Dutch Institute for Vulnerability Disclosure (DIVD) CSIRT (24 September 2026, “It was a matter of when, not if…”): after nearly seven years the volunteer vuln-disclosure nonprofit confirmed it was breached. Modus operandi “indicates that this is an agentic AI powered attack”; infrastructure access blocked; third-party IR engaged; Autoriteit Persoonsgegevens, NCSC-NL and police notified; treat as worst-case assume-breach until proven otherwise. Updated 29 Sep 2026: BleepingComputer (29 Sep, 11:39 pm Perth), citing DIVD's Monday update, reports DIVD described the attack as “loud and very, very messy”; after initial exploit of an undisclosed technical vulnerability (explicitly not Citrix NetScaler), an automated AI agent performed post-exploitation, choosing next steps autonomously, leaving verbose decision comments, and interfering with its own adversary-in-the-middle / password-spraying path — researchers characterise the agent as poorly trained/configured, aiding reconstruction. Purpose and full impact still unclear; DIVD intends a more detailed public update on 1 October and victim notification for the same vulnerability when ready. KrebsOnSecurity (28 Sep): a DIVD spokesperson said the incident does not appear related to ShinyHunters, nor are there any signs it involves the work of a previous volunteer. Updated 1 Oct 2026: BleepingComputer (30 Sep, 15:49 US Eastern; 1 Oct, 3:49 am Perth) reports initial access was a chain of two Zammad helpdesk zero-days CVE-2026-102489 and CVE-2026-102490 (discovered with Merlon Security) enabling session hijacking, RCE, and escalation to root in seconds under AI automation, then lateral access/exfiltration; segmentation limited deeper movement. DIVD recommending Zammad users upgrade to version 7 or take instances offline; alerting other vulnerable operators; further public detail still expected. Product patch path filed separately as zammad-102489-102490-20260930. (sources: DIVD CSIRT; BleepingComputer) Correction (26 Oct 2026): the KrebsOnSecurity report credited on this card is now linked. (source: KrebsOnSecurity)
DIVD CSIRT — It was a matter of when, not if… (24 Sep 2026)
UpGuard research by Greg Pollock (“Everything Everywhere: Systemic Data Exposure in Supabase Apps”; published 24 September 2026) documents systemic exposure across more than 16,000 misconfigured Supabase (PostgreSQL) backends. From ~300,000 domains showing Supabase use, researchers probed for readable users tables / schemas. More than half of exposed databases held PII; a smaller subset included passwords or authentication tokens; a very small set had plausible credit-card fields. Example exposures cited: US valet CRM >100k customer records (contacts, plates, visit history); Canadian immigration service ~5k users incl. 884 plaintext passwords; India-based adult creator platform with identity/payment accounts and >100k private messages; Philippines OTP service >2k users / ~100k SMS; African government consulate ~25k people with addresses and emergency housing locations. Root cause: missing or ineffective row-level security and public-key misuse — often on AI-assisted (“vibe coded”) apps where humans do not understand DB config; Supabase RLS-by-default in Table Editor UI does not cover API/programmatic table creation used by coding agents. UpGuard notified owners of significant findings. Not a Supabase platform breach — customer misconfiguration. (sources: UpGuard; UpGuard) Updated 28 Sep 2026: BleepingComputer reported the research. (source: BleepingComputer)
UpGuard — Everything Everywhere: Systemic Data Exposure in Supabase Apps (24 Sep 2026)
ASD’s ACSC alert Risks of AI misalignment to Australian organisations (first published 24 September 2026; High) states ASD is aware of AI misalignment instances where agents undertook unexpected actions not intended or authorised by operators. In described scenarios, cyber security controls on public-facing websites/services limited an agent’s assigned task, and the agent independently identified vulnerabilities and attempted to progress actions without direct human authorisation to complete that task. ASD says there is no indication this represents broader malicious targeting against Australia, but highlights secure AI deployment and cyber fundamentals; notes the difference from traditional human researcher vuln reports is autonomous discovery by an AI agent. Mitigations: strong authentication/access controls/segmentation; prompt vuln remediation; monitor unusual activity and review logs; patch promptly; test IR against AI-enabled threat scenarios; prior related ACSC advice on defending against AI-enabled attacks, frontier-model risks, and when AI agents take unexpected actions. Context on Cyberstack: OpenAI Medicare statistics portal access (PM disclosure 24 Sep) and related Senate inquiry coverage. (source: ASD’s ACSC)
ASD’s ACSC — Risks of AI misalignment to Australian organisations (24 Sep 2026)
SOCRadar Threat Research Unit (STRU; published 24 September 2026) documents Operation Master (April–mid-September 2026): a multi-tier intrusion and monetization pipeline that exploited Palo Alto Networks PAN-OS GlobalProtect authentication bypass CVE-2026-0257 to establish unauthorized VPN sessions on seven gateways in four countries, combined with web-app/SQL attacks (incl. xp_cmdshell), AdaptixC2 on at least two Windows servers, DNS tunneling / rclone exfil, and an automated invoice-fraud panel. Fraud telemetry cited: 2,468,335 emails and 1,487,294 SMS by 16 Sep; 622,666 personalized links; targeting skewed to Brazilian payment/PIX workflows; energy-sector data also sold under forum persona “masterblack”. Recon: ~277.5M address scans → 81 high-value orgs; 9+ databases stolen. Vendor PSIRT CVE-2026-0257 (published 13 May 2026, updated 3 Jun): auth bypass on GlobalProtect portal/gateway when authentication-override cookies are enabled with a specific certificate configuration; Panorama and Cloud NGFW not impacted; Exploit Maturity ATTACKED; limited exploit attempts on unpatched devices without mitigations. (source: Palo Alto Networks PSIRT) UPDATE (11 Oct): ReliaQuest says several ransomware groups, including Qilin and Settra, are now using CVE-2026-0257 to open unauthorised GlobalProtect VPN sessions and walk into internal networks through the victim's own remote-access service, where the traffic looks like normal remote work. It also saw follow-on use of Cobalt Strike, BloodHound and SharpHound, and assesses that exploitation is highly likely to continue over the next three months as ransomware crews and access brokers chase unpatched gateways. Arctic Wolf had already tied June 2026 intrusions that ended in Qilin ransomware to this flaw (report of 20 July), with VPN sessions coming from machines named "kali". Settra is the newly named group. What to do: patch every internal and external GlobalProtect portal and gateway that issues or accepts authentication-override cookies (hybrid Prisma Access sites must also upgrade their on-premises firewalls), then end all active GlobalProtect sessions, because patching does not remove access an attacker already has. Review unexpected VPN connections, including hostnames such as "kali" (a lead to check, not proof on its own), and rotate credentials, including the Active Directory KRBTGT account, if anything suspicious turns up. UPDATE (Unit 42 threat brief updated 19 Oct, 4:00 pm PT, 20 Oct 07:00 Perth): Palo Alto Networks' Unit 42 says it continues to see attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (Qilin) and Tarnished Scorpius (INC), and notes public reporting tying Settra ransomware operators to it. Its investigations, running since early June 2026, span education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail. After opening a VPN session that sidesteps MFA, the attackers typically run reconnaissance with dual-use remote monitoring and management (RMM) tools, move laterally over RDP and SMB, and stage tools for credential theft, data theft and ransomware. Unit 42 calls the direct pivot to the virtualisation layer the most significant change: in one case the attackers went from the VPN gateway to the vCenter management appliance, turned off the execInstalledOnly protection on ESXi hosts, and used a custom tool to dump credentials offline from a domain controller's virtual disk (VMDK), which bypasses endpoint detection inside the guest. It has also seen the access chained with exploits for Veeam Backup & Replication CVE-2023-27532. Unit 42 lists IP addresses, host IDs and device names (such as aa:bb:cc:dd:ee:ff, DESKTOP-GP01 and GP-CLIENT) to search for in GlobalProtect logs.
Project Black (Eddie Zhang, published 24 September 2026) documents a red-team experiment: can an LLM produce an LSASS credential-dumping executable that evades modern EDR with limited human direction? Claude Opus 5 / Opus 4.8 / Sonnet 5 refused even under Anthropic’s Cyber Verification Program. Open-weight DeepSeek v4 Flash 0731 produced a working reflective minidump + XOR writer that pypykatz could parse, but still triggered EDR. Moving the same binary to a community-uncensored Qwen 3.8 27B model running locally on a dual-RTX-4090 hashcat rig — with only a request to make it “more stealthy” — returned a revised build that generated no detections on either of two lab EDRs (vendors unnamed). Without further prompts the model reduced process-spawn suspicion, lowered LSASS access masks, inserted randomised sleeps during minidump construction, changed output path/name, and scrubbed embedded strings. Author frames this as a defender warning: after admin foothold, EDR is less dependable if rented GPU time can iterate bypasses. Research / lab only — not an in-the-wild campaign. (sources: Project Black; Cyber Security News)
Project Black — Bypassing EDR with Local AI (Eddie Zhang, 24 Sep 2026)
PaperCut Security Bulletin (24 September 2026 AEST; vulnerability log updated same day) discloses four issues fixed in current maintenance trains. PaperCut NG/MF: CVE-2026-14780 (CVSS 4.0 7.5 HIGH) — authenticated administrator RCE via optional Print/Device Scripting (disabled by default since 22.1.1; fixed earlier in 26.0.2 / 25.0.12); CVE-2026-82077 (CVSS 4.0 7.3 HIGH, watchTowr) — authenticated admin path-traversal/command injection in Scan-to-Fax; CVE-2026-87739 (CVSS 4.0 6.9 MEDIUM, internal) — unauthenticated remote attacker can trigger report generation and obtain sensitive report data (CWE-639). PaperCut Hive Embedded Application for Ricoh: CVE-2026-11744 (CVSS 4.0 3.8 LOW) — local NFC-card XSS into the embedded webview sandbox. Vendor note: sites already on NG/MF 26.0.5 or 25.0.13 already have the NG/MF fixes; Hive Ricoh app → 2.3.0. (source: PaperCut bulletin) UPDATE (12 Oct): watchTowr Labs published its full write-up on 9 October 2026 (US time; early 10 October Perth) showing that CVE-2026-82077, the Scan to Fax path traversal PaperCut rates as an authenticated-administrator flaw, completed an unauthenticated remote code execution chain against PaperCut NG 26.0.4-PO build 76508 when paired with WT-2026-0143, a further authentication bypass (no CVE assigned) that reaches the Setup Wizard forms through the Apache Tapestry service parameter and lets an attacker reset the admin password. watchTowr describes it as the second round of bypasses after the August in-the-wild chain (CVE-2026-81578 plus CVE-2026-82078): WT-2026-0141 and WT-2026-0142 defeated the first 26.0.4 fix and were closed in 26.0.4-PO build 76508; WT-2026-0143 was closed in 26.0.4-PO build 76530, and CVE-2026-82077 in 26.0.5. watchTowr also released a Detection Artefact Generator that checks exposure to the authentication bypasses. Any server still on a 26.0.4 emergency or PO build should be treated as reachable without a password and moved to a full maintenance release. PaperCut's vulnerability log still shows its last update as 24 September.
Netskope Threat Labs (blog 24 September 2026) tracks a cloud-hosted tech-support-scam kit delivered via Google Ads. Victims click an ad on legitimate high-traffic maps/weather/real-estate/document/sports publisher sites, land on a spinner then a benign-looking “ShopEase” storefront; after a mouse-movement bot gate the kit AES-decrypts a hidden C2, fetches an OS-specific encrypted payload, and assembles a full-screen fake Microsoft Defender (Windows) or Apple (macOS) security locker entirely in browser memory (no inspectable file download). Locker uses requestFullscreen, hides the cursor, swallows exit keys, lags the browser, and pressures a call to a bogus support line for payment / remote access / personal data. Window observed 31 August–14 September 2026: ≥619 organisations in Netskope telemetry clicked the ads (Netskope blocked content so those customers were not scammed); geography of clicks ~62% US, ~16% Japan, ~14% Australia; >250 Google Ads campaign IDs across ≥284 publisher sites. Google statement (via Ars): zero tolerance for scams; actively investigating and will act on policy-violating accounts. No CVE. (sources: Netskope; Ars Technica)
Netskope Threat Labs — A Fake Security Locker, Delivered by Google Ads (24 Sep 2026)
Huntress (24 September 2026) reports an early-September 2026 intrusion that began with exploitation of Samsung MagicINFO 9 Server CVE-2025-4632 (path traversal / arbitrary file write as SYSTEM; incomplete fix lineage from CVE-2024-7399). After access via the Tomcat-hosted MagicINFO service, the actor repeatedly tried to install AnyDesk (source IP 194.87.89.30), created a local admin, disabled Microsoft Defender, then compiled a Silent XMR Miner–based Monero miner on the endpoint (noisy csc/gcc/tcc/donut telemetry) and pointed it at auto.c3pool.org:19999. NVD / Samsung PSIRT: CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); affected MagicINFO 9 Server before 21.1052; fixed May 2025. CISA KEV entry (added 2025-05-22; catalog still lists). (sources: Huntress; NVD; vendor notes via KEV → security.samsungtv.com SVP-MAY-2025)
Huntress — The Not So Silent Miner (MagicINFO → on-host Monero build) (24 Sep 2026)
Cryptology ePrint Archive paper 2026/2131 (“Forging 1024-bit RSA signatures in nearly SNFS time”; Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger, Emmanuel Thomé) and Ars Technica (Dan Goodin, 24 September 2026) describe a classical-computing signature-forgery method that breaks RSA without factoring the modulus — building on an under-appreciated 2007 Joux–Naccache–Thomé oracle algorithm. Practical demonstration: forging against deprecated 1024-bit RSA took a handful of months on an academic CPU cluster, far below nation-scale GNFS factoring estimates for that size. Authors and independent cryptographers (quoted in Ars) stress widely deployed RSA-2048+ implementations remain practically safe for now, but the result is a conceptual break from the long-held “RSA security ≈ factoring hardness” assumption and further argues against any remaining 1024-bit RSA. Peer review pending. (sources: IACR ePrint 2026/2131; Ars Technica)
IACR ePrint 2026/2131 — Forging 1024-bit RSA signatures in nearly SNFS time
Socket (24 September 2026; update 25 Sep) documents that GitHub Actions actions-cool/issues-helper and actions-cool/maintain-one-comment — compromised in the May 2026 Mini Shai-Hulud campaign and disabled by GitHub on 19 May — became downloadable again on 16 September 2026 without cleaning release tags. Tags still pointed at the May 18 malicious commits, so workflows referencing either action by mutable version tag (e.g. @v2.2.1) resumed fetching and executing the payload (Bun install + obfuscated index.js; credential harvest / exfil cluster overlap with t.m-kosche[.]com). issues-helper alone has ~15,000 dependent repositories on GitHub's dependency graph; housekeeping workflows often run daily or on issue/PR events, so many repos likely re-ran the payload within a day of re-enablement with no further attacker action. SHA-pinned clean pre-May-18 commits were not affected. Socket update 25 Sep: both repositories disabled again by GitHub Staff (ToS); tag-referenced workflows now fail at job setup instead of running the payload. (sources: Socket; The Hacker News)
Flare Research (blog dated 24 September 2026) documents TWEAKOS, a Telegram-native credential theft and monetization workflow recovered after source appeared on Pastebin. Two co-designed Python components share one bot token and admin IDs: a Windows-oriented stealer that persists via Startup / user Run key (no admin needed), harvests Discord tokens from Discord / Discord PTB / Chrome default-profile LevelDB (.log/.ldb), validates them against Discord’s API, drives an interactive Telethon sign-in to mint a fresh Telegram .session, and exfils validated tokens/sessions to hardcoded admin IDs; plus a single-process Telegram bot backend (SQLite) that inventories victims/products/orders and sells “telegram” and “discord” accounts under the TWEAKOS brand with 5%/day time-decay pricing settled in Telegram Stars. Flare assesses this as the first documented case of a stealer and its own storefront running inside the same bot process. Delivery lure and victim count unknown; bot reachability at disclosure not confirmed. No CVE. (sources: Flare; Cyber Security News)
ServiceNow September 2026 CVE Advisory (KB3159623; CNA records published 24 September 2026) remediates five ServiceNow AI Platform flaws. Lead criticals: CVE-2026-13016 (CVSS 4.0 9.3) — unauthenticated SQL injection enabling arbitrary SQL against the instance database and unintended data read/modify; CVE-2026-86860 (CVSS 4.0 9.3) — missing authorization / unauthenticated sensitive data disclosure with privilege escalation. Highs: CVE-2026-86858 (8.7) improper access control via GraphQL allowing unauth create/modify/delete of instance data; CVE-2026-86859 (8.7) unauthenticated authorization bypass / arbitrary record disclosure; CVE-2026-86857 (8.4) authenticated authorization bypass within AI Platform data. ServiceNow states no evidence of malicious exploitation; hosted instances received vendor updates (August Patching Program participants already covered); self-hosted/partners must apply patched releases. (sources: ServiceNow KB3159623; CVE.org/NVD CNA metrics)
ServiceNow — KB3159623 September 2026 CVE Advisory
