CRITICAL
CISA KEV
CVE-2026-88779 · Citrix NetScaler
Citrix NetScaler contains a buffer overflow vulnerability (CVE-2026-88779) that allows remote code execution. This is actively exploited and requires immediate patching of all NetScaler instances.
▸ countermeasure Immediately inventory all Citrix NetScaler appliances in your environment
ArrayArrayArray
Open source advisory →
CRITICAL
BleepingComputer
Citrix patches NetScaler SAML zero-day exploited in attacks
Citrix NetScaler SAML zero-day (CVE-2026-88779) is actively exploited in the wild for denial-of-service attacks with potential RCE risk. Immediate patching of all NetScaler instances is required to prevent service disruption and potential compromise.
▸ countermeasure Immediately apply Citrix emergency patches to all NetScaler appliances
ArrayArrayArray
Open source advisory →
CRITICAL
The Hacker News
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
Warlock threat actor exploits SharePoint vulnerabilities to disable security tools and deploy ransomware against critical infrastructure, government, and education sectors in Portuguese and Spanish-speaking regions. Immediate patching and security tool hardening required.
▸ countermeasure Immediately patch all SharePoint instances to latest security updates
ArrayArrayArrayArray
Open source advisory →
CRITICAL
The Hacker News
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
China-nexus threat actor deploying Antino backdoor targeting Asian government entities, leveraging Outlook and OneDrive for command-and-control communications. Affects Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, and Myanmar government and policy organizations.
▸ countermeasure Audit and monitor all Outlook and OneDrive account activities for suspicious command-and-control patterns, particularly for government and policy organization accounts
ArrayArrayArrayArray
Open source advisory →
CRITICAL
BleepingComputer
Warlock ransomware breach SharePoint in water, telecom operator attacks
Warlock ransomware exploits SharePoint vulnerabilities to breach critical infrastructure (water, telecom) and government entities. Immediate patching and access control hardening required for SharePoint deployments.
▸ countermeasure Audit all SharePoint instances for CVE patches and apply immediately
ArrayArrayArrayArray
Open source advisory →
CRITICAL
CISA News
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directi
▸ countermeasure Confirm exposure, apply vendor patches, add temporary WAF/IPS rules, and run post-patch vulnerability validation.
Open source advisory →
CRITICAL
CISA News
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability CVE-2026-102490 Zammad GmbH Zammad Improper Privilege Management Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.&
▸ countermeasure Confirm exposure, apply vendor patches, add temporary WAF/IPS rules, and run post-patch vulnerability validation.
Open source advisory →
HIGH
The Hacker News
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
China-aligned TA419 group conducting credential phishing campaigns against U.S. AI policy experts using impersonation of prominent figures. Targets include think tanks, universities, legal organizations, and AI companies like Anthropic.
▸ countermeasure Implement advanced email authentication (SPF, DKIM, DMARC) to detect spoofed sender addresses
ArrayArrayArrayArray
Open source advisory →
HIGH
The Hacker News
MI5 Says China’s MSS Funded Research Involving 100+ U.K.-Linked Academics
Chinese MSS-linked entity (CGTRI) has funded research involving 100+ UK academics for intelligence gathering purposes. Organizations should implement enhanced vetting of international research partnerships and monitor for unauthorized technology transfer.
▸ countermeasure Audit all active research collaborations with Chinese institutions and researchers for potential dual-use technology exposure
ArrayArrayArray
Open source advisory →
HIGH
BleepingComputer
Google Gemini could soon get full access to your Mac’s files, apps and the web
Google Gemini may gain unrestricted file system access and application control on macOS without repeated user consent, creating significant data exposure and unauthorized action risks. Organizations must evaluate Gemini deployment policies and implement access controls before this capability rolls out.
▸ countermeasure Audit current Gemini deployments across macOS endpoints
ArrayArrayArrayArray
Open source advisory →
HIGH
BleepingComputer
Danish university DTU breach exposes data of up to 200,000 people
DTU's identity and access management system was compromised, exposing data of up to 200,000 users. Attackers gained unauthorized access and exfiltrated sensitive information from authentication infrastructure.
▸ countermeasure Audit your organization's IAM system logs for unauthorized access attempts and anomalous authentication patterns
ArrayArrayArray
Open source advisory →
HIGH
The Hacker News
OpenAI Parts Ways With Three Safety Researchers Over Sensitive Information Mishandling
OpenAI has parted ways with three members of its safety team after they leaked private information in violation of company policies, The Wall Street Journal reported. "We have parted ways with three individuals for violating our policies on accessing and handling sensitive company information," a spokesperson for the company was quoted as saying. "Our investigation confirmed that these
▸ countermeasure Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.
Open source advisory →
HIGH
BleepingComputer
GitLab warns of critical RCE vulnerability in AI Gateway service
GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. [...]
▸ countermeasure Confirm exposure, apply vendor patches, add temporary WAF/IPS rules, and run post-patch vulnerability validation.
Open source advisory →
HIGH
The Hacker News
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploited by bad actors to take over susceptible systems. The vulnerabilities are listed below - CVE-2026-63688 (CVSS score: 10.0) - A missing authentication for critical function vulnerability in the csm-authorization-storage gRPC server that an
▸ countermeasure Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.
Open source advisory →
HIGH
BleepingComputer
Frontline Education breach exposes school district employee data
Frontline Education suffered a breach exposing school district employee data including SSNs via third-party software vulnerability. Affected organizations should assume employee PII compromise and implement identity protection measures.
▸ countermeasure Notify affected employees and offer credit monitoring/identity theft protection services
ArrayArrayArray
Open source advisory →
HIGH
CISA KEV
CVE-2026-102489 · Zammad GmbH Zammad
Zammad contains a session fixation vulnerability allowing attackers to hijack user sessions and gain unauthorized access to ticketing system data and functionality. Immediate patching and session management review are critical for organizations using Zammad.
▸ countermeasure Update Zammad to the latest patched version immediately
ArrayArray
Open source advisory →
HIGH
CISA KEV
CVE-2026-102490 · Zammad GmbH Zammad
Zammad contains an improper privilege management vulnerability allowing unauthorized privilege escalation. Immediate patching and access control review required for all Zammad deployments.
▸ countermeasure Identify all Zammad instances in your environment and document versions
ArrayArray
Open source advisory →
HIGH
SANS ISC
TTY Logs and the Data it Captures, (Sun, Oct 4th)
For an experiment, I created a script [1] that parses and send the TTY logs collected from actors or bots activity that run various commands after they successfully login the DShield sensor. Those TTY logs are sent daily at the end of each day to the DShield SIEM [2] to be correlated with all the data. 
▸ countermeasure Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.
Open source advisory →
MEDIUM
The Hacker News
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members
ShinyHunters member 'Rey' detained in Jordan and cooperating with FBI, potentially enabling identification and disruption of the extortion group's operations. Organizations previously targeted by ShinyHunters should assume operational security compromises and prepare for potential data exposure.
▸ countermeasure Review ShinyHunters incident response logs and identify all data exfiltration incidents involving your organization
ArrayArrayArray
Open source advisory →
MEDIUM
BleepingComputer
ShinyHunters hacker reportedly detained in Jordan, aiding FBI
ShinyHunters member detained in Jordan cooperating with FBI; organization may face disruption but remaining members could accelerate attacks or rebrand. Monitor for increased extortion activity, credential dumps, or group restructuring.
▸ countermeasure Review ShinyHunters IOCs and known victim lists for organizational exposure
ArrayArrayArray
Open source advisory →
MEDIUM
The Hacker News
Why CISOs Struggle to Answer the Board's Three Hardest Questions, and How to Fix the Report
The quarterly board meeting is two weeks out. The security team is pulling exports from the identity provider, the cloud posture tool, the vulnerability scanner, the SIEM and the EDR console. Someone is building a spreadsheet to reconcile them. Someone else is turning that spreadsheet into slides. Then a board member asks three questions: How secure is the organization, overall? What is
▸ countermeasure Triage affected assets, validate exposure, apply available mitigations, increase logging, and document evidence for incident review.
Open source advisory →
LOW
BleepingComputer
Anthropic asks Claude users to share voice data for AI model training
Anthropic is requesting voluntary voice data sharing from Claude users for model training. Organizations should review data sharing policies and user consent mechanisms to ensure compliance with data protection regulations.
▸ countermeasure Review organizational policies on third-party AI service data sharing
Array
Open source advisory →
LOW
SANS ISC
User Agent Strings Curiosities, (Sun, Oct 4th)
User Agent String anomalies detected in honeypot logs may indicate reconnaissance or evasion attempts. Monitor for unusual or spoofed User Agent patterns that deviate from legitimate client signatures.
▸ countermeasure Implement User Agent string logging and baseline legitimate patterns for your environment
ArrayArray
Open source advisory →
LOW
The Hacker News
The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations
Featuring: Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibility, control, and the ability to respond to risk at scale. This report examines how core areas of
▸ countermeasure Rotate exposed keys, remove unused permissions, enable secret scanning, and review cloud audit logs for abuse.
Open source advisory →
