Stay updated with the latest cybersecurity news. This daily roundup covers critical vulnerabilities, nation-state campaigns, large-scale data exposures, supply-chain abuse, and high-value cybercrime from the last 48 hours. The common thread this week is familiar: unpatched edge devices, weak identity controls, and trusted platforms being turned into delivery channels.
1. Pentagon Personnel Database Breach Hits More Than 3 Million People
Published: 2026-09-29
A vulnerability in a Defense Manpower Data Center file-sharing system left unencrypted personnel files open to unauthorized users from October 2025 until July 16, 2026. Officials say the exposure covers about 2.76 million living people and 294,000 deceased individuals, including Social Security numbers plus names, dates of birth, contact details, and military occupational data. The Pentagon says it has seen no evidence of misuse so far and is offering credit monitoring.
2. Apple Patches CoreGraphics Zero-Day Used in “Extremely Sophisticated” iPhone Attacks
Published: 2026-09-29
Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1 to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics that can lead to arbitrary code execution when a device processes a malicious file. Apple says the flaw, reported by Meta Product Security, may have been exploited against specific individuals on versions of iOS before iOS 27. High-risk users should update immediately.
3. Citrix NetScaler Zero-Days Exploited for Weeks to Plant Web Shells
Published: 2026-09-29
Attackers exploited CVE-2026-88771 and CVE-2026-88772 on Citrix NetScaler ADC and Gateway appliances before public disclosure, with Mandiant tracing CVE-2026-88772 activity back to at least September 3. Both flaws score 9.5 and can yield unauthenticated remote code execution. Post-compromise activity includes custom web shells, tunneling malware, root access, credential theft, and internal pivoting. Tens of thousands of internet-facing appliances were potentially exposed; patching alone does not remove an existing web shell.
4. French Tax Data Theft Went Undetected for Seven Weeks
Published: 2026-09-29
An attacker used stolen staff passwords at France’s tax administration (DGFiP) to access tax data on more than 350,000 individuals and 250,000 businesses in June and July. ANSSI said the intrusion was not sophisticated: weak login protection, poorly segmented networks, and monitoring gaps let the data leave without detection for seven weeks. Taxpayer account passwords were not compromised, but exposed records include tax IDs, contact details, family situation, and reference taxable income.
5. Russia’s Star Blizzard Uses Fake Event Invites to Drop a Windows Backdoor
Published: 2026-09-29
Microsoft reports that FSB-linked Star Blizzard has run at least 13 larger campaigns this year using fake conference and event invitations to deliver a Windows backdoor. Targets are people and organizations tied to Ukraine, with more than 100 organizations affected since January, mostly in the U.S. and U.K. The group still relies on social engineering first, then a malicious link after a period of conversation. At least one infection has been confirmed.
6. Dutch Police Arrest Amsterdam Man in ShinyHunters Investigation
Published: 2026-09-29
Dutch national police confirmed the arrest of a 24-year-old Amsterdam man in a ShinyHunters investigation. The suspect is expected to appear before the Rotterdam District Court. Reporting by Brian Krebs and DataBreaches.net identifies him as Pepijn van der Stap (aka Umbreon), previously linked to data-theft and extortion activity and previously associated with the Dutch vulnerability-disclosure community. The FBI has separately urged other alleged ShinyHunters members to turn themselves in after the arrest.
7. Bitget Says Third-Party Security Flaw Enabled ~$388M Wallet Theft
Published: 2026-09-28
Bitget now says the attacker who drained about $388 million from hot and warm wallets on September 24 exploited a vulnerability in a third-party security product to obtain high-privilege internal credentials, then issued fraudulent withdrawal commands. Cold wallets and customer balances were not hit; Bitget says its protection fund will cover the loss. Bitcoin withdrawals have resumed, with other assets coming back in stages through October 2. The exchange initially attributed the operation to suspected North Korean actors.
8. Malicious ChatGPT Custom GPTs Funnel Users Into ClickFix RAT Attacks
Published: 2026-09-29
Huntress documented attackers creating Custom GPTs on chatgpt.com, including one named “Plus 5.6,” then promoting them via sponsored Google results. The GPTs send users to a Google Sites page posing as a Cloudflare CAPTCHA, which uses ClickFix to make victims paste a PowerShell command. That command starts an eight-stage chain ending in a full-featured RAT, sideloaded through signed Canon and later Stardock binaries. Huntress tied the infrastructure to at least 40 incidents. OpenAI removed the first GPT on September 25; a replacement appeared two days later.
Stay Vigilant
The last two days underline four operational priorities: patch internet-facing appliances immediately and hunt for web shells afterward; treat identity and file-share misconfigurations as breach-class risks; assume AI product surfaces (custom agents, GPTs, MCP servers) will be abused for social engineering; and isolate OT/train-control and other critical networks from business IT. Subscribe for the next daily drop, and keep endpoint controls, MFA, and software updates current. Stay safe online.