📰 DAILY THREAT BRIEFING
Thursday, October 1, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of October 1, 2026.

  1. Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
    — Bleeping Computer

    Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-da…
  2. Alleged KillSec Ransomware Mastermind a 16-Year-Old
    — Dark Reading

    Law enforcement from multiple countries collaborated to disrupt a cybercrime operation that has claimed some 500 victims worldwide in the pa…
  3. Autonomous AI agents tried to hack US, Canadian government websites
    — Bleeping Computer

    Autonomous AI agents using aggressive strategies attempted to hack U.S. and Canadian government websites to find school and divorce statisti…
  4. Microsoft says threat actors are ahead in the early AI race
    — Bleeping Computer

    Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed u…
  5. Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers
    — The Hacker News

    Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of steali…
  6. ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories
    — The Hacker News

    This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path whe…
  7. WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
    — The Hacker News

    Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensur…
  8. Warlock Ransomware Hits Large Spanish, Portuguese Orgs
    — Dark Reading

    A year-old Chinese threat actor looks like a cybercrime gang, acts like a state-associated APT, and attacks organizations in unexpected plac…
  9. ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
    — SANS ISC

    Threat Actors do not always use top-notch techniques or very complex malware to perform their attacks. Sometimes, they just abuse of existin…
  10. ISC Stormcast For Thursday, October 1st, 2026 https://isc.sans.edu/podcastdetail/10118, (Thu, Oct 1st)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  11. Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure
    — Dark Reading

    In yet another ClickFix-style campaign, threat actors abuse legitimate domains from OpenAI and Google to fool unsuspecting users.
  12. Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
    — Unit 42

    Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in …

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (14985 in last 30 days).
Critical: 3 · High: 7 · Medium: 4 · Low: 0. View full dashboard →

  1. CVE-2026-103098
    — CVSS 7.5 (HIGH)

    Transmission of a sensitive key in the URL
    over an unencrypted HTTP connection.  The
    request is sent over HTTP rather than HTTPS, meaning the key is transmitted in
    plaintext across the network. An attacker with the abil…
  2. CVE-2026-103097
    — CVSS 7.5 (HIGH)

    An API key is
    hardcoded and retrievable from the application package. Since Android
    applications can be reverse engineered, embedding sensitive API credentials
    directly in the client application may allow unauthorized us…
  3. CVE-2026-103096
    — CVSS 7.5 (HIGH)

    API
    key is hardcoded and retrievable from the application package. Since Android
    applications can be reverse engineered, embedding sensitive API credentials
    directly in the client application may allow unauthorized users…
  4. CVE-2026-86345
    — CVSS 9.0 (CRITICAL)

    A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is proc…
  5. CVE-2026-103766
    — CVSS 7.2 (HIGH)

    ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers c…
  6. CVE-2026-103765
    — CVSS 9.4 (CRITICAL)

    Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata ke…
  7. CVE-2026-103764
    — CVSS 9.8 (CRITICAL)

    Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data po…
  8. CVE-2026-103761
    — CVSS 7.5 (HIGH)

    Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can re…
  9. CVE-2026-103760
    — CVSS 5.9 (MEDIUM)

    Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata …
  10. CVE-2025-71427
    — CVSS 6.8 (MEDIUM)

    Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can…
  11. CVE-2026-86344
    — CVSS 7.5 (HIGH)

    A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that conn…
  12. CVE-2026-104356
    — CVSS 5.9 (MEDIUM)

    PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Att…
  13. CVE-2026-104051
    — CVSS 8.2 (HIGH)

    PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint which returns the c…
  14. CVE-2026-104002
    — CVSS 5.3 (MEDIUM)

    A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field values that the application intended to mask. 

    To remediate this issue…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · October 1, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com