Stay updated with the latest cybersecurity news. This roundup covers critical vulnerabilities under active exploitation, a ransomware takedown, a large government breach, and AI-themed social engineering from the last 48 hours.
1. Police Dismantle KillSec Ransomware; 16-Year-Old Named as Suspected Leader
Published: 2026-10-01
An international operation dubbed Operation KillSwitch seized KillSec’s leak site and servers, provisionally arrested three suspects, and identified a 16-year-old as the group’s alleged main operator. Europol says the investigation covered about 1,000 suspected attacks worldwide. Authorities from Belgium, the United States, Finland, Germany, Greece, the Netherlands, Romania, Spain, Switzerland, and the United Kingdom took part, along with Europol, Eurojust, Bitdefender, and Group-IB. Law enforcement also secured at least 110 terabytes of stolen victim data.
2. Fortinet Warns of Critical FortiMail Zero-Day Under Active Exploitation
Published: 2026-10-01
Fortinet disclosed CVE-2026-104286, a critical path-traversal flaw (CVSS 9.8) in FortiMail that lets an unauthenticated attacker write arbitrary files via crafted HTTP or HTTPS requests. The bug is being exploited in zero-day attacks. Affected branches include FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9. Fixed builds are not yet available for every branch. Until patches land, Fortinet advises disabling IBE support or blocking management-interface access from the internet.
3. CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
Published: 2026-10-01
CISA added CVE-2026-76504 (CVSS 9.8) to the Known Exploited Vulnerabilities catalog after Cisco confirmed in-the-wild exploitation. A hex-encoding bug in URI handling lets an unauthenticated remote attacker reach the Catalyst SD-WAN Manager API as the admin user with a crafted HTTP request. U.S. federal civilian agencies have until October 3, 2026 to patch. This is the latest in a run of 2026 Cisco SD-WAN flaws landing on the KEV list.
4. Pentagon Personnel Breach Exposes Data on More Than 3 Million People
Published: 2026-10-01
The Defense Manpower Data Center is notifying people that unauthorized users accessed unencrypted personally identifiable information on a file-sharing system between October 2025 and July 2026. The Defense Department says the incident affects about 2.76 million living people and 294,000 deceased individuals. Exposed data includes Social Security numbers and job information for military and civilian personnel. The vulnerability was patched after discovery on July 16, 2026. The affected product has not been named.
5. Attackers Drop Web Shells on Citrix NetScaler After Pre-Auth Command Injection
Published: 2026-10-01
Threat hunters are seeing post-exploitation on Citrix NetScaler ADC and Gateway after abuse of CVE-2026-88771 (CVSS 9.5), a pre-authentication command injection bug. LevelBlue reported malicious authentication events with attacker-controlled usernames, followed by web shells mapped to CSS-like URLs and attempts to steal configuration data. A related memory-safety flaw, CVE-2026-88772, was also exploited before public disclosure. Dutch authorities previously urged some organizations to take appliances offline. Patches are in NetScaler ADC and Gateway 14.1-73.37 and later, and 13.1-64.23 and later.
6. CISA Urges Immediate MikroTik RouterOS Updates for Pre-Auth Root Bug
Published: 2026-10-01
CISA warned of CVE-2026-84411, a near-maximum severity integer underflow in RouterOS web management that is reachable before authentication. A single crafted HTTP request can execute code as root or crash the device. Versions earlier than 7.24 are affected; MikroTik shipped fixes in stable 7.24.4 and long-term 7.23.7 in mid-September. Researchers note more than 367,000 hosts expose the RouterOS web interface to the internet. No public exploitation has been confirmed, but botnet operators routinely scan MikroTik devices. Isolate the management interface and update to 7.24.5 or the latest available build.
7. More Than 850 Fake ChatGPT Ads Push ClickFix Malware to Windows Users
Published: 2026-10-01
Researchers tied a malvertising campaign to about 850 paid Google ad landings, 26 lookalike ChatGPT destinations, and 71 Google Ads campaign IDs. Sponsored results and attacker-made Custom GPTs send users to fake Cloudflare or ChatGPT verification pages that instruct them to press Win+R and paste a command. That ClickFix lure installs malware, in some cases via PowerShell and DLL sideloading. No real CAPTCHA asks a user to run PowerShell.
8. TeamViewer Urges Immediate Update to 15.82 After Five High-Severity Flaws
Published: 2026-10-01
TeamViewer patched five vulnerabilities in Full Client and Host on Windows, Linux, and macOS, fixed in version 15.82 and supported maintenance branches. The lead issue, CVE-2026-92370, is a remote-session access-control bypass that can lead to unauthorized remote code execution. The other four (path traversal, heap overflow, a TOCTOU race, and improper path validation) can enable local code execution or escalation to SYSTEM or root. TeamViewer says it has not seen public exploit code or active exploitation.
Also on the wire
- Apple CoreGraphics zero-day (CVE-2026-86950). Apple patched an out-of-bounds write exploited in an “extremely sophisticated” targeted attack against specific iOS users. Fixed in iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. CISA’s KEV due date was October 2, 2026.
- Zimbra flaw exploited before disclosure. Microsoft reported attackers using CVE-2026-73570 in Zimbra Collaboration Suite to deploy JSP web shells and harvest mailbox secrets from crafted emails, with no user click required under some conditions.
- AI agent chained Zammad zero-days. An agentic attack against the Dutch Institute for Vulnerability Disclosure on September 21 used two Zammad zero-days for session hijack, remote code execution, and root.
- GitHub secret exposure. Researchers said roughly 500,000 active credentials remained exposed on GitHub, about 200,000 of them after push protection was enabled by default.
What to do today
- Patch or isolate internet-facing FortiMail, Cisco Catalyst SD-WAN Manager, Citrix NetScaler, and MikroTik web management.
- Confirm Apple devices are on the September 28 security updates, and move TeamViewer clients to 15.82.
- Treat sponsored “ChatGPT” results and any CAPTCHA that asks for Win+R or PowerShell as malware.
- If you hold DoD personnel records or contractor data tied to DMDC, watch for notification letters and prepare identity-monitoring guidance.
Stay Vigilant
Edge appliances and remote-access tools are carrying most of this week’s exploitable risk, while social engineering has moved onto AI brand names. Prioritize anything already on the CISA KEV list before feature work. Stay safe online.