📰 DAILY THREAT BRIEFING
Wednesday, September 30, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of September 30, 2026.

  1. Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure
    — Dark Reading

    In yet another ClickFix-style campaign, threat actors abuse legitimate domains from OpenAI and Google to fool unsuspecting users.
  2. Trump, Tech Giants Strike Voluntary AI Safety Accord
    — Dark Reading

    The new White House Accord on so-called "Super Intelligence" calls on companies to implement greater controls and oversight over AI safety.
  3. Russian state hackers use new RedFlick technique to push malware
    — Bleeping Computer

    The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed "RedFlick" to deploy its signature CosmicPulse…
  4. Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
    — Unit 42

    Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in …
  5. DIVD says Zammad zero-days enabled AI-driven network breach
    — Bleeping Computer

    The Dutch Institute for Vulnerability Disclosure (DIVD) says that the breach of its network was possible by exploiting a chain of two zero-d…
  6. As AI Reshapes the SOC Career Ladder, Satisfaction Rises for 91%, but Entry Gets Harder for Nearly Half
    — Dark Reading

    New Swimlane research underscores a paradox: While AI detection and response is essential to giving defenders an edge, one in four security …
  7. Over 543,000 valid credentials exposed in public GitHub repositories
    — Bleeping Computer

    More than 543,000 credentials exposed in public GitHub repositories were still valid in July despite the platform's security measures to pre…
  8. Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
    — The Hacker News

    Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, …
  9. Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
    — The Hacker News

    Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under th…
  10. Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
    — The Hacker News

    Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WA…
  11. ISC Stormcast For Wednesday, September 30th, 2026 https://isc.sans.edu/podcastdetail/10116, (Wed, Sep 30th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  12. Scans for Wordfence Protected Websites, (Tue, Sep 29th)
    — SANS ISC

    Starting yesterday, our sensors picked up a small number of scans for "wordfence-waf.php". This particular script is used by Wordfence, a so…

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (15075 in last 30 days).
Critical: 2 · High: 7 · Medium: 11 · Low: 0. View full dashboard →

  1. CVE-2026-103530
    — CVSS 7.3 (HIGH)

    A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argume…
  2. CVE-2026-103592
    — CVSS 6.5 (MEDIUM)

    simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attacker…
  3. CVE-2026-103591
    — CVSS 7.5 (HIGH)

    DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers can supply a non-URL repo_url value to bypass pat…
  4. CVE-2026-103590
    — CVSS 5.4 (MEDIUM)

    QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests…
  5. CVE-2026-103589
    — CVSS 5.4 (MEDIUM)

    QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and comment field values in input attributes. Attackers can induce a…
  6. CVE-2026-103588
    — CVSS 5.4 (MEDIUM)

    QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the…
  7. CVE-2026-103587
    — CVSS 5.4 (MEDIUM)

    QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where date_to and id_room_type parameters are copied into template variables with…
  8. CVE-2026-47096
    — CVSS 6.1 (MEDIUM)

    AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamID_SystemN…
  9. CVE-2026-103001
    — CVSS 6.5 (MEDIUM)

    PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an a…
  10. CVE-2026-51570
    — CVSS 8.1 (HIGH)

    modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.
  11. CVE-2026-51568
    — CVSS 8.1 (HIGH)

    modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.
  12. CVE-2026-102150
    — CVSS 7.2 (HIGH)

    A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks p…
  13. CVE-2026-102149
    — CVSS 9.4 (CRITICAL)

    Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confid…
  14. CVE-2026-102147
    — CVSS 9.3 (CRITICAL)

    A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator wh…
  15. CVE-2026-102146
    — CVSS 6.5 (MEDIUM)

    An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway ser…
  16. CVE-2026-102145
    — CVSS 6.6 (MEDIUM)

    An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code e…
  17. CVE-2026-102144
    — CVSS 5.3 (MEDIUM)

    A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to repeatedly trigger a comparatively expensive server-side operation, causing a partial denial of serv…
  18. CVE-2026-102143
    — CVSS 7.5 (HIGH)

    An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did …
  19. CVE-2026-102142
    — CVSS 7.2 (HIGH)

    A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store …
  20. CVE-2026-102141
    — CVSS 6.7 (MEDIUM)

    Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be execute…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · September 30, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com