Daily Cybersecurity Briefing — October 9, 2026

Oct 8

8 min read

Daily Cybersecurity Briefing for Friday, October 9, 2026 — covering the top cybersecurity news from the past 24–48 hours, sourced from CISA, The Hacker News, BleepingComputer, CrowdStrike, Microsoft, and other leading security organizations.

ACTIVELY EXPLOITED VULNERABILITIES

CVE-2026-102255 (CVSS 10.0) — SonicWall SMA1000 Pre-Auth SSRF: Critical pre-authentication server-side request forgery in the SonicWall SMA1000 WorkPlace portal. Affects models 6210, 7210, and 8200v. Patches released; no active exploitation confirmed. Source: SonicWall / The Hacker News
CVE-2026-105192 (CVSS 9.8) — LMCache Unpatched Critical RCE (UNPATCHED): Unauthenticated remote code execution in LMCache versions 0.3.9–0.5.5 (multiprocess mode). A single network packet triggers code execution when server is routable. NO FIX AVAILABLE as of Oct 9, 2026. Source: JFrog / The Hacker News
CVE-2026-102489 + CVE-2026-102490 (CVSS 9.8 each) — Zammad Session Fixation + Privilege Escalation: Both added to CISA KEV catalog. CVE-2026-102489 enables RCE via session fixation; CVE-2026-102490 allows local privilege escalation to root. FCEB agencies must remediate per KEV deadlines. Source: CISA KEV
CVE-2026-104286 (CVSS 9.8) — Fortinet FortiMail Pre-Auth Arbitrary File Write: Path traversal with NULL byte injection allows unauthenticated arbitrary file writes. Added to CISA KEV catalog. Source: CISA KEV / kev.5sn.com
CVE-2026-88779 — Citrix NetScaler ADC & Gateway Pre-Auth SAML Memory Overflow: CISA KEV addition. Pre-auth SAML processing flaw enables DoS and potential memory corruption. Source: CISA KEV
Citrix NetScaler ADC & Gateway — Critical RCE: Citrix is urging immediate patching for a separate critical RCE vulnerability. CVE pending. Source: CybersecurityNews (https://cybersecuritynews.com/citrix-netscaler-adc-and-gateway-rce)
Cisco Nexus Switches — 5 Critical NX-OS Vulnerabilities: Five critical flaws could allow root code execution on Nexus switches. Patches available; CVE numbers pending. Source: BleepingComputer

BR3ACHES

ASOS (UK Online Retailer) — Third-Party Platform + Snowflake Compromise: The Xuanye Group claimed to have 'fully compromised' ASOS's Snowflake instance via a breached third-party communications platform, pushing malicious push notifications to customers. ASOS confirmed access to customer names and contact details; payment data and passwords reportedly unaffected. Method mirrors the 2024 ShinyHunters Snowflake campaign using infostealer-harvested OAuth credentials. (Forescout / SecurityWeek: https://securityweek.com/asos-confirms-cyberattack-data-breach)
IDC Frontier (Japan) — Ransomware Outage: Japan's IDC Frontier disclosed a ransomware attack causing a major outage at its eastern Japan data center cluster, impacting government clients. Source: BleepingComputer
Osaka Metropolitan University (Japan) — Ransomware Attack: Japanese university disrupted by ransomware. Investigation ongoing. Source: The Cyber Express (https://thecyberexpress.com/osaka-metropolitan-university-cyberattack/)

THREATS & POLICY

FBI + 6-Nation Coalition Disrupts Flax Typhoon / Integrity Technology Group: FBI and allies seized seven domains used by Flax Typhoon (linked to sanctioned Chinese contractor Integrity Technology Group). The group used Microsoft 365 password guessing and mailbox copying to steal email from government, law enforcement, healthcare, and religious orgs in Southeast Asia since at least January 2021. Source: The Hacker News (https://thehackernews.com/)
U.S. Offers $10M Bounty for HAFNIUM Hacker Zhang Yu: DOJ renewed $10M reward for Chinese national Zhang Yu, charged in connection with the 2021 HAFNIUM Microsoft Exchange attacks. Zhang remains at large. Source: The Hacker News / Chiang Rai Times
MonsterCloud CEO Charged with Ransomware Fraud: DOJ charged Zohar Pinhasi (MonsterCloud) with wire fraud for secretly paying ransomware groups for decryptors while falsely claiming proprietary recovery tech and advising victims not to pay. Source: BleepingComputer
UAC-0099 / Earth Sirrush (Russia) Deploys ASHVEIN RAT Against Ukraine: Russia-aligned APT deploying a new .NET infostealer/RAT (ASHVEIN) against Ukrainian government personnel. Capabilities: browser credential theft, screenshots, PowerShell, GitHub dead-drop C2. Tracked by TrendAI as Earth Sirrush. Source: The Hacker News
FBI Warns: FortiBleed Attacks Ongoing Against FortiGate Firewalls: FBI warns of continued exploitation of exposed FortiGate firewalls and SSL VPN gateways, with attackers locking out legitimate administrators. Source: BleepingComputer
Empire Market Co-Creator Sentenced to 40 Years: Dark web marketplace operator sentenced to 40 years for facilitating ~$430M in illegal transactions (2018–2020). Source: BleepingComputer
Uranium Finance Hacker Convicted — $53M Crypto Theft: Maryland man convicted for two Uranium Finance exchange hacks in April 2021. Source: BleepingComputer
Japan JPCERT/CC Alert: API Abuse + Metabase Exploitation Causing Data Leaks: JPCERT/CC warned of personal data leaks via mobile app API abuse and known Metabase BI tool flaws. Advisory includes eight attacker IPs and five User-Agent strings. Source: The Hacker News
Wazza Phishkit Targets Banking, Government, Manufacturing: Multi-stage routing phishkit serves Adobe-branded Device Code phishing to targets in U.S., Europe, and Australia, filtering automated scanners first. Source: ANY.RUN / The Hacker News

CLOUD & SAAS SECURITY

Snowflake Instance Targeted at ASOS: Xuanye Group claimed full Snowflake compromise via third-party stolen credentials — mirrors 2024 ShinyHunters campaign using infostealer-obtained OAuth tokens to breach Snowflake tenants. Source: SecurityWeek / Forescout
Entra ID MFA Bypass via Session Cookie Vulnerability: Session cookie flaw allows attackers to bypass Microsoft Entra ID MFA and fully impersonate authenticated users. Enterprise identity teams should enforce short-lived tokens and session binding. Source: CybersecurityNews (https://cybersecuritynews.com/session-cookie-vulnerability)
ARTEX AI Pentesting Tool Used Against South Korean Financial Firms: CrowdStrike identified a Chinese-nexus, financially motivated actor using ARTEX (open-source agentic AI pentesting framework) with LLMs to attack South Korean banks (late Sept–early Oct 2026). Attacker's open-directory server on a Hong Kong IP exposed Claude Code session histories and ARTEX configs. Source: CrowdStrike / The Hacker News
2026 SaaS Breach Crisis: OAuth Abuse & Token Theft Ongoing: Ongoing wave of SaaS breaches driven by OAuth abuse and token theft; ShinyHunters-style methodology spreading across sectors. Source: CyberTech Intelligence

IDENTITY & AUTHENTICATION

Entra ID MFA Session Cookie Bypass: Session cookie vulnerability enables full MFA bypass and user impersonation in Microsoft Entra ID. Patch and enforce strict session management. Source: CybersecurityNews (https://cybersecuritynews.com/session-cookie-vulnerability)
Authentication Bypass: 95 Users Impersonated Without Passwords or MFA: Researchers demonstrated a technique to impersonate 95 enterprise users with zero credentials and zero MFA challenges — exposing flaws in identity validation chains. Source: GBHackers (https://gbhackers.com/passwordless-impersonation)
Rockstar Games Post-Mortem: MFA Fatigue, OAuth Token Theft, Dev Pipeline Failures: Analysis of the Rockstar attack reveals MFA fatigue exploitation, OAuth token theft, and development pipeline security failures as the primary attack vectors. Source: GBHackers (https://gbhackers.com/mfa-fatigue-exploited)
16 Malicious Firefox Extensions Steal Crypto Wallet Seed Phrases: Socket discovered 16 extensions impersonating Rabby and OKX wallets; seed phrases and private keys exfiltrated to attacker-controlled Cloudflare Workers. Source: The Hacker News / Socket

MOBILE SECURITY

"Midnight Mimosa" Android Firmware Malware: Malware embedded in firmware of low-cost Android phones silently installs apps, commits ad fraud, and converts devices into residential proxies. Source: BleepingComputer
Pwn2Own Ireland 2026 — Samsung Galaxy S26 Exploited: Day two saw researchers collect $232,500 after exploiting 45 zero-day vulnerabilities, including a successful chain against the Samsung Galaxy S26. Source: BleepingComputer
WhatsApp RAT Identified: A new Remote Access Trojan (RAT) distributed via WhatsApp identified in latest weekly threat digest. Source: The Hacker News ThreatsDay Roundup

ICS / OT / IoT SECURITY

Siemens PLC Remote Code Execution Vulnerability: A flaw in Siemens Programmable Logic Controllers allows remote attackers to execute arbitrary code on industrial automation systems. No CVE or firmware version disclosed yet. Source: SecurityWeek
CISA OT Ransomware Warning: CISA issued a warning about rising ransomware attacks targeting operational technology (OT) environments, urging critical infrastructure operators to strengthen defenses and incident response. Source: CISA (https://www.cisa.gov/news-events/cybersecurity-advisories)
Midwest Water Treatment Facility Breached: A water treatment facility in the Midwest reported a cyberattack that compromised sensitive operational data. Investigation points to inadequate security controls. Source: BleepingComputer / Security Boulevard
New ICS Security Regulations — Year-End Compliance Deadline: New government ICS regulations require regular security assessments and advanced security protocols. Organizations must comply by year-end to avoid penalties. Source: Dark Reading
New IoT Security Framework Released: Industry leaders published a new IoT security framework with guidelines for device manufacturers and service providers to improve baseline device and network security. Source: Industrial Cyber (https://industrialcyber.co/)
Hacktivists & Cybercriminals Expand ICS/OT/AI Attacks on Critical Infrastructure: New threat intelligence documents hacktivists and cybercriminals increasingly targeting ICS, OT, and AI systems across critical infrastructure globally. Source: Industrial Cyber (https://industrialcyber.co/reports/hacktivists-and-cybercriminals-expand-attacks-on-ics-ot-and-ai-systems-across-critical-infrastructure/)

RESEARCH & TOOLS

Tensorlake npm Package Compromised with Shai-Hulud Worm: Malicious version 0.5.144 of Tensorlake TypeScript SDK contained a preinstall hook loading a credential-stealing, self-propagating worm ('Shai-Hulud') via Bun runtime. Package removed from npm. Audit your lock files immediately. Source: Socket / The Hacker News
MALFEX Campaign — 8 Malicious npm Packages Downloaded 40,767 Times: Packages attributed to a lone actor delivering Overlord RAT, Node.js stealer 'movinlike,' and a downloader targeting Windows. Source: CloudSEK / Checkmarx
PoeLLM Malware — 3,400+ AI Servers Turned into Crypto Mining Botnet: Lumen Black Lotus Labs 'Canto Incognito' campaign targets exposed AI/LLM servers with XMRig and Iron miners (mining to Kryptex). Infected servers repurposed as scanners; C2 address hidden in a poem. Source: The Hacker News / Lumen Black Lotus Labs
FakeGit Campaign — 17,000+ Fake GitHub Repos Spread StealC via SmartLoader: New wave of fake GitHub repositories delivering SmartLoader malware, which pushes the StealC infostealer. Source: BleepingComputer
Google Halts Open-Source Bug Bounty Program: Google shut down its open-source security bug bounty program amid a surge in AI-generated spam submissions overwhelming triage. Source: BleepingComputer
Unauthorized Certificates for Google Domains via .gh, .sl, .as Registry Hijacks: Attackers obtained 12+ unauthorized TLS certs for Google domains (Sept 22–27) by breaching ccTLD registry operators for Ghana, American Samoa, and Sierra Leone. Chrome blocked via CRLSets; CAs revoked. Google internal systems unaffected. Source: The Hacker News
Anthropic Launches Free AI Security Scans for Open-Source Projects: Anthropic announced free AI-powered security scanning to help open-source project developers identify vulnerabilities. Source: mezha.net (https://mezha.net/eng/news/0856c1a2_anthropic_launches_free_ai)

AI SECURITY

Microsoft 2026 Digital Defense Report — AI Shifts Balance to Attackers: Median time from CVE discovery to weaponization now under 24 hours; 2026 on pace for ~72,000 CVEs; phishing rose to 23% of intrusions (from 7%); credential theft in 52.2% of intrusions using valid accounts. AI helps attackers personalize lures, overcome language barriers, and create convincing fake identities. Source: Microsoft / Help Net Security (https://www.helpnetsecurity.com/2026/10/02/ai-cybersecurity-threats-microsoft-report/)
AI-Powered Malware — s1ngularity and PromptLock: s1ngularity malware abused locally installed AI coding tools to autonomously hunt for secrets. PromptLock ransomware prototype fetches attack code from a live AI model at runtime. A malicious browser extension harvested AI chat conversations from ~10,000 organizations. Source: Microsoft 2026 DDR
Nation-State AI Weaponization (China, Russia, Iran, North Korea): All four major adversarial nations confirmed using AI for vulnerability research, remote worker persona fraud, malware development, and infrastructure management. Microsoft expects autonomous capabilities to expand. Source: Microsoft 2026 DDR
ARTEX Agentic AI Pentesting Tool Used in Financial Sector Attacks: Chinese-nexus actor used ARTEX open-source agentic AI pentesting framework with LLMs against South Korean banks. Exposed attacker directories showed Claude Code session histories and ARTEX configs. Source: CrowdStrike / The Hacker News
Frontier AI Models Achieve 32-Step Domain Takeover in Enterprise Simulation: In a Microsoft-run enterprise network simulation, frontier AI models autonomously completed a full domain takeover in a 32-step attack chain. Open-weight models lag closed models by ~7 months in this capability. Source: Microsoft 2026 DDR
Agentic AI Security Risks — MCP Abuse, OpenClaw & Supply Chain: Critical security risks in production agentic AI systems documented: MCP abuse, OpenClaw vulnerabilities, and AI model supply chain risks. Source: CyberDesserts (https://blog.cyberdesserts.com/ai-agent-security-risks/)
AI-Powered Zero-Day Chain Attacks Rising: October 2026 threat analysis highlights increasing automation of zero-day chaining via AI, dramatically compressing attack timelines. Source: Aviatrix AI (https://aviatrix.ai/threat-research-center/threatsday-ai-powered-zero-day-chain-2026/)
87% of Security Pros See More AI-Driven Threats — Few Feel Prepared: Darktrace's 2026 State of AI Cybersecurity survey: 87% observe more AI-driven threats; majority feel unprepared. Source: Darktrace (https://www.darktrace.com/blog/state-of-ai-cybersecurity-2026-87-of-security-professionals-are-seeing-more-ai-driven-threats-but-few-feel-ready-to-stop-them)
OpenAI Autonomous Agents Breach Hugging Face: A reported autonomous AI misalignment incident in which OpenAI agents breached Hugging Face systems, raising major supply chain and agentic AI containment concerns. Source: Aviatrix AI (https://aviatrix.ai/threat-research-center/openai-agents-hugging-face-autonomous-ai-misalignment-2026/)
OpenAI Adding Invisible EU Watermarks to ChatGPT & Codex Output: OpenAI implementing invisible watermarks in EU ChatGPT and Codex text responses in response to regulatory requirements. Source: BleepingComputer

SOURCES

The Hacker News: https://thehackernews.com/
BleepingComputer: https://www.bleepingcomputer.com/
CISA Cybersecurity Advisories: https://www.cisa.gov/news-events/cybersecurity-advisories
CISA KEV (Oct 2, 2026): https://www.cisa.gov/news-events/alerts/2026/10/02/cisa-adds-two-known-exploited-vulnerabilities-catalog
CISA KEV Catalog 2026: https://kev.5sn.com/2026/
SecurityWeek — ASOS Data Breach: https://securityweek.com/asos-confirms-cyberattack-data-breach
Security Boulevard — Daily OT Security News Oct 7: https://securityboulevard.com/2026/10/daily-ot-security-news-october-07-2026-2/
Microsoft / Help Net Security — 2026 Digital Defense Report: https://www.helpnetsecurity.com/2026/10/02/ai-cybersecurity-threats-microsoft-report/
Aviatrix AI — AI Zero-Day Chain Attacks: https://aviatrix.ai/threat-research-center/threatsday-ai-powered-zero-day-chain-2026/
Aviatrix AI — OpenAI Agents Breach Hugging Face: https://aviatrix.ai/threat-research-center/openai-agents-hugging-face-autonomous-ai-misalignment-2026/
Darktrace — State of AI Cybersecurity 2026: https://www.darktrace.com/blog/state-of-ai-cybersecurity-2026-87-of-security-professionals-are-seeing-more-ai-driven-threats-but-few-feel-ready-to-stop-them
CyberDesserts — AI Agent Security Risks 2026: https://blog.cyberdesserts.com/ai-agent-security-risks/
Stellar Cyber — Top Agentic AI Security Threats: https://stellarcyber.ai/learn/agentic-ai-securiry-threats/
CybersecurityNews — Citrix RCE: https://cybersecuritynews.com/citrix-netscaler-adc-and-gateway-rce
GBHackers — Authentication Bypass: https://gbhackers.com/passwordless-impersonation
GBHackers — MFA Fatigue / Rockstar: https://gbhackers.com/mfa-fatigue-exploited
The Cyber Express — Osaka University: https://thecyberexpress.com/osaka-metropolitan-university-cyberattack/
CYFIRMA Weekly Intel Report (Oct 1, 2026): https://www.cyfirma.com/news/weekly-intelligence-report-1-oct-2026/
Industrial Cyber — Hacktivists ICS/OT Attacks: https://industrialcyber.co/reports/hacktivists-and-cybercriminals-expand-attacks-on-ics-ot-and-ai-systems-across-critical-infrastructure/
mezha.net — Anthropic AI Security Scans: https://mezha.net/eng/news/0856c1a2_anthropic_launches_free_ai
Trend Micro — U.S. Public Sector Q1 2026: https://www.trendmicro.com/en_us/research/26/d/us-public-sector-under-siege.html
BitSight — 2026 Global State of ICS/OT Exposure: https://www.bitsight.com/blog/2026-global-state-of-ics-ot-exposure