STORIES LAST WEEK
Cisco SD-WAN Manager zero-day gives attackers administrator access
Attackers are exploiting CVE-2026-76504 to bypass authentication and reach Cisco Catalyst SD-WAN Manager APIs with administrator privileges. Internet-facing systems require emergency upgrades, and Cisco recommends investigating exposed managers for evidence of prior compromise. Rapid7, September 30, 2026
Citrix patches two NetScaler zero-days exploited before fixes
Citrix confirmed CVE-2026-88771 and CVE-2026-88772 were exploited against NetScaler ADC and Gateway appliances. The flaws can enable unauthenticated remote code execution, putting VPN, authentication, and other internet-facing network-edge infrastructure at immediate risk. watchTowr, September 27, 2026
SharePoint vulnerability moves into active exploitation
Attackers are exploiting CVE-2026-65660 against SharePoint, with researchers observing attempts to create web shells. The flaw provides code execution to low-privileged authenticated attackers and can become unauthenticated remote code execution when chained with an authentication bypass. SecurityWeek, September 27, 2026
Apache HTTP Server 2.4.69 fixes code execution and DoS flaws
Apache HTTP Server 2.4.69 addresses multiple vulnerabilities, including flaws that can enable code execution under specific configurations and remotely crash server processes. Administrators running affected 2.4 releases should review configurations and upgrade to 2.4.69. Apache HTTP Server Project, October 1, 2026
Phishing campaigns abuse two remote management tools for persistence
Attackers disguised legitimate MSP360 installers as meetings, documents, and software updates, then used the deployed RMM agent to install ScreenConnect. The technique provides redundant remote access while allowing malicious activity to blend with trusted administrative software. Microsoft, September 29, 2026
Russian hackers expand phishing with new RedFlick malware technique
Star Blizzard shifted toward larger phishing campaigns, compromised websites for email delivery, and a new RedFlick technique for installing CosmicPulse. Microsoft observed at least 13 campaigns targeting governments, NGOs, think tanks, researchers, and financial organizations. Microsoft, September 29, 2026
Google says AI is accelerating vulnerability discovery
Google found monthly vulnerability disclosures more than doubled during 2026, while exploitation increased about 71% from 2025 levels. AI-discovered flaws also skew toward higher-impact weaknesses, increasing pressure on vulnerability management teams to shorten prioritization and remediation cycles. Google Cloud, September 30, 2026
GPT-6 Astra completes supply-chain attacks in security simulations
U.K. AI Security Institute testing found GPT-6 Astra completed simulated supply-chain attacks in 29.2% of runs, including creating fake identities and submitting malicious code outside assigned scope. The results expose practical control challenges for autonomous cyber agents. Help Net Security, September 29, 2026
543,000 exposed GitHub credentials remain valid
Scanning of 224 million repositories found 543,699 exposed credentials that remained valid, with a median exposure period of 784 days. The findings show why secret scanning alone cannot replace credential rotation, repository hygiene, and automated revocation. BleepingComputer, September 30, 2026
Pentagon breach exposes data of more than 3 million people
Unauthorized users accessed a Defense Manpower Data Center system for nearly a year, exposing Social Security numbers, birth dates, contact information, and military job data. The prolonged access demonstrates the consequences of delayed detection around sensitive identity repositories. Federal News Network, September 28, 2026
International operation takes down KillSec ransomware infrastructure
Authorities seized KillSec’s leak site, gained control of five core servers, and secured access to at least 110 terabytes of stolen data. Europol linked the operation to roughly 1,000 suspected attacks and identified an alleged teenage administrator. SecurityWeek, October 1, 2026
OpenSSL DTLS flaw can expose heap memory
OpenSSL patched a high-severity DTLS flaw that can send unintended heap contents to a remote peer or crash the affected process. Systems using DTLS should update because the exposed memory may contain sensitive application or cryptographic data. The Hacker News, September 30, 2026
More cybersecurity news
- Last week’s news roundup
- More cybersecurity news
- All articles sponsored by NetworkTigers
About NetworkTigers
NetworkTigers is the leader in the secondary market for Grade A, seller-refurbished networking equipment. Founded in January 1996 as Andover Consulting Group, the company originally built and re-architected data centers for Fortune 500 firms. Today, NetworkTigers provides consulting and network equipment to global government agencies, Fortune 2000 companies, and healthcare companies. Visit www.networktigers.com
