STORIES LAST WEEK
Fortinet FortiMail zero-day under active exploitation
Attackers are exploiting CVE-2026-104286, a critical FortiMail path traversal flaw allowing arbitrary file writes and potential code execution. With patches unavailable at disclosure, administrators should disable affected features, restrict management access, and investigate indicators of compromise. SecurityWeek, October 2, 2026
Citrix confirms exploited NetScaler zero-day
CVE-2026-88779 allows attackers to disrupt NetScaler ADC and Gateway appliances configured for SAML authentication. Citrix confirmed targeted denial-of-service attacks and released additional fixes, requiring some administrators to upgrade again shortly after addressing earlier exploited vulnerabilities. Citrix, October 3, 2026
Cisco patches five critical NX-OS vulnerabilities
Cisco disclosed five vulnerabilities affecting Nexus 3000 and 9000 switches that could permit root-level code execution or device crashes. Exploitation depends on enabled NX-API, NGOAM, or MPLS OAM features, making configuration reviews and upgrades essential. BleepingComputer, October 8, 2026
Attackers hijack DNS records to obtain HTTPS certificates
Attackers manipulated authoritative DNS records for domains under Ghana, Sierra Leone, and American Samoa’s country-code registries, obtaining unauthorized HTTPS certificates. Google blocked affected certificates in Chrome and recommends certificate transparency monitoring for domain owners. Google Security Blog, October 6, 2026
Attackers exploit Atlassian flaw within hours
Attackers began targeting CVE-2026-21589 shortly after researchers published exploit details. The unauthenticated file-access vulnerability affects eight Atlassian products, including Jira, Confluence, and Bitbucket, and can expose credentials enabling administrative access in certain configurations. BleepingComputer, October 7, 2026
Microsoft Exchange flaw exposes internal mailboxes
CVE-2026-96940 allows authenticated attackers to escalate privileges within Exchange and access other employees’ mailboxes. Microsoft issued an unscheduled security update for affected on-premises servers, while Exchange Online received a server-side fix. TechRadar, October 6, 2026
Critical LMCache flaw allows remote code execution
JFrog identified CVE-2026-105192, an unauthenticated code execution flaw in LMCache’s multiprocess ZeroMQ transport. Exposed distributed deployments can execute attacker-controlled commands, potentially with root privileges. No fixed release was available at disclosure, making network isolation essential. JFrog Security Research, October 7, 2026
Anthropic expands AI access for cybersecurity professionals
Anthropic introduced three access tiers for its Cyber Verification Program, giving qualified security teams expanded access to advanced AI capabilities. The program supports defensive analysis, authorized penetration testing, and specialized security research while maintaining eligibility and verification requirements. Anthropic, October 6, 2026
AI coding assistants expose thousands of internal screenshots
Security researchers reported that AI coding assistants published more than 13,000 internal screenshots to public GitHub repositories across over 300 organizations. The exposure highlights the need to restrict autonomous agents’ publishing permissions and monitor sensitive development artifacts. AI Risk Today, October 5, 2026
PoeLLM malware compromises more than 3,400 servers
Researchers identified PoeLLM malware targeting exposed AI infrastructure to deploy cryptocurrency miners and expand its botnet. The malware conceals command-and-control addresses within a GitHub-hosted poem and repurposes compromised servers for additional vulnerability scanning and exploitation. Lumen Black Lotus Labs, October 7, 2026
Malicious npm packages impersonate AI development tools
CloudSEK identified seven malicious npm packages masquerading as NebulaAI development tools. Installation scripts deploy a modified KNTRAT remote-access trojan capable of persistence, hidden desktop control, and microphone surveillance, threatening developer workstations and software supply chains. CloudSEK, October 8, 2026
FBI seizes Chinese state-linked hacking infrastructure
The Justice Department and FBI seized seven domains supporting MicroScan and FishHub, tools allegedly operated by China-based Integrity Technology Group. Authorities linked the infrastructure to vulnerability scanning, phishing, and intrusions targeting critical infrastructure and other organizations. U.S. Department of Justice, October 8, 2026
Ransomware disrupts Japanese cloud provider serving 495 organizations
IDC Frontier confirmed ransomware disrupted IDCF Cloud’s East Japan Region 1, affecting 495 businesses and local governments. The provider isolated affected infrastructure and warned that data in four zones might be unrecoverable without customer-held backups. Japan Cyber Watch, October 7, 2026
Google patches 247 Chrome vulnerabilities
Google released Chrome 155 with fixes for 247 security vulnerabilities, including four critical use-after-free flaws. The update affects Windows, macOS, and Linux, requiring administrators to verify deployment across managed endpoints as the rollout progresses. SecurityWeek, October 7, 2026
More cybersecurity news
- Last week’s news roundup
- More cybersecurity news
- All articles sponsored by NetworkTigers
About NetworkTigers
NetworkTigers is the leader in the secondary market for Grade A, seller-refurbished networking equipment. Founded in January 1996 as Andover Consulting Group, the company originally built and re-architected data centers for Fortune 500 firms. Today, NetworkTigers provides consulting and network equipment to global government agencies, Fortune 2000 companies, and healthcare companies. Visit www.networktigers.com
