Stay updated with the latest cybersecurity news. This daily roundup covers actively exploited zero-days, major thefts, nation-state tradecraft, and AI-assisted social engineering from the last 24–48 hours — the period ending Wednesday, September 30, 2026.
1. Cisco Warns of Actively Exploited SD-WAN Manager Zero-Day (CVE-2026-76504)
Published: 2026-09-30
Cisco confirmed attackers are exploiting a critical authentication bypass in Catalyst SD-WAN Manager (formerly vManage). CVE-2026-76504 (CVSS 9.8) lets an unauthenticated remote attacker abuse URI encoding in the Manager API and operate as the admin/netadmin user. There is no workaround. Internet-exposed Managers are the highest-risk targets, and this is Cisco’s fifth actively exploited SD-WAN zero-day of 2026. CISA added the flaw to its KEV catalog with a federal deadline of October 3.
2. Citrix NetScaler Zero-Days Used for Root Access; WHIPSHOT and SLAPSHOT Deployed
Published: 2026-09-30
Unknown actors are exploiting two newly patched NetScaler ADC/Gateway flaws — CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5) — against government, finance, technology, education, and professional-services organizations in North America and Europe. Mandiant and Google Threat Intelligence say CVE-2026-88772 can bypass authentication, crash the Packet Processing Engine, and yield root. Post-exploitation has included custom web shells and the WHIPSHOT and SLAPSHOT payloads. CISA already listed both bugs as known exploited and set a September 30 federal patch deadline.
3. Apple Patches CoreGraphics Zero-Day Exploited in Targeted Attacks
Published: 2026-09-29
Apple shipped iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics reported by Meta Product Security. Apple said the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals” on older iOS builds. The company improved bounds checking; anyone on a supported iPhone, iPad, or Mac should update immediately even if the campaign looks targeted rather than mass-scale.
4. Bitget Theft Reaches ~$387.5M After Third-Party Security-Product Zero-Day
Published: 2026-09-30
Interim forensics from SlowMist and Mandiant say the September 24 Bitget hot/warm-wallet drain began weeks earlier. Attackers exploited a zero-day in an unnamed third-party security product as early as August 31, later obtained privileged access to two security appliances, dropped a web shell, moved laterally to a production wallet job server, and used a custom withdrawal tool that forged risk-control parameters so Bitget’s own systems treated the transfers as valid. Private keys and cold wallets were not stolen. Bitget says customer balances are covered by its user-protection fund. North Korea remains a suspected, not confirmed, attribution.
5. ShinyHunters Claims FBI PeopleSoft Breach; Dutch Police Arrest Alleged Leader
Published: 2026-09-30
ShinyHunters claims it used an Oracle PeopleSoft zero-day to hit FBIJobs.gov, move into FBI-managed AWS GovCloud, and steal 2–3 TB of data on current, former, and prospective employees. The FBI confirmed it is investigating unauthorized activity on the jobs site and urged group members to turn themselves in after Dutch police arrested a 24-year-old Amsterdam man in a ShinyHunters investigation. The group publicly insisted operations remain “completely fine.” Treat the volume and contents of the alleged FBI theft as unverified until the Bureau publishes findings.
6. Attackers Exploit Zimbra Flaw to Drop Web Shells and Steal Auth Secrets
Published: 2026-09-30
Microsoft Security Research reports continued weaponization of CVE-2026-73570 (CVSS 8.9), an unauthenticated OS command-injection bug in Zimbra Collaboration Suite when SNMP notifications and the optional zimbra-snmp package are enabled. A crafted SMTP request can yield RCE with no login and no user click. Observed follow-on activity includes JSP web shells, reverse shells, privilege escalation, persistent remote-access tools, and in-memory execution. Zimbra patched the issue in 10.1.20 in July; unpatched internet-facing Zimbra remains a mailbox-harvesting target.
7. Threat Actors Abuse ChatGPT Custom GPTs to Deliver a RAT via ClickFix
Published: 2026-09-30
Huntress observed attackers standing up ChatGPT Custom GPTs that look like legitimate product helpers, then sending victims to sites that use ClickFix lures — fake “fix this error / complete this check” prompts that trick users into pasting and running a command. The chain delivers a remote-access trojan. It is another example of trusted AI features being used as a distribution front rather than as the exploit itself. Treat unexpected Custom GPT “install” or “verification” steps as hostile.
8. Microsoft: Phishing Abuses MSP360 to Install ScreenConnect (Dual-RMM)
Published: 2026-09-30
Microsoft warned of phishing that delivers a real MSP360 (CloudBerry) RMM installer under meeting invites, PDF lures, and fake update prompts. Once the trusted installer runs, operators add a second remote-management channel with ScreenConnect, giving them dual legitimate-looking RMM persistence that many EDR policies fail to treat as malware. The campaign is unattributed. Hunt for unexpected RMM agents, especially MSP360 plus ScreenConnect on the same host, and lock software deployment to approved catalogs.
Also on the radar
- CISA flagged a critical pre-auth RCE/DoS issue in MikroTik RouterOS.
- Russia’s Star Blizzard is using a new RedFlick infection chain to drop its CosmicPulse backdoor.
- Researchers say more than 500,000 valid secrets were still sitting in public GitHub repos, including a weak spot around Gemini API keys.
- France’s tax agency said stolen staff passwords were used to pull tax data on hundreds of thousands of people and businesses over seven weeks.
- A new Spectre-v2 variant, Branch Target Reuse (BTR), leaked a Linux root password hash in minutes in lab conditions; kernel fixes are merging.
Stay Vigilant
Edge appliances (Cisco SD-WAN, Citrix NetScaler, Check Point, MikroTik) and mail platforms (Zimbra) are the week’s hottest internet-facing targets. Patch those first. Treat unexpected RMM installers and “paste this command to continue” prompts as compromise attempts, even when the software or AI wrapper looks legitimate. Subscribe for the next daily drop, and keep an eye on CISA’s KEV list before the next federal deadline hits. Stay safe online