# Weekly Situation Report — 10/12/26

2026-10-15 · Threat Brief

Canonical: https://www.osec.com/resources/threat-briefs/weekly-situation-report-10-12-26

---

- An Atlassian path traversal vulnerability has attracted exploit attempts within hours of its public disclosure by security researchers.

- Citrix has released patches for a NetScaler SAML zero-day vulnerability that has been exploited in real-world attacks.

- A Fortinet FortiMail zero-day vulnerability is being actively exploited in attacks against vulnerable email security appliances.

- A Linux backdoor targeting multiple IoT products abuses the STUN protocol to support covert communications or command-and-control activity.

- Threat actors have compromised three top-level domains, potentially enabling malicious activity through affected domain infrastructure.

- Citrix has disclosed vulnerability CVE-2026-107406 affecting SAML identity provider deployments, with exploitation considered likely.

## 1. Atlassian Path Traversal Bug Sees Exploit Attempts Hours after Research Disclosure

**Summary**

Atlassian advised users to patch their datacenter products to address a critical vulnerability (CVE-2026-21589) that allows unauthenticated access to specific files. Organizations unable to patch immediately should remove affected systems from public internet access. Atlassian cloud products are not affected. Exploitation attempts were observed within hours of the research being disclosed, although no confirmed breaches or malware deployment have been reported at this time.

**Category:** Critical Vulnerabilities

**Industry:** Multiple

**Analyst comments**

Atlassian has advised users to remediate CVE-2026-21589, a vulnerability that allows unauthenticated access to specific files within the web application root directory. This vulnerability affects various products including Bitbucket, Crowd, Confluence, and Jira (Full list of affected are in actionable guidance below). While exploitation requires knowledge of exact filenames and paths and does not permit directory browsing, it still poses a significant risk if sensitive files are present.

Public research detailing exploitation of this vulnerability is available. Exploitation requires knowledge of sensitive file locations. Specific configurations, such as on-premises Atlassian Crowd, can result in major impact, including user modification and administrator credential theft. Therefore this product line should be prioritized for remediation first.

CVE-2026-21589 is a path traversal flaw exploiting replacement logic within Atlassian's codebase that replaces "/" characters with "::". This produces requests resembling `..::..::..::..::..::WEB-INF::web.xml`. An example request can be seen below.Exploitation attempts were seen hours after disclosure. Public honeypots are seeing traffic relating to this vulnerability.

The researchers note that they created a PoC using exfiltrated Crowd credentials to modify existing users and create rogue accounts, although this activity has not been observed in honeypots,consistent with external researcher reports. The vulnerable endpoint for Crowd is not mentioned in the original research disclosure. However, threat actors may exploit `crowd.properties` and reuse credentials found in that file. URL requests to that filename that are not attributable to administrator activities, followed by requests to user management endpoints during exploitation, are a high signal of an attack.

**Actionable guidance**

A patch is available that remediates this vulnerability. Organizations unable to apply the patch immediately should remove affected Atlassian instances from public internet access until remediation is complete. Subscription versions are already patched. The vendor also suggests implementing the following WAF rules to protect on-premises instances of Atlassian products until the patch can be applied.

```
(?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*
```

Additionally, organizations running Atlassian Crowd should look for recent modification or creation of users without attribution to legitimate administrator activities, including users that may have been recently added to the administrator group. Traffic monitoring on Crowd hosts should look for access attempts with log entries ending in `crowd.properties`. Attempts not attributable to administrator activity are likely exploitation attempts. The vulnerability affects the following versions.

```
Bitbucket Data Center - 9.4.26, 10.2.8, and 10.5.1
Confluence Data Center - 9.2.26 and 10.2.19
Jira Service Management Data Center - 5.12.40, 10.3.26, and 11.3.12
Jira Software Data Center - 9.12.40, 10.3.26, and 11.3.12
Bamboo Data Center - 10.2.24 and 12.1.12
Crowd Data Center - 6.3.7, 7.0.3, 7.1.7, and 7.2.4
Crucible - 4.9.15
Fisheye - 4.9.15
```

## 2. Citrix patches NetScaler SAML zero-day exploited in attacks

**Summary**

Citrix released emergency updates for a new NetScaler vulnerability (CVE-2026-88779) exploited in zero-day attacks causing denial-of-service and used in remote code execution exploit chains.

**Category:** Critical Vulnerabilities

**Industry:** Multiple

**Analyst comments**

Citrix has released emergency updates to address a newly discovered NetScaler denial-of-service vulnerability (CVE-2026-88779), which has been exploited in zero-day attacks and potentially allows for remote code execution. The vulnerability affects NetScaler ADC and NetScaler Gateway appliances using SAML authentication and has caused targeted denial-of-service attacks on unpatched systems. Remote code execution remains unverified; researchers who disclosed earlier Citrix PoCs have stated it is a DoS-only vulnerability and suspect it makes CVE-2026-88771 faster to exploit. References to CVE-2026-88771 in observed payload samples also support this.

Multiple reports on social media and message boards have described evidence of this resulting in multi-stage backdoor malware. The vulnerability primarily affects devices using SAML for authentication, using endpoints such as `/cgi/samlauth` or `/saml/login`. External reporting indicates that threat actors have primarily targeted US-based assets. We are not aware of any public exploits at this time.

**Actionable guidance**

A patch is now available that addresses this vulnerability. If the patch cannot be applied immediately, organizations should remove affected Citrix devices from public internet access or disable SAML authentication until remediation is complete. Additionally, if compromise is suspected:

- Audit `/var/core` and `/var` for core dumps, and scan file systems for recently modified `nsaaad-*.gz` artifacts that may contain malicious payloads or forensic evidence.
- Monitor `/var/log/ns.log*` using:

`zgrep -Ei 'proc nsaaad.*(SIGNALED|EXITED)|maximum number of restarts|Pitboss declaring system failure|All monitored processes have exited, rebooting' /var/log/ns.log* | tail -100`

## 3. Fortinet FortiMail Zero-Day Exploited in the Wild

**Summary**

A critical zero-day vulnerability in Fortinet's FortiMail, tracked as CVE-2026-104286, allows attackers to execute arbitrary code through crafted HTTP/HTTPS requests, affecting multiple versions of the software.

**Category:** Known Exploited Vulnerabilities

**Industry:** Multiple

**Analyst comments**

CISA and Fortinet have warned of a critical zero-day vulnerability (CVE-2026-104286) in FortiMail that allows attackers to write arbitrary files to the system through crafted HTTP or HTTPS requests. This vulnerability has already been exploited in the wild.

We are not aware of a publicly available PoC. However, we have seen GitHub repositories that claim to have a working exploit obtainable by contacting the repository maintainer. According to internet scanners such as FOFA, over 32,000 FortiMail hosts are exposed based on certificate common name matches, with a majority located in the US, Japan, and Australia. Log entries generated during exploitation, provided in the advisory, indicate that the path traversal vulnerability affects GUI web panels with IBE enabled.

Further details on the behaviors of payloads dropped to affected devices are not available. However, from the log entries, it is assessed that persistence is maintained via rogue users and cron jobs on affected hosts, in addition to shared library injection via `ld.so.preload`.

**Actionable guidance**

A patch is currently not available as of October 8th. Organizations should disable the IBE feature or limit access to the management interface to trusted sources until patches are released for FortiMail versions 7.2.0 through 8.0.1. If compromise is suspected, look for log entries containing `Invalid Base64 Encoding at pos 0. Character=0x2a` and possible rogue users and cron jobs. Hunt for requests to the vulnerable host containing `../../` and ending with `%00`, especially from unfamiliar IP addresses. Suspicious files may also be found in the host's `/upload` folder based on log entries.

```
Version    Affected    Solution
FortiMail 8.0    8.0.0 through 8.0.1    Upgrade to 8.0.2 or above
FortiMail 7.6    7.6.0 through 7.6.6    Upgrade to 7.6.7 or above
FortiMail 7.4    7.4.0 through 7.4.8    Upgrade to 7.4.9 or above
FortiMail 7.2    7.2.0 through 7.2.9    Upgrade to branch 7.4 or above
```

## 4. Linux Backdoor Abuses STUN Protocol in Multiple IoT Products

**Summary**

ClingSTUN, a newly identified Linux backdoor, transforms compromised systems into proxies using the STUN protocol. It spreads through multiple hardcoded exploits and maintains persistence by embedding itself into system initialization scripts. The malware also leverages legitimate STUN servers for NAT traversal.

**Category:** Threat Actor Activities

**Industry:** Manufacturing, Multiple (likely smaller office branches or environments using consumer/small business routers)

**Analyst comments**

According to researchers, ClingSTUN is a Linux backdoor that transforms compromised systems into STUN protocol proxies and uses hardcoded exploits for self-propagation. It targets over two dozen vulnerabilities for initial access and establishes persistence by copying itself into hidden files and appending startup commands to system initialization scripts. The malware's operators exploit vulnerabilities in products from multiple vendors, including Avtech, D-Link, and Realtek. ClingSTUN uses downloaders to retrieve malware payloads for various system architectures. It establishes endpoint connections via STUN binding requests to maintain NAT connectivity and sends group identifiers and mapped-port lists to STUN endpoints for coordination.

Use of public STUN servers as a C2 technique remains uncommon, with only a handful of groups employing STUN/TURN relays, primarily those operating ransomware or extortion campaigns (Dragonforce being a notable example). However, as adversaries increasingly leverage legitimate infrastructure such as compromised websites, well-known official domains (e.g., azure-websites.net, github.com), OAST endpoints, and WebSocket-based addresses for command and control, we can expect this technique to expand to additional threat groups. This will make it increasingly difficult for defenders to attribute malicious network activity, particularly for those relying on network IoCs for both blocking and forensic investigation of potential intrusions.

The malware primarily uses known exploits for initial infection against the affected router brands. Most of the exploits used are older, with the oldest dating to 2019. The full list of exploited vulnerabilities includes the following.

```
# Vulnerabilities by Company
## AVTECH
- **CVE-2024-7029** – AVM1203 Factory.cgi Command Injection

## D-Link
- **CVE-2024-23625** – UPnP SUBSCRIBE CGI Remote Code Injection
- **CVE-2024-23624** – UPnP SUBSCRIBE CGI Remote Code Injection
- **CVE-2024-10915** – Devices account_mgr.cgi Command Injection
- **CVE-2024-10914** – Devices account_mgr.cgi Command Injection
- **CVE-2022-37055** – Go-RT-AC750 hnap_main Buffer Overflow
- **CVE-2019-17621** – UPnP SUBSCRIBE CGI Remote Code Injection
- **CVE-2014-8361** – Realtek SDK Miniigd UPnP SOAP Command Execution

## EnGenius
- **CVE-2025-34035** – EnShare IoT Gigabit Cloud Service Command Injection

## Hytec
- **CVE-2022-36553** – Inter HWL-2511-SS popen.cgi Command Injection

## Ivanti
- **CVE-2024-21887** – Connect Secure Policy Secure Authentication Bypass
- **CVE-2023-46805** – Connect Secure Policy Secure Authentication Bypass

## JAWS
- **CVE-2016-20016** – DVR CCTV Shell Unauthenticated Command Execution

## KGUARD
- **CVE-2026-87827** – DVR Unauthenticated Remote Command Execution

## Lantronix
- **CVE-2025-67038** – EDS5000 Code Injection

## LB-LINK
- **CVE-2023-26801** – goform.set_LimitClient_cfg Command Injection

## Linear
- **CVE-2019-7256** – eMerge card_scan_decoder.php Command Injection

## Linksys
- **CVE-2025-34037** – Devices Administrative Console Authentication Bypass

## MeiG
- **CVE-2026-36356** – Smart FORGE_SLT711 GoAhead web server OS Command Injection

## Realtek
- **CVE-2021-35394** – SDK UDPServer Command Execution

## Sunhillo
- **CVE-2021-36380** – SureLine Remote Command Injection

## TBK
- **CVE-2024-3721** – DVR SOSTREAMAX Command Injection

## Tenda
- **CVE-2024-46048** – Devices exeCommand Command Injection
- **CVE-2024-35340** – Devices exeCommand Command Injection
- **CVE-2024-32314** – Devices exeCommand Command Injection
- **CVE-2024-32292** – Devices exeCommand Command Injection
- **CVE-2024-32281** – Devices exeCommand Command Injection
- **CVE-2022-35555** – Devices exeCommand Command Injection
- **CVE-2022-26289** – Devices exeCommand Command Injection

## TP-Link
- **CVE-2023-1389** – Archer AX21 luci.stok Command Injection
```

In addition to using public STUN servers, the malware communicates primarily with network addresses associated with China. Most associated malware hashes are classified as Mirai.

**Actionable guidance**

Organizations using affected devices should apply firmware updates or migrate to a supported version to reduce risk from this threat. If compromise is suspected, look for files named `.cling` in `/root` and `/usr/local/bin`. Additional artifacts include `wget` calls to IP address endpoints, downloading files named after common architectures (e.g., `/mips`, `/i686`, `/aarch64`).

## 5. Threat Actors Compromise Three Top-Level Domains

**Summary**

Hackers compromised three country-code top-level domains to obtain unauthorized HTTPS certificates for Google and other major organizations. In response, Google blocked the certificates in Chrome and worked with Certificate Authorities to protect users across other browsers.

**Category:** Supply Chain Risk, Confirmed Breach

**Industry:** Technology

**Analyst comments**

Attackers compromised the ccTLDs of .gh, .sl, and .as to obtain unauthorized HTTPS certificates for Google domains and other major organizations. This DNS hijack allowed changes to authoritative DNS records, putting all domains under these ccTLDs at risk, though Google's systems were not compromised. In response Google utilized CRLSets to block the unauthorized certificates in Chrome and worked with CAs to revoke them. Google also used Certificate Transparency logs to identify and block affected domains for other organizations.

However, Google is likely not the only major organization affected; other organizations operating in these regions are also at risk. This allows malicious websites to bypass certificate security protections and present attacker-controlled content to users without warning. The compromise also enables DNS hijacking of any domain under the affected TLDs, allowing official domain names in these regions to serve malicious content without warning. Organizations using the compromised TLDs should actively monitor Certificate Transparency logs for potentially rogue certificates, in addition to maintaining an up-to-date inventory of certificates currently in use. Exploitation of these TLDs is highly likely to be leveraged in future attacks at a larger scale and may expand into malware- and phishing-as-a-service models.

Organizations within these regions are the most at risk of compromise. However, threat actors could also target organizations in the US or EU by using affected domains as secondary redirects from phishing landing pages to deliver malware payloads.

**Actionable guidance**

Organizations that do not operate within the affected regions should consider blocking TLDs with the noted country codes. If this cannot be done, an additional vetting process will likely be needed to ascertain the trustworthiness of these domains. If an organization is operating in a region affected by this breach, it should consider the following recommendations.

- Implement CAA records to restrict which certificate authorities are authorized to issue certificates for the organization.
- Keep a working inventory of in-use certificates and monitor for potential rogue certificates.
- Monitor for unattributable changes to domain and DNS records to identify potentially rogue behavior.

## 6. Citrix Vulnerability (CVE-2026-107406) Affecting SAML IdP Deployments Likely to be Exploited

**Summary**

Citrix announced a remote code execution vulnerability in a security advisory that has a high likelihood of exploitation in the short term. The vulnerability affects NetScalers that use SAML in SP and IdP deployments.

**Category:** Critical Vulnerabilities

**Industry:** Multiple

**Analyst comments**

A remote code execution vulnerability exists in Citrix NetScalers resulting from a memory overflow flaw within SAML deployments. It is assigned CVE-2026-107406 and affects Citrix NetScaler devices running with SAML SP or IdP enabled. The vulnerability is described as using a similar attack vector to the latest round of Citrix vulnerabilities exploited in the wild.

It should be noted that this only affects NetScaler products using SAML IdP and SAML SP specifically. Products not deployed in this manner are not vulnerable. CVE-2026-107406 is currently not exploited in the wild and no PoC is available. However, as it affects a similar vector previously exploited in recent attacks, there is a high likelihood of exploitation attempts over the next 30 days. Citrix has not released details about the exploitation. However, similar to previous attacks, exploitation may target SAML IdP and SP-related endpoints such as `/cgi/samlauth` and `/saml/*`.

```
# The following products are affected by this vulnerability.
# For the following versions: Applicable only when configured as a SAML IdP:
NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive

NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive

NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive

NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive

# For the following versions: Applicable only when configured as a SAML SP or SAML IdP:
NetScaler ADC and NetScaler Gateway before 14.1-73.37

NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS

NetScaler ADC and NetScaler Gateway before 13.1-64.23

NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279
```

**Actionable guidance**

A vendor-provided fix is available and should be applied immediately given the risk of imminent exploitation. Organizations that cannot apply a fix at this time should disable SAML SP and IdP use if not required, or remove affected hosts from public internet exposure. Monitoring for potential exploitation should look for unexpected reboots, rogue user accounts, and unknown files dropped onto the file system (such as in `/var/tmp`).

—------- TEAROFF: Internal USE ONLY Below this line —-------------------------------------

This section will include data that has either not undergone deeper research and only light analysis conducted. Can be used for public dissemination or other needs.

Major BREACHES

Danish university (DTU) breach exposes data of up to 200,000 peopleLink/s: https://www.bleepingcomputer.com/news/security/danish-university-dtu-breach-exposes-data-of-up-to-200-000-people/Assessment: Threat actors exploited the institution's identity management infrastructure, resulting in a PII leak affecting its users. This includes next-of-kin information with addresses and phone numbers, in addition to national ID numbers. Risk is primarily to individuals rather than to the organization.Sector: Education | Region: EU

Nikkei cyberattack in JapanLink/s: https://therecord.media/nikkei-cyberattack-japan-dataAssessment: A user account was compromised in M365 and subsequently used for phishing attempts. The breach was primarily restricted to personal email addresses and the contents of those emails. No group has claimed responsibility. This is part of a recent series of attacks targeting Japanese companies through email and phishing tactics.Sector: Media | Region: Japan

Ukrainian grocery retailer ATB hit by ransomwareLink/s: https://therecord.media/atb-ukraine-cyberattack-ransomwareAssessment: Claimed by the group DataSuckers, which demanded $400K or will publish the data. There are contradictions regarding the validity of the data, and ATB denies the breach. The group has published samples, but none of the information has been verified at this time. DataSuckers primarily communicate in Russian, which may indicate the actors' origin. If PII is leaked, individuals are at risk; if the data is connected to larger organizations, additional brands could be affected.Sector: Retail, Food and Agriculture | Region: Ukraine

University of Illinois, Chicago (UIC) hit by ransomwareLink/s: https://therecord.media/ransomware-university-illinois-chicagoAssessment: Targeted by the newer ransom/extortion group Booba, which claims 344 GB of data obtained from the breach. The group is thought to be a rebrand of Frag ransomware, based on similarities in the leak site and negotiation flow. The incident resulted in disruption of systems; the impact of the leaked data is currently unknown.Sector: Education | Region: US

ASOS app delivers a data leak rather than fast fashionLink/s: https://www.theregister.com/security/2026/10/06/asos-app-delivers-a-data-leak-threat-instead-of-fast-fashion/5301332Assessment: Major UK retailer affected by a Snowflake compromise. While the company's messaging states the impact is unconfirmed, social media chatter and additional reporting confirm that personal data was stolen. The attack was likely attributable to Simon AI users who share a common portal without full MFA coverage, with portal login credentials appearing in multiple infostealer logs.Sector: Retail | Region: UK/US

—TEAROFF—-----------------------------------------------------------------------------------------------------------

SECONDARY INTEL ITEMS

May be used for Public facing materials

Note: Assessment is in relation to the current client base. Please vet analyst language before using public facing materials.

Title: Critical GitLab AI Gateway flaw fixedLink/s: https://securityaffairs.com/200283/hacking/cve-2026-90970-critical-gitlab-ai-gateway-flaw-fixed.htmlAssessment: Prompt sandbox escape. Primarily a patch release advisory. Not exploited in the wild. No PoC. If a PoC is released, exploitation may follow; however, this appears to be noise amid more critical vulnerabilities, as exploitation likely requires authenticated access and additional steps. GitLab has not assigned monetary value to this issue, as reflected in the researcher's HackerOne award. No action required.Sector: n/a | Region: n/a

Title: Zammad GmbH exploited in the wild with at least one known victimLink/s: https://securityaffairs.com/200248/security/u-s-cisa-adds-zammad-gmbh-zammad-flaws-to-its-known-exploited-vulnerabilities-catalog.htmlAssessment: This follows dark web chatter in which a user posted about an exploit in helpdesk software, referencing VR Chat and Twilio. It is not known whether either company uses the software, and further verification would likely be required to determine whether this activity is related. This may also indicate a focus on helpdesk platforms by certain threat groups and ransomware actors. Monitor, medium priority. DIVD (Dutch Vulnerability Disclosure Institute) is among the known victims.Sector: Technology | Region: EU

Title: Warlock continues exploiting SharePoint vulnerabilities, old and newLink/s: https://thehackernews.com/2026/10/warlock-exploits-sharepoint-flaws-to.htmlhttps://www.security.com/threat-intelligence/warlock-ransomware-critical-infrastructureAssessment: Data may be stale, with intrusions noted as occurring in July. Warlock, which emerged in 2025, is known to have exploited ToolShell previously. The actor continues to target primarily the government, water, energy, telecommunications, and education sectors. Portuguese-speaking countries remain the primary targets. The actor is China-nexus. Tradecraft is non-novel.Sector: Government, Water, Energy, Telecommunications, Education | Region: Portugal, Brazil, South Africa, Africa, Timor

Title: MI5 warns of researchers inadvertently conducting Chinese intelligence researchLink/s: https://thehackernews.com/2026/10/mi5-says-chinas-mss-funded-research.htmlhttps://www.mi5.gov.uk/mi5-issues-espionage-alert-cgtri-%E4%B8%AD%E5%9B%BD%E9%80%9A%E7%94%A8%E6%8A%80%E6%9C%AF%E7%A0%94%E7%A9%B6%E9%99%A2Assessment: MI5 claims that institutions are directly supporting research for Chinese MSS espionage purposes. However, the advisory is overly broad and does not detail research examples that would pose a threat to national security beyond the association with the MSS. As it stands, this does not affect our current clients or work. No action required.Sector: Education | Region: EU/UK

Title: Impact from New Jersey and Texas healthcare firmsLink/s: https://www.securityweek.com/250000-impacted-by-data-breaches-at-new-jersey-texas-healthcare-firms/Assessment: Stale. Intrusions occurred in July, and impact has already passed. Drop.Sector: Healthcare | Region: US

Title: AI-discovered Rejetto HFS bug disclosedLink/s: https://horizon3.ai/attack-research/disclosures/anthropic-mythos-rejetto-hfs-rce/Assessment: The composition of our current customer base using this product is unknown. Sufficient research from Horizon3 appears available to develop a working PoC. Rejetto HFS has been exploited in the wild previously, specifically CVE-2024-23692 and CVE-2026-61500. Monitor, medium priority.Sector: something | Region: something

Title: SK Bank claims AI-driven attacks affected themLink/s: https://www.bleepingcomputer.com/news/security/south-korea-probes-bank-breaches-amid-suspected-ai-powered-attacks/Assessment: No IoCs or research data are associated with the intrusions, preventing full verification of the reported activity or confirmation that the actors used agentic attacks. The report does not state the success rate of the attacks or provide auditable breach data. Monitor, low priority.Sector: Finance | Region: South Korea

Title: Atlassian critical file access flawLink/s: https://www.theregister.com/security/2026/10/06/atlassian-warns-of-critical-file-access-flaw-in-its-datacenter-products/5301284https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/Assessment: Critical file access vulnerability with public research published by WatchTowr Labs. Given their track record of public research, this is likely to be exploited. An alert may be warranted depending on how widespread the technology is (Shodan crawl here). Further investigation may be warranted to determine potential scope. Further investigate, medium priority.Sector: Technology / Multiple | Region: n/a

Title: Ninja Forms WordPress plugin exploitedLink/s: https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/Assessment: A known PoC exists on Sploitus for CVE-2026-94504 (https://sploitus.com/exploit?id=34ADA71A-08D7-59AD-8BE3-8926666DB8A2), released around 22 September. However, much of the published content appears AI-generated and may overstate impact. We have observed this plugin in client environments previously; because exploitation requires phishing an administrator, execution may be more difficult than other, more impactful attacks. Both issues are XSS-related. Together with recent WooCommerce exploitation, this is likely affecting primarily the retail sector and smaller WordPress storefronts. Monitor, low priority.Sector: Retail | Region: n/a

Title:Link/s: https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/Assessment: Storm-2570 has adopted RMM tooling such as MeshCentral, similar to ShinyHunters intrusions, but still relies on common security tooling and known threat-actor-abused tools such as SoftPerfect Network Scanner, Nmap, and Mimikatz. The actor adds Defender exclusions for C:\PerfLogs, likely where malicious files are staged, and impairs Defender-related registry keys. It also uses Impacket, NetExec, RDP batch scripts, and admin shares. Tunneling is performed over ngrok, which has been widely used previously. NetExec is used for SMB exploitation. Outside of renamed MeshAgent variants, nothing in this affiliate's tradecraft is novel; in fact, the actor uses older techniques overall. The report references Cloudflare Tunnel for some C2 and then ngrok, which raises doubt about the reliability of parts of the report. The information is also likely stale, with no IoCs provided. Monitor, low priority.Sector: Multiple | Region: US/EU

Title: KVM guest-to-host escape in Vercel microVM infrastructure also used by Google and AWSLink/s: https://www.theregister.com/offbeat/2026/10/06/security-researcher-claims-they-found-kvm-guest-host-escape-flaw/5301267Assessment: No details on exploitation beyond an X post detailing the reward paid to the researcher. No further details are available from the researcher's X account. The announcement may prompt some threat actor groups to attempt to discover the bug independently, using the announcement as an indication that the product is vulnerable. However, it is unknown whether such a bug will be identified in the short term before fixes are rolled out on popular hypervisors. Monitor, high priority.Sector: Technology | Region: n/a

Title: ClickFix using DNS to obscure aspects of PowerShell payloadsLink/s: https://www.darkreading.com/cyberattacks-data-breaches/clickfix-attacks-evolve-better-hide-malicious-payloadsAssessment: No new tradecraft. The technique simply removes the source location and retrieves it via a second stage over DNS. The attack still relies on user interaction and PowerShell and Win+R tactics against typically non-technical users. No action required at this time.Sector: n/a | Region: n/a

Title: SonicWall SMA1000 max-severity SSRFLink/s: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-max-severity-ssrf-flaw-in-sma1000-gateways/Assessment: New SonicWall SSRF vulnerability in SMA1000 devices. No exploitation in the wild currently. No PoC or research. According to the advisory, the issue was partially identified with AI assistance, and four contributors may have found the vulnerability independently. This is a low-complexity, pre-authentication bug; because SSRF is typically straightforward to identify, threat actors will likely discover it in the short term. However, the lack of a readily available device for testing will make it difficult to verify where the exploitation vector occurs. Monitor, high priority.Sector: n/a | Region: n/a

Title: Shai-Hulud compromises TensorLake packages in latest supply chain attackLink/s: https://www.theregister.com/security/2026/10/08/shai-hulud-worm-makes-jump-to-ai-infrastructure-with-tensorlake-compromise/5302054https://socket.dev/blog/tensorlake-compromisehttps://socket.dev/npm/package/tensorlake/overview/0.5.144https://safedep.io/tensorlake-npm-compromise-mini-shai-hulud/https://safedep.io/keyv-npm-supply-chain-compromise/Assessment: The compromised package was hosted on 8 October at 01:12:07 UTC and flagged at 01:23:10 UTC, an 11-minute window. As with previous exploitation, a preinstall hook is added to package.json, in addition to the primary malware samples placed in the package's /lib folder. The package has approximately 12,000 downloads per week. Notably, the worm's overall tradecraft has not changed: it uses the same dead drop naming string, "Shai-Hulud: Here We Go Again," and preinstall hooks pointing to two files in the package's /lib folder (Math_Symbol.mjs and Setup.mjs). The worm primarily functions as a wallet drainer and credential stealer, subsequently affecting other attached packages and maintainers. Monitor, medium priority.Sector: n/a | Region: n/a