Reports indicate that Kiteworks instructed customers to power down its data-protection platform during a nine-hour window amid a zero-day incident, while Citrix released a patch without prior public disclosure of active attacks. Both cases underscore the operational difficulties in coordinating zero-day responses and the impact of communication gaps on customer environments.
GitLab has released patches to address a critical vulnerability in its AI Gateway component, tracked as CVE-2026-44951. The flaw could allow a logged-in user with Duo Agent Platform access to execute arbitrary commands on self-hosted gateway servers under certain conditions. The vulnerability affects GitLab AI Gateway versions prior to 19.2.4, 19.3.2, and 19.4.1. Organizations running self-hosted instances are urged to update immediately.
Cisco Talos has uncovered a new cyberespionage campaign attributed to a China-nexus threat actor. The operation deploys a previously undocumented backdoor codenamed Antino, which specifically targets government and policy organizations across Asia. The backout leverages legitimate Microsoft services, including Outlook and OneDrive, for command and control communication, making detection more difficult. Victims have been identified in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar.
Frontline Education notified affected school districts of a data breach where unauthorized access to employee information, including Social Security numbers, was gained through a vulnerability in third-party software. The incident impacts districts utilizing Frontline's services, with potential risks of identity theft and fraud for affected individuals.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, affecting Fortinet FortiMail, has a CVSS score of 9.8 and allows unauthenticated attackers to write arbitrary files on the underlying system. CISA's action follows reports of active exploitation in the wild prior to the catalog addition.
Dell has released security updates to patch two maximum severity vulnerabilities in the Container Storage Modules (CSM) component. The flaws affect Dell enterprise storage arrays connected to Kubernetes environments and could allow attackers with network access to achieve remote code execution and admin-level privileges. Patches have been released and admins are urged to apply them as soon as possible.
Microsoft has assessed that cyber threat actors are currently benefiting from artificial intelligence faster than defenders, enabling accelerated vulnerability discovery, malware development, and post-compromise activity. Security teams globally are struggling to maintain pace with the speed of AI-enhanced threat operations.
Security researchers have reported that threat actors are actively exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances. The exploitation activity, identified across multiple customer environments, involves deploying web shells, creating a superuser account, and mapping web shells to CSS-like URLs to conceal malicious files. Additionally, actors are attempting to exfiltrate configuration data from compromised systems. The findings were analyzed by LevelBlue's Threat Hunt Operations & Research (THOR) team.
Bitget has confirmed that a $387.5 million cryptocurrency theft last week resulted from exploitation of a zero-day vulnerability in third-party security products. Investigation findings cited from SlowMist indicate malicious activity involving compromised security tools, and a customized tool used by the attacker was recovered. Specific technical details, the identity of the threat actor, and the full scope of the compromise remain under investigation.
Kiteworks has released security updates to address 126 vulnerabilities, including a maximum severity code injection flaw affecting the Email Protection Gateway (EPG) security solution. The vulnerability could allow remote code execution on affected systems. Users are advised to apply the latest updates immediately.
An international law enforcement operation, dubbed Operation KillSwitch, successfully disrupted the KillSec ransomware gang. The operation resulted in the seizure of the group's data leak site and servers, and led to three arrests. Authorities identified a 16-year-old as the alleged administrator of the group. The disruption prevents KillSec from executing future ransomware attacks and publishing stolen victim data.
Sucuri researchers have detailed a WordPress backdoor codenamed SC that employs multiple persistence mechanisms—including injected files, database entries, and shared memory segments—to ensure the malware self-replicates after apparent remediation. The threat actors embedded "SC_" markers in injected content to facilitate reconstruction of the malicious payload.
Spanish National Police, operating through the Ciberpolice Unit, arrested a 16-year-old suspected of administering the KillSec ransomware group. The operation, conducted on September 30, 2026, also resulted in the seizure of KillSec's data leak site and servers. Three individuals were detained in total. KillSec was accused of exfiltrating data from organizations and threatening to publish it unless ransom payments were made.
Law enforcement agencies from multiple countries have collaborated to disrupt the KillSec ransomware operation. According to reports, the alleged mastermind is a 16-year-old individual. The operation is accused of targeting roughly 500 victims worldwide over the past two years. The disruption marks a significant action against a ransomware group that has been active in extorting organizations globally.
The U.S. Department of Defense notified current and former military service members that their personal and personnel data was compromised in a breach of the Pentagon's Defense Manpower Data Center (DMDC) human resources management system. The breach, which occurred in October 2025, affected over 3 million individuals. Notifications to affected parties began around October 1, 2026. The specific threat actor, vulnerability exploited, and full extent of data stolen remain under investigation.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an Industrial Control Systems advisory regarding CVE-2026-64892, a vulnerability in Johnson Controls EasyIO Neo Series EC and CW Controllers that could allow an attacker to gain access to sensitive information. The flaw stems from improper access controls in building automation controllers and impacts four specific firmware versions. Johnson Controls has released fixed firmware versions V3.3b64 (EC) and V3.3b26 (CW) to address the issue.
Armatura LLC's Armatura One and Armatura One (USA) platforms are affected by five vulnerabilities spanning critical and high severity. The most severe, CVE-2023-46604, is a deserialization flaw in embedded Apache ActiveMQ that allows unauthenticated remote code execution with highest privilege. Additional issues involve hard-coded cryptographic keys, fixed database passwords, and sensitive data leakage into logs. Versions prior to 4.7.2 (global) and 4.6.1_USA are affected. Patches have been released.
CISA has issued an industrial control systems advisory warning of two authorization vulnerabilities affecting the Meari IoT Cloud Platform OpenAPI Service. The flaws, tracked as CVE-2026-101104 and CVE-2026-96613, stem from missing authorization checks. CVE-2026-101104 allows authenticated users to manipulate configurations of devices they do not own, while CVE-2026-96613 allows access to the complete device shadow of any device by specifying its ID. Both vulnerabilities affect all product versions (vers:all/*). Notably, Meari has not planned a fix and did not respond to CISA's coordination attempts, leaving users without official remediation.
CISA has published advisory ICSA-26-274-03 detailing two vulnerabilities in ABB Protection and Control IED Manager PCM600. CVE-2026-15952 is a privilege escalation flaw in the Scheduler Service, and CVE-2026-15953 is a path traversal vulnerability in project archive processing. Both affect versions 2.14 and earlier. Exploitation of CVE-2026-15952 could allow a local attacker with valid credentials to elevate to LocalSystem. CVE-2026-15953 could allow writing files outside the intended extraction directory. ABB has not released a patched version beyond 2.14; mitigations are recommended.
Johnson Controls has identified a vulnerability in EasyIO Neo Series EC and CW Controllers that allows cleartext transmission of sensitive information over the network. Exploitation could enable interception of credentials and session data. Fixed firmware versions are now available.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an industrial control systems advisory detailing six vulnerabilities in the CISA Malcolm platform. The flaws range from cross-site scripting and OS command injection to path traversal and SSRF. All listed vulnerabilities affect CISA Malcolm versions earlier than v26.06.0, with the latest release (September 2026 or later) resolving the issues. Affected installations are urged to update immediately.
South African aviation authorities are responding to a confirmed cyberattack involving ransomware deployed on at least one operational air traffic control network. The incident, reported on September 30, 2026, has prompted the government to seek external cybersecurity expertise to assess and mitigate the disruption to aviation infrastructure.
Unknown threat actors have been observed exploiting a security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to gain root access and deploy WHIPSHOT and SLAPSHOT malware. Activity was observed in September 2026 targeting government, financial services, technology, education, and legal and professional services sectors across North America and Europe. The vulnerability was recently patched, but specific CVE details and exploitation mechanics were not disclosed in the source summary.
OpenSSL has addressed a high-severity vulnerability in its DTLS implementation that could allow heap memory leakage or program crashes during handshake message resend scenarios. The flaw stems from improper timing handling when larger handshake messages are partially outstanding and a resend is triggered.
