPG components affecting authentication and access control. The flaw was reported through the bug bounty program and no active exploitation was documented in the report.

Forensics / Compliance Impact

This follows Kiteworks’ earlier request that customers shut down servers on a law-enforcement warning of an imminent attack, so the vendor’s secure-file-exchange products are under visible pressure. Kiteworks is used to move controlled and regulated files between organizations, which makes any gateway compromise a data-handling and contractual event for the customers involved. The size of the release suggests a broad review of the product, and customers will be working through a long list of fixes at once.

SOURCE: BleepingComputer — Kiteworks patches max severity Email Protection Gateway code injection vulnerability

Technical Scope

A Government Accountability Office report published 29 September summarizes a three-hour July panel in which six organizations from the energy, financial and health sectors described conflicting reporting thresholds, timelines and definitions across federal cyber rules. The regulators cited include CISA, the SEC, TSA, NERC, NCUA, the FTC and HHS. Participants said the overlap makes it difficult to satisfy every reporting requirement and remediate threats within required time frames.

Forensics / Compliance Impact

Defense suppliers face the same stacking of obligations, with contract-based incident reporting running alongside sector, state and securities rules that each define a reportable event differently. The GAO finding does not change any requirement, but it records the compliance burden that regulators are being asked to harmonize. Until that happens, organizations that report to more than one authority are tracking several clocks for a single incident.

SOURCE: Cybersecurity Dive — GAO report spotlights industry’s concerns about overlapping cybersecurity regulations

Technical Scope

On 2 October the Treasury Department sanctioned eight members of the Venezuelan gang Tren de Aragua, including leader Anibal Alexander Canelon Aguirre, who developed the Ploutus ATM malware, and added seven TRON cryptocurrency addresses to the Specially Designated Nationals list. Treasury attributes more than 1,500 ATM jackpotting attacks and about 40.73 million dollars stolen from U.S. financial institutions as of August 2025. The Justice Department has charged 98 suspects since October 2025.

Forensics / Compliance Impact

The action extends sanctions law to a malware-driven cash-out operation, which raises legal exposure for any organization or intermediary that handles payments linked to the designated parties. Sanctions designations also give financial institutions and their vendors a defined list to screen against. It is a reminder that physical-device malware operations are treated as organized-crime and terrorism matters, not only as technical incidents.

SOURCE: BleepingComputer — US sanctions Tren de Aragua members in ATM hacks crackdown

Technical Scope

SecurityWeek reported on 4 October that the President appointed Director of National Intelligence Jay Clayton to lead a new federal artificial intelligence task force, joined by the FTC Chairman, the Pentagon Chief Technology Officer and the Director of the Office of Personnel Management. The group is to coordinate federal AI policy and follow up on a voluntary industry accord announced the previous week in which major technology companies committed to self-regulating AI development. It will report to the President and the Chief of Staff.

Forensics / Compliance Impact

The task force is a coordination body and does not itself set binding requirements, but its membership spans intelligence, consumer protection, defense technology and federal personnel policy. Organizations that build or buy AI-enabled tools, including defense suppliers, should expect AI governance expectations to emerge through contracts and agency guidance. The reliance on a voluntary industry accord means obligations for most companies remain unchanged for now.

SOURCE: SecurityWeek — Trump Names National Intelligence Director Jay Clayton to Lead a New Federal AI Task Force

Technical Scope

Apple patched CVE-2026-86950, an out-of-bounds write in the Core Graphics framework that allows arbitrary code execution when processing a crafted file, and said it may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS before version 27. Fixes shipped in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1 and the 27.0.1 releases. On 1 October researchers published a proof-of-concept malicious PDF that causes controlled crashes but does not demonstrate code execution; Meta Product Security discovered the flaw.

Forensics / Compliance Impact

Apple has not said who was targeted or by whom, and the public crash proof-of-concept lowers the barrier for others to build on the flaw. The PDF path matters because documents arrive through email and messaging, so exposure is not limited to people who browse risky sites. Managed fleets of iPhones and Macs are affected until the fixed releases are installed.

SOURCE: Help Net Security — Apple Core Graphics zero-day (CVE-2026-86950) fixed

Technical Scope

Fortra patched eight vulnerabilities in the Core Privileged Access Manager (BoKS), including CVE-2026-79901 at CVSS 9.9, an authentication bypass caused by predictable passwords seeded with Unix timestamps, CVE-2026-12627 at 9.8, a stack buffer overflow in autoregistration, and CVE-2026-79898 at 9.1, a command injection in the crlserver REST and SOAP interfaces. The authentication bypass affects BoKS Manager deployments that use the BoKS keytab to manage Active Directory service accounts. Fortra does not report exploitation in the wild.

Forensics / Compliance Impact

Privileged access managers hold the keys to other systems, so a bypass in one turns a single product flaw into potential access across the servers it governs. The network-reachable command injection widens the exposure beyond local users. Absence of reported exploitation is the current state; public detail of predictable-password flaws tends to speed up attacker interest.

SOURCE: SecurityWeek — Fortra Patches Critical Vulnerabilities in BoKS

Technical Scope

OpenSSL released fixes on 29 September for 14 flaws, led by CVE-2026-84782, a high-severity DTLS bug in which a handshake message resend during a partially transmitted larger message can send heap memory to the peer as unencrypted handshake data or crash the program. Fixed public releases are 4.0.3, 3.6.5, 3.5.9 and 3.4.8, while 3.0.23, 1.1.1zj and 1.0.2zs are available only to premium support customers. One moderate, one low and eleven further low-severity issues were also disclosed.

Forensics / Compliance Impact

OpenSSL is embedded in operating systems, appliances and applications that rarely announce the version they carry, so the practical question for most organizations is which of their products inherit the fix and when the vendor ships it. The older 3.0, 1.1.1 and 1.0.2 fixes sit behind paid support, which affects long-lived industrial and embedded equipment that cannot easily move to newer branches. Because DTLS is used by VPNs and real-time protocols, the leak affects a narrower set of deployments than TLS flaws do.

SOURCE: The Hacker News — OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted

Technical Scope

A 16-year-old researcher reported that Microsoft’s internal Titan analytics service did not verify JSON Web Token signatures, so changing the username claim to admin granted administrator access. The exposed data included about 25,000 account and email entries, roughly 18,000 employee email records, about 15,000 employee organization records and Bing search analytics with location data, across an estimated 17.3 trillion rows in 17 databases. Microsoft locked down the endpoint on 9 September and paid a 5,000 dollar bounty on 17 September.

Forensics / Compliance Impact

Unverified token signatures are a basic authentication failure, and the case shows how an internet-reachable internal analytics tool can hold large volumes of personal and employee data. Microsoft edited sections and figures of the researcher’s disclosure before publication, so the row count is the researcher’s estimate and includes duplicated and historical data. The case is relevant to any organization whose internal dashboards are reachable from the internet behind token-based sign-in.

SOURCE: Help Net Security — 16-year-old researcher breaks into Microsoft analytics service with access to 17 trillion rows of data

Technical Scope

Pillar Security reported, as summarized in The Hacker News ThreatsDay bulletin of 1 October, a critical flaw in the Unsloth AI fine-tuning library in which selecting a model in the web interface caused the backend to download and execute Python code shipped inside that model’s Hugging Face repository. Simply reading the model configuration file triggers the exploit, enabling credential theft and data exfiltration. The flaw is fixed in version 2026.6.9.

Forensics / Compliance Impact

The flaw turns browsing a public model repository into code execution on the machine running the tool, which collapses the usual line between inspecting a model and running it. AI development hosts commonly hold cloud credentials, API keys and proprietary training data, so a single selection can reach all of them. It adds to the pattern of AI development tooling treating third-party content as trusted input.

SOURCE: The Hacker News — ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories

Technical Scope

OpenInfra Europe disclosed that attackers exploited CVE-2026-82329, an authentication bypass in JFrog Artifactory, to gain administrator access to its self-hosted instance at artifactory.nordix.org. The flaw was publicly disclosed on 28 August, exploitation began on 31 August, and the breach was discovered on 15 September when a legitimate user was denied access. Any artifact downloaded or installed from the repository between 28 August and 15 September is considered potentially compromised, and the full scope remains undetermined.

Forensics / Compliance Impact

An administrator on an artifact repository can alter the packages, credentials and integrations that downstream builds trust, so a compromise reaches every project that pulled from it, not only the host. Discovery came by chance from a locked-out user rather than from monitoring, and the exposure window spanned more than two weeks. Software developers that mirror or consume third-party repositories rely on exactly this kind of trust for build integrity.

SOURCE: Help Net Security — OpenInfra JFrog Artifactory instance compromised

Technical Scope

Symantec and Carbon Black reported that the China-linked Warlock ransomware group, also tracked as Longlegs, exploited the ToolShell SharePoint vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771) to place web shells on a water utility, a telecom provider, a regional government body and a university. The group used a bring-your-own-vulnerable-driver technique with the K7RKScan driver (CVE-2025-1055) to kill antivirus and EDR tools, installed Visual Studio Code Insiders as a service for remote tunneling, and used NetExec for Active Directory enumeration. One intrusion began on 22 July and ransomware was deployed on 31 July; victims were in Portuguese- and Spanish-speaking regions across Europe, Africa and Latin America.

Forensics / Compliance Impact

The SharePoint flaws involved were disclosed in 2025, so the intrusions succeeded against servers that had not been updated for more than a year. Using a signed but vulnerable driver and a legitimate code editor for tunneling helps attackers avoid tools that look for conventional malware, which pushes detection toward behavior and privilege changes. Water and telecom victims show the group is reaching operators of essential services, not only commercial targets.

SOURCE: BleepingComputer — Warlock ransomware breach SharePoint in water, telecom operator attacks

Technical Scope

Proofpoint attributed a reply-triggered phishing campaign to TA419, an espionage-motivated China-aligned group active since April 2025, aimed at AI policy experts at U.S. think tanks, universities and legal organizations, with wider interest in defense, national security, energy and foreign policy. Lures combine a frameless browser-in-the-browser page with an adversary-in-the-middle proxy that captures Microsoft credentials and session cookies. The actors posed as prominent economists, AI policymakers and an Anthropic employee, and in July impersonated members of the White House Office of Science and Technology Policy.

Forensics / Compliance Impact

Capturing session cookies lets an attacker bypass multifactor sign-in and operate inside a mailbox as the legitimate user, which makes this technique relevant to any Microsoft 365 tenant. Reply-triggered lures start as ordinary conversations, so the first message contains nothing to flag. The target set overlaps with people who advise on defense and technology policy, which includes staff at defense industrial base organizations.

SOURCE: The Hacker News — China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing

Technical Scope

Microsoft reported that Star Blizzard, a Russian state-sponsored group active since 2017, is delivering the CosmicPulse backdoor through a phishing chain called RedFlick, in which password-protected archives contain VHDX virtual disks with disguised shortcut files that install the malware through scheduled tasks. The NOROBOT and BAITSWITCH downloader components stage the backdoor. Microsoft observed 13 large-scale campaigns since early 2026 against more than 100 organizations, primarily in the U.S. and U.K., including NGOs, think tanks, governments and financial entities supporting Ukraine.

Forensics / Compliance Impact

Password-protected archives and virtual disk images are used to avoid email scanning and the mark-of-the-web warnings that normally accompany downloaded files. The campaign scale, 13 operations in under a year, indicates sustained collection rather than opportunistic phishing. Organizations that support or contract for Ukraine-related work fall within the stated target profile.

SOURCE: BleepingComputer — Russian state hackers use new RedFlick technique to push malware

Technical Scope

Cisco Talos described Antino, a Rust-compiled Windows backdoor used by UAT-11587, a China-nexus group with possible overlap to Jewelbug, against government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria. The chain starts with spoofed spear-phishing and fake Gmail attachment widgets, moves through HTA or WSF stagers, a JavaScript downloader and .NET deserialization, and sideloads DLLs through legitimate Microsoft binaries. Command and control runs through Microsoft 365 Outlook and OneDrive; activity peaked between March and June 2026, with a concentrated burst on 8-9 June.

Forensics / Compliance Impact

Routing command traffic through Outlook and OneDrive means the malicious connections look like ordinary Microsoft 365 use, which defeats allow-lists and reputation-based blocking. The campaign is aimed at Asian governments, so exposure for U.S. contractors is indirect, but the tradecraft is reusable against any Microsoft 365 customer. The report is a disclosure of activity from earlier in the year rather than a new wave.

SOURCE: The Hacker News — Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

Technical Scope

The Dutch Institute for Vulnerability Disclosure reported that an autonomous AI agent breached its network on 21 September by chaining two zero-day flaws in the Zammad ticketing system, CVE-2026-102489 and CVE-2026-102490, for session hijacking, remote code execution and escalation from the Zammad user to root. The agent decided its next steps without outside direction, read and exfiltrated data from DIVD systems, and documented its own decisions, which let DIVD reconstruct the incident. Network segmentation stopped deeper penetration, and the investigation was ongoing.

Forensics / Compliance Impact

The speed of the chain, from first access to root within seconds, leaves almost no window for human response during a live intrusion. DIVD’s segmentation limited the damage, which shows a design control working against an automated attacker. The case is among the first publicly described intrusions in which an autonomous agent found and used previously unknown flaws, so defenders now have a reference point for that class of attack.

SOURCE: BleepingComputer — DIVD says Zammad zero-days enabled AI-driven network breach

Technical Scope

Notification letters shared online in early October show that the Defense Manpower Data Center breach affected more than 3 million people, about 2.8 million living individuals and 294,000 deceased. Attackers exploited a vulnerability in the center’s file-sharing systems in October 2025 and kept access until the flaw was found in July 2026. Stolen data includes Social Security numbers, names, dates of birth, contact information, sex, race and military personnel details, and the Pentagon is offering 12 months of credit monitoring through IDX with an enrollment deadline of 19 August 2027.

Forensics / Compliance Impact

The letters give a firmer population than the up-to-four-million estimate in last week’s coverage and show the data covers the deceased as well as living personnel. Access lasted roughly nine months before discovery, which is the exposure window that matters for how long the stolen data was being collected. Social Security numbers combined with personnel details support identity fraud and targeted impersonation of service members and veterans, many of whom now work for contractors.

SOURCE: BleepingComputer — Hackers stole Pentagon personnel records of over 3 million people

Technical Scope

The Technical University of Denmark disclosed on 3 October that an attacker used compromised credentials to log in to DTUBasen, its identity and access management system, and downloaded a large volume of data spanning more than two decades. Up to 200,000 people are affected, about 40,000 active users and 160,000 former users. Exposed data includes Danish CPR civil registration numbers, names and home addresses, profile pictures, work contact details and job titles, and next-of-kin names, relationships and telephone numbers.

Forensics / Compliance Impact

The attacker reached the identity system with a stolen login, so the breach reflects a credential problem rather than a software flaw. DTU said it cannot determine exactly what was downloaded or how many people are affected, which means its visibility into activity in the system was incomplete. Identity directories that retain data for former users keep large populations exposed for years after they leave.

SOURCE: BleepingComputer — Danish university DTU breach exposes data of up to 200,000 people

Technical Scope

Frontline Education began sending notifications on 1 October after identifying on 14 August that a vulnerability in a third-party software product it uses allowed unauthorized access to part of its environment. Exposed data includes Social Security numbers, email addresses and physical addresses, with at least 1,210 employees affected at one identified district and the total across districts undisclosed. Frontline engaged an outside cybersecurity firm and law enforcement and is offering two years of credit monitoring through TransUnion; districts can opt out of Frontline-provided notices by 16 October.

Forensics / Compliance Impact

The breach came through a supplier’s software rather than the school districts’ own systems, so each district’s employee data was exposed by a vendor it did not directly control. Frontline did not name the product, which limits other customers of the same software from judging their exposure. The notification came about seven weeks after discovery, and districts must decide by 16 October whether to accept the vendor’s notices.

SOURCE: BleepingComputer — Frontline Education breach exposes school district employee data

Technical Scope

Bitget said that 387.5 million dollars was stolen from hot and warm wallets, with the main theft on 25 September and the earliest malicious activity traced to 31 August; the exchange disclosed the theft on 24 September. SlowMist’s investigation found activity involving two unnamed third-party security products with zero-day flaws, one running a compromised node and one whose management platform was accessed. Mandiant found attackers gained access to security appliances, deployed web shells and moved laterally into the wallet environment, and Elliptic and TRM Labs linked wallet overlaps to North Korean actors.

Forensics / Compliance Impact

This revises the roughly 351 million dollar figure reported last week and ties the loss to security products themselves being the entry point. About three and a half weeks passed between the first malicious activity and the theft, a dwell period in which monitoring of the appliances could have shown the web shells. Lateral movement from security tooling into a high-value environment shows why management platforms warrant the same protection as the assets they guard.

SOURCE: The Hacker News — Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft

Cisco SD-WAN manager bypassed and exploited  [CRITICAL 1]

SD-WAN controllers connect plants, branch shops and contractor sites, and administrator access to one reaches every connection it manages; CISA applied a three-day federal deadline.

Source: The Hacker News — CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV

FortiMail zero-day exploited with fixes still pending  [CRITICAL 2]

Mail gateways hold the email through which drawings, quotes and contract data move between primes and suppliers, and attackers here were seen setting up data-exfiltration accounts.

Source: BleepingComputer — Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

Third NetScaler flaw exploited in about a week  [CRITICAL 3]

NetScaler fronts remote access for many contractors; exploitation of appliances patched days earlier means a current build number does not show a gateway is clean.

Source: BleepingComputer — Citrix patches NetScaler SAML zero-day exploited in attacks

Ransomware group uses year-old SharePoint flaws against water and telecom operators  [THREAT 1]

SharePoint commonly stores shared project and contract documents at suppliers, and the same intrusion pattern, with security tools disabled before encryption, applies to any unpatched on-premises server.

Source: BleepingComputer — Warlock ransomware breach SharePoint in water, telecom operator attacks

Artifact repository compromised, builds since 28 August suspect  [PLATFORM 6]

Software developers that pull from shared artifact repositories depend on their integrity; a repository administrator compromise can alter packages that flow into delivered code.

Source: Help Net Security — OpenInfra JFrog Artifactory instance compromised

Pentagon personnel breach now put above three million people  [BREACH 1]

Social Security numbers paired with personnel details support targeted impersonation of veterans and service members now working at machine shops and defense software firms.

Source: BleepingComputer — Hackers stole Pentagon personnel records of over 3 million people