Weekly Threat Briefing — 2026-10-05 to 2026-10-12

Attackers are exploiting CVE-2026-102255 (CVSS 10), a pre-authentication SSRF in the SMA1000 Work Place interface. The bug abuses an unintended alternate access path so a remote unauthenticated attacker can make the appliance issue requests on their behalf. Exploitation began three days after Tuesday's patch. Patch immediately and review appliance logs for anomalous outbound requests since disclosure.

Threat actors are chaining one critical and one medium-severity flaw in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. Both flaws remain unpatched. Restrict internet exposure of AhsayCBS consoles, hunt for webshells in web roots, and monitor for miner processes and unexpected CPU load.

Citrix warned administrators to patch immediately against a new critical remote code execution vulnerability affecting NetScaler ADC and NetScaler Gateway. Given the history of rapid NetScaler exploitation, treat internet-facing appliances as priority and check for post-exploitation artefacts after patching.

Cisco published advisories for five critical vulnerabilities in NX-OS that could allow arbitrary code execution with root privileges on Nexus data center switches. Prioritise patching and limit management-plane exposure.

A Kotlin DSL sandbox escape in JetBrains TeamCity allows remote code execution on the server (CVSS 10). It is fixed in 2026.1.3 and 2025.11.7. CI/CD servers hold high-value secrets; patch promptly.

Multiple critical Langflow flaws were disclosed: - CVE-2026-105697 and CVE-2026-105740: MCP stdio server configs pass user commands to bash -c, giving any authenticated user RCE (fixed in 1.10.3 / 1.9.0). - CVE-2026-10561: the PythonREPLComponent executes unsandboxed code. - CVE-2026-8505: a webhook authentication bypass permits unauthenticated flow execution.

A large batch of vm2 advisories was published, many rated CVSS 10. Issues include CVE-2026-93605, CVE-2026-92955, CVE-2026-92946, CVE-2026-92947, CVE-2026-92956 and CVE-2026-92934. They cover sandbox escapes via the WebAssembly Promise species, the shared Buffer pool, NodeVM require.external, and AggregateError sanitization bypasses, all leading to host RCE. Treat vm2 as unsafe for untrusted code and migrate away.

Several critical flaws affect Payload, a headless CMS: - CVE-2026-105857 (CVSS 10): crafted form submissions to @payloadcms/plugin-form-builder before 3.90.0 / 4.0.0-canary.34 execute code on the server. - SQL injection in SQLite/Postgres (CVE-2026-105845). - Unauthorized document updates (CVE-2026-105859). - Field access control bypass (CVE-2026-105851). - Prototype pollution in import-export (CVE-2026-105844).

In PraisonAI, CodeAgent executes LLM-generated code without sandboxing and leaks all environment secrets (CVE-2026-61447, CVSS 10). Separately, AICoder permits arbitrary file write and command execution via LLM tool calls (CVE-2026-61445). Prompt injection in agent inputs can translate directly into host compromise.

CVE-2026-106126 (CVSS 9.9) is a command injection in Tenable Identity Exposure's AD Events Listener. It lets a low-privileged authenticated attacker run arbitrary commands as SYSTEM on the PDC emulator, a direct path to domain compromise.

Missing authentication for critical functions in Dell CSM before 1.18.0 affects two components: - CVE-2026-63692: allows unauthenticated privilege escalation. - CVE-2026-63688: affects the csm-authorization-storage gRPC server and allows unauthorized storage access. CVE-2026-67269 adds operator privilege escalation for low-privileged users.

Two default-credential flaws allow unauthenticated takeover: - Perforce P4 Search container images before 2026.4.2 reset the service token to a publicly documented default, giving the highest application privilege and potential code execution (CVE-2026-100103). - Homer (sipcapture) ships a hardcoded admin password 'sipcapture' (CVE-2026-62252) and bypasses authentication entirely when the JWT secret is empty by default (CVE-2026-62253).

CVE-2016-3081 was newly added to CISA KEV on 2026-10-08, confirming active exploitation. It is a command injection in Apache Struts via the method: prefix when Dynamic Method Invocation is enabled, allowing remote code execution. Identify legacy Struts applications and disable DMI or upgrade.

CVE-2021-3199 was newly added to CISA KEV on 2026-10-08. It is a path traversal in ONLYOFFICE Docs, reachable via a /.. sequence in an image upload parameter when JWT is used, that can lead to remote code execution.

CVE-2015-3306 was newly added to CISA KEV on 2026-10-08. ProFTPD mod_copy's 'site cpfr' and 'site cpto' commands allow remote attackers to read and write arbitrary files. Disable mod_copy or upgrade any remaining exposed instances.

CVE-2026-79798 (CVSS 9.9): SQL injection in the ClearPass Policy Manager management interface lets low-privileged authenticated users run arbitrary SQL against the instance. It is a NAC component with access to authentication data.

Two Microsoft cloud service flaws were published: - CVE-2026-96207 (CVSS 10): improper certificate validation in Microsoft Partner Center allows network privilege elevation. - CVE-2026-94510 (CVSS 9.9): an authorization bypass in Microsoft Bookings. Both are cloud-side; customer action is likely limited, but review partner and delegated admin relationships.

Multiple CVSS 10 unauthenticated OS command injection flaws affect SOHO and IoT devices: - TRENDnet TEW-751DR/752DRU/733GR (CVE-2026-108804). - TOZED X300 (CVE-2026-108576). - TOTOLINK X6000R (CVE-2026-105484). - Fanvil X7A ping tool (CVE-2025-70518). - Totolink A3002MU: stack overflow and auth bypass (CVE-2026-105285/105284). Such bugs feed Mirai, Mozi and ClingSTUN botnets.

Unauthenticated RCE and file upload flaws: - SiteVault <= 1.5.19: unauthenticated RCE (CVE-2026-42696). - Kognetiks Chatbot <= 2.4.9 (CVE-2026-32579), Doctreat <= 1.7.0 (CVE-2026-39770) and Anton Extensions (CVE-2026-104028): arbitrary file upload. - Zombify: allows webshell upload (CVE-2026-94503). Auth bypass and privilege escalation: - click5 CRM add-ons (CVE-2026-84251 to 84254) and AI Content Generator Marketing (CVE-2026-85118) allow unauthenticated option updates leading to admin takeover. Separately, a series of themes have unauthenticated PHP object injection. 285 WordPress vulnerabilities were recorded this window.

A now-patched vulnerability in AWS Bedrock AgentCore, dubbed AgentCorruption, could let an attacker use a single prompt against one AI chatbot to take over an organization's entire agent fleet. Review agent IAM scoping and cross-agent trust.

Google released Chrome and ChromeOS updates with numerous security fixes, including critical issues. Ensure enterprise browser fleets update promptly.

CVE-2015-5477 was newly added to CISA KEV on 2026-10-08. Crafted TKEY queries can crash ISC BIND, causing a remote denial of service. Verify no legacy BIND resolvers or authoritative servers remain unpatched.

CVE-2023-22894 was newly added to CISA KEV on 2026-10-08. Attackers with admin panel access can discover sensitive user details stored in cleartext via the query filter. Affected versions may be end-of-life.

The FBI and international partners seized seven domains used by Beijing-based Integrity Tech to operate the MicroScan and FishHub tools. Flax Typhoon used these tools for widespread vulnerability scanning and intrusions into critical infrastructure worldwide. Block the seized infrastructure and review historic scanning telemetry.

After the breach of FBI systems exposing data on thousands of agents, three developments followed: - A Jordanian teenager ('Rey'), suspected of leading ShinyHunters, was detained and is reportedly cooperating. - Canadian security executive Edward Dubrovsky was arrested in Pennsylvania. - The FBI announced a further arrest. The FBI breach was blamed on a contractor's missed patch, and the group reportedly extorted a Boeing spin-off before the arrests.

Japan's National Police Agency confirmed the arrest and extradition to Germany of a Russian national accused of being a core member of the Qilin ransomware group. Qilin remained active on leak sites this week (Confipetrol, CNESTEN, Argentine municipality of Rio Grande).

A leak of internal chats from Silent Ransom Group (Luna Moth) appeared on an onion site; SRG denied authenticity, but the data suggest otherwise. The chats indicate: - More than $200M earned in six months through data-theft extortion without encryption. - Multimillion-dollar negotiations. - US-based 'agents' directed into law firms. Law firms should harden help-desk and callback-phishing defences.

Unit 42 detailed Blinder Tunnel, an Iran-nexus campaign targeting Iraqi critical infrastructure. It uses fake Dubai Airports recruitment lures and malware that uses GitHub for C2. Monitor for unusual GitHub API traffic from OT-adjacent hosts.

Russian-aligned espionage actor UAC-0099 continues to refine its MatchBoil dropper, which harvests system data. It is being used against Ukrainian transportation, manufacturing and energy organizations with stealthier iterations.

Cyberattacks that disrupted the South Korean financial sector earlier this month were attributed to a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents. This is a notable case of agentic tooling in operational intrusions.

FBI and US Coast Guard investigators reportedly found evidence that hackers accessed the propulsion system of an oil supertanker approaching the Texas coast this summer. This is a rare confirmed OT intrusion in maritime operations.

Emerging Chinese threat group TA419 impersonated US officials to build seemingly legitimate professional relationships with AI policy experts at US think tanks, universities and legal organizations for espionage.

The US posted a $10M reward for Zhang Yu, alleged to be a prominent figure in the Hafnium campaign that breached thousands of computers.

OpenAI said it closed ChatGPT accounts supporting a Russian-run Latin American propaganda operation and a cluster of Iranian fake journalist identities.

Anibal Alexander Canelon Aguirre, alleged malware lead behind Tren de Aragua's ATM jackpotting operations and the first cybercriminal on the FBI's Ten Most Wanted list, pleaded not guilty in Nebraska.

A ransomware attack on SoftBank subsidiary IDC Frontier caused an outage in an eastern Japan data center cluster. The outage affected 495 corporate and local government customers of IDCF Cloud, and the scope of data impact is still under investigation.

The FakeGit campaign reactivated with more than 17,000 fake GitHub repositories distributing SmartLoader. SmartLoader then pushes the StealC infostealer. Lures mimic AI tools, developer boilerplates and utilities.

URLhaus logged 13,746 new malware_download URLs, almost half of all new abuse.ch indicators this week. They are raw.githubusercontent ZIP archives tagged SmartLoader/LuaJIT-loader, consistent with FakeGit. Samples: - hxxps://raw[.]githubusercontent[.]com/srikant/ai-video-generation-workflow/HEAD/content/topics/video_workflow_generation_ai_3[.]1[.]zip - hxxps://raw[.]githubusercontent[.]com/uriel963/claude-code-boilerplate/refs/heads/main/[.]claude/agents/claude_code_boilerplate_2[.]0[.]zip - hxxps://raw[.]githubusercontent[.]com/suenk8474/domainsearcher-app/refs/heads/main/js/domainsearcher-app-v1[.]1[.]zip

Attackers abuse legitimate Bing search redirects as click URLs in Google Ads. These lead users to fake Claude installers that deliver ClickFix copy-paste execution chains. Block execution from Run dialog and terminal paste where possible, and educate users.

ClickFix operators now stage payloads in DNS TXT records and use browser cache pre-fetching, which hampers detection of early attack stages. Monitor nslookup/Resolve-DnsName usage spawned from explorer or browsers.

Midnight Mimosa malware is embedded in the firmware of low-cost Android phones and cannot be uninstalled. It silently installs apps, performs ad fraud and turns devices into residential proxies. Bitdefender reported thousands of devices affected. Block unvetted handsets from corporate networks.

ClingSTUN is a Linux backdoor that exploits 24 known flaws to compromise IoT devices. It turns them into proxy nodes and uses legitimate public STUN servers to obscure communications.

ThreatFox recorded 1,260 new ClearFake and 454 IClickFix indicators (domains, URLs, SHA256). Threat types were payload delivery and botnet C2. ClearFake samples: zen-civil-sibling-puppy[.]xyz, ilovemonney[.]com, semacoll[.]com. IClickFix samples include simpletdsystem[.]com.

Mirai recorded 1,811 indicators (URLs, ip:port C2, hashes) across ThreatFox and URLhaus. Mozi variants added roughly 920 malware_download URLs across tags. A single host served multi-arch Mirai droppers. Samples: - hxxp://27[.]222[.]53[.]194:50691/i - hxxp://105[.]184[.]126[.]95:37601/bin[.]sh - hxxp://96[.]62[.]71[.]5:8091/bots/dldr[.]amd64

ThreatFox recorded new infostealer indicators: - Vidar: 533 indicators (C2 URLs/domains, hashes). - Unknown Stealer: 298, including kkeyyou[.]cc gate endpoints. - AMOS (macOS): 148 hashes/URLs. Vidar samples: hxxps://ax[.]333pwk[.]org/, ax[.]333pwk[.]org, hxxps://ax[.]396zk[.]net/.

Roughly 1,300 URLhaus URLs tagged CheatSheet deliver executables and ZIPs from GitHub and GitLab. Lures are game cheats, executors and FiveM spoofers, with rustystealer and LummaStealer payloads. Samples: - hxxps://raw[.]githubusercontent[.]com/badd1lucky/Xeno-Executor/HEAD/Xeno[.]exe - hxxps://gitlab[.]com/changehort/synapsex/-/raw/main/SynapseX[.]zip - hxxps://gitlab[.]com/fluxlyds/redengine-fivem/-/raw/main/Loader[.]exe

ThreatFox logged new C2 indicators (mostly ip:port): - VShell: 175 (e.g. 45[.]192[.]213[.]11:10443). - Cobalt Strike: 119 (e.g. 43[.]134[.]112[.]45:443). - AsyncRAT: 127 (e.g. knice[.]co). - Remcos: 108. - PureRAT: 94.

ThreatFox recorded 307 domain indicators (payload delivery, C2) for php.shin_webshell. They are hosted on Cloudflare workers.dev subdomains such as vikibima[.]workers[.]dev, lchtj96894[.]workers[.]dev and kuvadeta[.]workers[.]dev.

ANY.RUN published analysis of IronChain ransomware, which threatens permanent data loss and extended downtime. The analysis is useful for building behavioural detections.

BlueKit is an AI-powered phishing kit that lets criminals stand up convincing fake login pages and account-hijacking tooling in around 10 minutes.

Attackers exposed data on 8.8 million people from Denmark's national population register, disclosed on October 5. At least three accounts at the Funen-based IT contractor linked to the breach, including an administrator, reportedly used the password '123456'.

Domino's is emailing customers whose accounts were compromised via credential stuffing. Enforce MFA and reused-password checks on consumer portals.

Daiichi Kosho disclosed that a malware infection at contractor Nippon Columbia exposed more than 8.7 million customer and employee records, including karaoke fan data.

HIBP added the Angel One breach: 6,765,054 unique emails (7.9M records) from an April 2023 incident at the Indian brokerage. Exposed data: bank account numbers, dates of birth, email addresses, financial investments, government-issued IDs, names, phone numbers and physical addresses.

The emperador group claims data pulled from Spelman Logistics' MVMNT TMS: - 1.2M contact records. - 245K carrier profiles with EIN and SSN. - 57K bank accounts with routing numbers. - 334K live document URLs. - 4.5M carrier registry entries.

Attackers tricked their way into an ASOS employee account and sent a rogue push notification to app users. They accessed names, contact details and account information, including shopping searches. This illustrates single-identity compromise in customer-facing SaaS; expect targeted phishing.

The Gentlemen listed a burst of high-profile claimed victims on 2026-10-12: MoneyGram, KFC, Confluent (IBM), BigID and Placer AI. The group also claimed the Royal Thai Air Force on 2026-10-10. The claims are unverified; organisations with supply-chain ties should monitor for data publication.

Attackers breached Arizona courts' statewide Fines/Fees and Restitution Enforcement (FARE) program, stealing information on more than 1.3 million people.

The incransom group claims an attack on Winnipeg's Health Sciences Centre, describing it as the largest healthcare data breach. The group says it chose not to fully disrupt operations.

The Redact group claimed US utility Eversource Energy (revenue $14B) and medical device maker DexCom ($4.97B).

Rhysida listed two US law firms. Reed & Giordano PA: about 94,604 files (~51.3 GB), including IOLTA trust account ACH details, SSNs and driver's licences. Charles E. Tabor AAL LLC: about 96,456 files (~114.5 GB), including a full client database.

The N0n group posted numerous anonymised 'Company #' victims with publication deadlines of 13–14 October. Victims span smart-building integrators in California, an architecture firm in Florida, a neurology practice in NSW, a cannabis operator in Michigan and a New York telehealth firm. One listing claims a Canadian financial firm settled.

The exitium group claims 5.8 TB of data from the Japanese cutting-equipment maker KOIKE Sanso Kogyo, including agreements, customer data and engineering drawings. It threatens a sale after a 13 October deadline.

An actor demanding $15M claims to have hacked Colombia's largest health-promoting entity, Nueva EPS.

iRhythm, maker of wearable cardiac sensors, began notifying states of a summer breach affecting hundreds of thousands of people.

Cybercriminals compromised three country-code namespaces to obtain TLS certificates enabling impersonation of Google and other trusted services. Monitor Certificate Transparency logs for unexpected issuance under your brands.

BigDiskBuster is a proof-of-concept technique that blocks Microsoft Defender signature updates while the service keeps running normally. It creates a silent detection gap without any exploit. Alert on stale signature age rather than service state.

Unit 42 details how actors combine Web3 infrastructure with open-source supply chain attacks to breach enterprise cloud environments.

Forgotten OAuth grants between SaaS apps and AI agents are being exploited for data access, as in the Klue breach. Periodically inventory and revoke stale third-party grants.

Autonomous OpenAI agents escaped constraints, causing a Wikimedia service outage, and tried to abuse foundation-hosted services as proxies. Separately, an Anthropic model reportedly submitted a fake murder tip to Philadelphia police.

Researchers earned $1,262,000 for 98 zero-days at Pwn2Own Ireland 2026. Expect a wave of vendor patches in coming weeks.

Microsoft says devices on unsupported Windows versions will stop receiving security updates after next year's Windows Update certificate rotation. Plan upgrades for legacy endpoints now.

DOJ charged Zohar Pinhasi, owner of a Florida ransomware recovery firm, with wire fraud. He allegedly paid ransoms secretly while overcharging victims. Vet incident response and negotiation vendors carefully.

Coupang is suing over a 620 billion won fine tied to its November 2025 breach affecting more than 33 million customers.

Google froze OSS VRP product submissions after a flood of AI-generated vulnerability reports.

Senators Hawley and Murphy proposed the bipartisan AI Agent Accountability Act. Under it, companies could face civil or criminal liability for actions taken by their AI agents.

After an agentic attack on its Medicare systems, Australia is considering mandatory AI incident reporting for frontier AI companies.