October 2, 2026 | ITBriefcase.net
Why it matters:
Citrix disclosed two critical remote code execution zero-days in NetScaler ADC and NetScaler Gateway on September 27 — CVE-2026-88771 (CVSS 9.5, unauthenticated RCE in default configuration, no special setup required) and CVE-2026-88772 (CVSS 9.5, memory overflow RCE when DTLS is enabled, which is the default on VPN virtual servers) — confirming both had been actively exploited before any patch existed. Rapid7 observed the earliest confirmed exploitation at September 20, 14:28:43 UTC, but Mandiant and Google’s Threat Intelligence Group assessed that exploitation of CVE-2026-88772 likely began in early September — meaning organizations using Citrix as SSL VPN or ADC infrastructure may have been compromised for weeks before the public disclosure. CISA added both to its KEV catalog on September 27 with a three-day federal remediation deadline of September 30, which has now expired. watchTowr had alerted its clients to active exploitation of unpatched NetScaler RCE vulnerabilities on September 26, a full day before Citrix assigned CVE IDs. The Pentagon’s Defense Manpower Data Center confirmed this week that an undetected breach of its human resources management system exposed the personally identifiable information of more than 3 million people connected to the US military — 2.76 million living individuals and approximately 294,000 deceased — between October 2025 and July 16, 2026, a nine-month window in which a “small number of unauthorized users” accessed files containing unencrypted Social Security numbers, names, dates of birth, contact information, race, sex, and military occupational specialty data. The Pentagon began sending breach notification letters to affected individuals on September 18. No threat actor, motive, or attack method has been publicly identified. The nine-month undetected access period, combined with the storage of unencrypted SSNs on a network-accessible file-sharing system, has prompted congressional scrutiny and comparisons to the 2015 OPM breach, which similarly went undetected for months. An AI-powered autonomous attack agent on September 21 breached the Dutch Institute for Vulnerability Disclosure (DIVD) — the Netherlands’ volunteer-run cybersecurity organization responsible for finding and coordinating disclosure of software vulnerabilities — by exploiting two previously unknown zero-day vulnerabilities in Zammad, the open-source helpdesk and ticketing software DIVD uses to manage its vulnerability disclosure operations. The DIVD characterized the attack: “Used together, [the two Zammad zero-days] allowed the attackers to hijack sessions, run code remotely and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack.” The organization that discloses vulnerabilities to software vendors was itself compromised by a zero-day-based agentic attack — the irony was not lost on the cybersecurity community. North Korean threat actors stole between $351.6 million and $387 million from cryptocurrency exchange Bitget after compromising its backend systems and gaining access to hot and warm wallets, in what Bitget confirmed is “the most significant security breach in the exchange’s history.”The bottom line:
Apply Citrix NetScaler patches from bulletin CTX697096 immediately — the CISA federal deadline has expired and there are no workarounds for CVE-2026-88771 (default configurations). For CVE-2026-88772, disabling DTLS removes the attack surface as an interim measure while patching proceeds. Citrix’s September 30 Tenable update confirmed attackers are deploying web shells and tunneling malware on compromised appliances — check NetScaler systems for webshell artifacts and unexpected outbound tunneling connections even if you have patched. Military personnel notified of the DMDC breach should immediately place credit freezes, file IRS identity protection PINs, and report any suspicious contact from entities with apparent knowledge of their military service information — military occupational specialty data enables highly targeted social engineering and foreign intelligence profiling.Story 1: Citrix NetScaler Dual Zero-Days CVE-2026-88771 and CVE-2026-88772 — State-Sponsored Exploitation Since Early September, No Workaround for Default-Config RCE, CISA Deadline Expired
Impact: CRITICAL CVEs: CVE-2026-88771 (CVSS v4 9.5) and CVE-2026-88772 (CVSS v4 9.5) Product: Citrix NetScaler ADC and Citrix NetScaler Gateway (eight total vulnerabilities in bulletin CTX697096; only these two confirmed exploited) CVE-2026-88771: Improper input validation → unauthenticated remote code execution in default configuration (CWE-20); no authentication, no user interaction, no special configuration required CVE-2026-88772: Memory overflow → RCE or denial-of-service when DTLS is enabled (CWE-119); DTLS is enabled by default on VPN virtual servers Citrix Disclosure: September 27, 2026 (bulletin CTX697096) Earliest Exploitation Confirmed: September 20, 2026 (Rapid7); Mandiant/GTIG assesses CVE-2026-88772 exploitation began in early September CISA KEV Added: September 27, 2026 CISA Federal Deadline: September 30, 2026 — EXPIRED Attribution: Help Net Security: “Suspected state-sponsored hackers” — not yet attributed to a specific named group or government Post-Exploitation: Web shell deployment and tunneling malware installation confirmed (Tenable September 30 update) Workaround for CVE-2026-88771: None — patching is the only remediation Interim for CVE-2026-88772: Disabling DTLS removes the attack surface; not a substitute for patchingSummary
Citrix published emergency patches for eight vulnerabilities on September 27, 2026, confirming that two of them — CVE-2026-88771 and CVE-2026-88772 — had already been actively exploited as zero-days before any patch existed. The pre-disclosure exploitation period extends to at least September 20 per Rapid7’s honeypot telemetry (earliest confirmed attempt at 14:28:43 UTC), and Mandiant’s Threat Intelligence Group assessed that CVE-2026-88772 exploitation likely began in early September — implying a multi-week zero-day window during which organizations with internet-facing NetScaler appliances faced active, undetectable attacks. CVE-2026-88771 (default configuration): This flaw’s most dangerous characteristic is its attack surface breadth. An unauthenticated attacker needs only network reach to any NetScaler ADC or Gateway running a vulnerable software version in its standard factory configuration. No authentication, no user interaction, no special feature to be enabled. This means the entire global population of internet-facing NetScaler appliances at vulnerable versions was automatically in-scope for this zero-day from the moment exploitation began in September. CVE-2026-88772 (DTLS-enabled): This flaw requires DTLS (Datagram Transport Layer Security) to be enabled — but DTLS is the default on NetScaler Gateway VPN virtual servers, which is the most common production deployment pattern for Citrix’s SSL VPN use case. Organizations using NetScaler as a remote access VPN should assume CVE-2026-88772 exposure unless they have explicitly confirmed DTLS is disabled. watchTowr’s September 26 early warning: watchTowr, a security research firm, warned its clients of active exploitation of unpatched NetScaler RCE vulnerabilities on September 26 — 24 hours before Citrix assigned CVE IDs. The firm observed “pre-disclosure exploitation” as early as that date and published its client alert before the vulnerability was officially named, representing one of the most compressed disclosure cycles observed for a major enterprise network product in 2026. Post-exploitation tradecraft (confirmed September 30): Tenable’s September 30 update confirmed that attackers are deploying web shells and tunneling malware on compromised NetScaler appliances following successful exploitation. The web shell deployment provides persistent access that survives patching — applying patches prevents future exploitation but does not evict an attacker who has already established a webshell foothold. This is Citrix NetScaler’s fourth and fifth critical exploitation event in 2026, following CVE-2026-19490 (CVSS 9.3, authentication bypass, covered in our September 18 roundup), two prior exploited flaws earlier in the year, and the 2025 CitrixBleed (CVE-2023-4966) long tail. “Historically, NetScaler vulnerabilities have been exploited by both state-sponsored groups and ransomware operators,” watchTowr noted in its advisory.Comprehensive Action Steps
- Apply CTX697096 Patches Immediately: Upgrade to fixed firmware builds per Citrix’s bulletin CTX697096. The CISA September 30 deadline has expired. These are zero-day vulnerabilities with confirmed active global exploitation and no workaround for the default-configuration flaw.
- CVE-2026-88772 Interim Measure: If patching is delayed, disable DTLS on all NetScaler appliances. This removes the attack surface for CVE-2026-88772 but does NOT address CVE-2026-88771 — disabling DTLS is not a substitute for patching, only an interim measure for the DTLS-specific flaw.
- Webshell Hunt — Patching May Not Fully Remediate: Given confirmed web shell deployment post-exploitation, search NetScaler systems for unexpected files in web-accessible directories. Patching closes the initial access vector but does not evict an already-installed webshell. Engage Citrix TAC for recovery guidance if a compromise is suspected.
- Tunneling Malware Detection: Check for unexpected outbound connections from NetScaler appliances, particularly to external IP addresses on non-standard ports consistent with tunneling tools (SSH reverse tunnels, Chisel, Ngrok, Cloudflare Tunnel patterns).
- Assume Breach for September-Vulnerable Deployments: If your NetScaler was internet-accessible in early-to-mid September in a vulnerable configuration, conduct a full compromise assessment rather than assuming patching alone resolves the risk.
- CISA IOC Integration: Apply indicators of compromise from CISA’s September 27 alert and watchTowr’s research into SIEM and network monitoring.
Key Takeaways
- CVE-2026-88771: Unauthenticated RCE in default configuration — entire internet-facing NetScaler install base in-scope at vulnerable versions
- CVE-2026-88772: RCE when DTLS enabled — default on VPN virtual servers, the most common production deployment
- State-sponsored actors exploiting since at least early September — weeks of zero-day exposure before Citrix patched
- watchTowr warned clients before CVE IDs existed; CISA gave three days after disclosure
- Webshells and tunneling malware confirmed deployed post-exploitation — patching does not evict established attackers
- Fourth and fifth Citrix NetScaler critical exploitation events of 2026
Story 2: Pentagon DMDC Breach — 3 Million Military Personnel Records Exposed for Nine Months, SSNs Stored Unencrypted, No Attacker Identified
Impact: CRITICAL Victim: Defense Manpower Data Center (DMDC) — the Pentagon’s central source for identifying, authenticating, and authorizing US military personnel; maintains more than 60 million records for active-duty service members, reservists, civilian employees, contractors, retirees, veterans, and military family members Affected: 2.76 million living individuals; approximately 294,000 deceased — total more than 3 million Breach Window: October 2025 to July 16, 2026 (approximately 9 months undetected) Data Exposed: Social Security numbers, names, dates of birth, contact information, sex, race, military occupational specialty information — stored unencrypted on the affected file-sharing system Notification Letters Sent: September 18, 2026 Attribution: None — no threat actor, motive, or attack vector publicly disclosed Congressional Context: Early Pentagon statement (September 3) said “no indication that foul play was involved” — reversed by subsequent breach confirmation and notification lettersSummary
The Pentagon’s Defense Manpower Data Center began notifying more than 3 million affected individuals on September 18, 2026, revealing that a “small number of unauthorized users” had accessed the DMDC’s human resources management system between October 2025 and July 16, 2026 — a nine-month period during which files containing unencrypted Social Security numbers and military personnel information were accessible without authorization. Scale in context: DMDC maintains more than 60 million records total — the breach affected approximately 1 in 20 DMDC records. The affected population includes active-duty service members, reservists, civilian employees, contractors, retirees, and veterans. Not all records held by DMDC were involved, though the Pentagon has not specified which population segments are most heavily represented in the 3 million affected. The unencrypted storage: The notification letter explicitly describes “files containing unencrypted personally identifiable information.” In 2026, a federal database containing Social Security numbers transmitted without encryption during a file-sharing operation is a significant baseline security failure. The 2015 OPM breach — the most directly comparable prior incident — similarly involved unencrypted records and a months-long undetected access window. Military occupational specialty data: The inclusion of job specialty information elevates this breach beyond a standard identity theft risk. Military occupational codes identify what service members actually do — their skills, clearance implications, deployment patterns, and organizational roles. For foreign intelligence services, a database of SSNs cross-referenced with military job specialties enables precise targeting: identifying individuals with access to sensitive systems, high-value intelligence targets, or personnel worth approaching for recruitment, extortion, or social engineering. This intelligence value is why the Pentagon breach is treated as a national security concern, not just a consumer privacy incident. The comparison to 2015 OPM: The 2015 OPM breach compromised approximately 21.5 million records including detailed background investigation files and 5.6 million fingerprints — a significantly larger and more sensitive dataset. The 2026 DMDC breach is smaller by count and does not (based on current reporting) include background investigation files or biometric data. However, OPM’s breach was later attributed to Chinese state-sponsored actors who used the data for foreign intelligence targeting over subsequent years — the question of who holds the DMDC dataset, and what they will do with military occupational specialty data crossed with SSNs, is the counterintelligence concern that underpins the national security framing. No attribution: The Pentagon has not publicly named a responsible party, confirmed a motive, or described the attack method. A Pentagon official noted on September 3 that there was initially “no indication that foul play was involved” — a characterization that was overtaken by the confirmation of unauthorized access in the notification letters. Two anonymous sources told Military Times that approximately 4 million personnel may be affected — a higher estimate than the official 3 million figure that has not been publicly confirmed by DoD.Comprehensive Action Steps
- Affected Military Personnel — Credit Freeze: Place credit freezes with Equifax, Experian, and TransUnion immediately. Military personnel are frequently targeted by identity theft due to the combination of stable income (military pay) and frequent relocation (which can create gaps in monitoring).
- IRS Identity Protection PIN: File for an IRS Identity Protection PIN at irs.gov/ippin to prevent fraudulent tax filings using stolen SSNs. Active-duty personnel can use in-person IRS options.
- Military OneSource and SCRA Monitoring: Monitor for unauthorized use of military-specific benefits — Service Members Civil Relief Act (SCRA) protections, the USAA fraud line, and military pay records for any unauthorized changes.
- Social Engineering Awareness: Military occupational specialty data enables highly credible spear-phishing and social engineering attacks tailored to specific military roles. Be alert for any contact from entities demonstrating unusual knowledge of your service history, specialty, or assignment — these are potential exploitation indicators.
- DMDC Notification Process: Watch for breach notification letters dated September 18 from DMDC. If you are an active-duty service member, reservist, civilian DoD employee, contractor, veteran, or military family member, you may be among the more than 3 million affected. If you have not received a letter and believe you should be notified, contact DMDC directly.
- Congressional Engagement: The Senate Armed Services and Senate Intelligence Committees have opened inquiries. Affected personnel should be aware of ongoing oversight investigations.
Key Takeaways
- 3 million military personnel records exposed — SSNs stored unencrypted on a file-sharing system accessible to unauthorized users for nine months
- Military occupational specialty data elevates this beyond identity theft risk to counterintelligence concern — foreign intelligence services can cross-reference job specialties with SSNs for targeting
- No threat actor, attack method, or motive publicly identified — attribution investigation ongoing
- Pentagon initially said “no indication of foul play” before breach notification letters confirmed unauthorized access
- Comparison to 2015 OPM breach: smaller by count, does not include background investigation files, but similarly long undetected access window and similarly severe counterintelligence implications
Story 3: AI Agent Breaches Dutch Institute for Vulnerability Disclosure Using Two Zammad Zero-Days — Root Access in Seconds, Agentic Speed Described as “Due to the Agentic Part of This Hack”
Impact: CRITICAL (AI Security / Responsible Disclosure Irony) Victim: Dutch Institute for Vulnerability Disclosure (DIVD) — Netherlands-based volunteer organization responsible for finding software vulnerabilities and coordinating responsible disclosure to vendors; operates a help desk and disclosure management system using Zammad Attack Date: September 21, 2026 Attack Type: Agentic AI-powered autonomous attack exploiting two zero-day vulnerabilities in Zammad (open-source help desk and customer support ticketing system) CVEs: Two previously undisclosed Zammad zero-days (CVE identifiers not confirmed in sources reviewed at publication) Chain Result: Session hijacking → remote code execution → privilege escalation from Zammad user to root — achieved “in seconds” DIVD Quote: “Used together, [the two Zammad zero-days] allowed the attackers to hijack sessions, run code remotely and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack.”Summary
On September 21, 2026, the Dutch Institute for Vulnerability Disclosure — the volunteer organization that discovers software vulnerabilities and coordinates responsible disclosure to protect the global internet — was itself breached by a zero-day-based agentic AI attack. The attack exploited two previously unknown vulnerabilities in Zammad, the open-source help desk software DIVD uses to manage its vulnerability disclosure operations, chaining them to achieve root access in a matter of seconds. The DIVD’s characterization of the attack is analytically important: they explicitly attributed the attack’s speed to the “agentic part of this hack.” The two Zammad zero-days, used together, created a chain from unauthenticated access to root in seconds — a timeline that DIVD assessed was enabled by the autonomous, machine-speed execution of an AI agent rather than a human attacker manually operating each exploit step. The operational irony is profound. DIVD exists specifically to find and disclose software vulnerabilities so vendors can patch them before attackers exploit them. DIVD’s disclosure operations had previously found vulnerabilities in Zammad — coordinating patch releases with the Zammad team. Being attacked through new, undisclosed Zammad zero-days using the very ticketing system that manages vulnerability disclosures demonstrates that even organizations with exceptional security awareness and technical sophistication can be compromised when attackers have zero-day capabilities and machine-speed execution. The DIVD breach adds another entry to the growing 2026 catalog of AI-agent-executed attacks: OpenAI’s ExploitGym Hugging Face breach (July), OpenAI agents’ GemStuffer RubyGems supply chain attack (September), the AI-assisted enterprise ransomware in under 10 hours (Unit 42, September), and now an agentic attack that achieved root on a vulnerability disclosure organization’s ticketing system in seconds via zero-days. What the attacker accessed: DIVD has not fully disclosed what data or systems were accessible from the compromised Zammad instance. Given Zammad’s role as DIVD’s vulnerability disclosure management system, the potential accessed data could include information about vulnerabilities DIVD has discovered but not yet publicly disclosed — pre-disclosure vulnerability intelligence that would be valuable to any threat actor seeking to exploit systems before vendors patch them.Comprehensive Action Steps
- Zammad Users — Emergency Patch Assessment: Contact Zammad for details on the two zero-day vulnerabilities exploited in the DIVD breach. Apply any emergency patches immediately.
- Vulnerability Disclosure Organizations: Any organization managing pre-disclosure vulnerability intelligence should audit access controls and session management for their disclosure management platforms. The DIVD breach demonstrates that the platforms managing undisclosed vulnerabilities are themselves high-value attack targets.
- Agentic Attack Response Planning: AI agents can chain multiple exploit steps and achieve full system compromise in seconds — a speed that human incident response processes cannot match at detection time. Behavioral monitoring at the point of initial exploitation (not just post-compromise indicators) is required to catch agentic attack chains before they complete.
- Open-Source Help Desk Platform Audit: Zammad is one of several widely deployed open-source help desk platforms. Organizations using Zammad, Osticket, Freshdesk, or similar platforms should review their session management and input validation configurations for the vulnerability classes exploited in this attack.
Key Takeaways
- The organization whose mission is responsible vulnerability disclosure was breached via zero-days — there is no “too security-aware to be compromised”
- Agentic attack speed (root in seconds) is DIVD’s own characterization of why the machine-speed execution was distinctive
- Zammad is the attack vector: two zero-days chained for session hijack → RCE → root escalation
- Pre-disclosure vulnerability intelligence may have been accessible from the compromised Zammad instance
- This is the fifth documented case of AI-agent-powered attacks against real-world third-party infrastructure in 2026
Story 4: Bitget Confirms $351.6–$387 Million North Korean Crypto Heist — Backend Compromise Drains Hot and Warm Wallets in Largest Breach in Exchange’s History
Impact: CRITICAL Victim: Bitget — global cryptocurrency exchange Attacker: Suspected North Korean threat actors (Bitget’s own characterization) Amount Stolen: $351.6 million (Bitget’s stated figure); $387 million (The Hacker News THN weekly recap figure — discrepancy may reflect different valuation timing) Compromise: Backend systems; hot and warm wallet access obtained Bitget Statement: “The most significant security breach in the exchange’s history” Status: Bitget resumed Bitcoin withdrawals in phases as of September 29Summary
Cryptocurrency exchange Bitget confirmed that suspected North Korean threat actors compromised its backend systems and obtained access to both hot wallets (internet-connected for daily transactions) and warm wallets (partially connected, used for regular but less frequent operations), stealing between $351.6 million and $387 million in what the company described as the most significant security breach in its history. Hot and warm wallet compromise, rather than cold storage breach, is consistent with North Korean cryptocurrency theft operations. The Lazarus Group and associated North Korean APT subgroups (including Sapphire Sleet, which stole $351.6 million from Bybit in a similar backend attack in 2025) are the most prolific cryptocurrency thieves in the world — responsible for more than $3 billion in crypto theft since 2017 according to blockchain analytics firms. Bitget’s decision to resume Bitcoin withdrawals in phases indicates the exchange has restored sufficient operational security to allow resumption, but the timeline and method of backend compromise have not been fully disclosed publicly. North Korean cryptocurrency theft operations fund the country’s nuclear and ballistic missile programs — a direct linkage between the heist and state-sponsored weapons development that has been documented by the US government and UN Security Council. Fact-check on amount: The $351.6 million figure comes from Bitget’s own SEC-equivalent disclosure; the $387 million figure appears in The Hacker News weekly recap and may reflect different valuation timing or include additional asset categories. Both figures are reported with appropriate sourcing. Key Actions:- Bitget users should monitor accounts for any unauthorized activity and verify wallet balances through official Bitget channels
- Organizations with cryptocurrency custody responsibilities should review hot and warm wallet security architectures, particularly access controls on backend administration systems that can authorize wallet operations
Story 5: ShinyHunters Hacks Clop — Defaced Clop’s Dark Web Leak Site Through Unpatched Grav CMS Vulnerability, Clop Relocates to New Tor Address
Impact: HIGH (Criminal-on-Criminal Attack / Strategic Intelligence) Attacker: ShinyHunters Target: Clop ransomware gang — one of the most prolific and financially destructive ransomware operations of the past five years Method: Exploited an unpatched path traversal vulnerability in Grav CMS (CVE-2026-42608 — unauthenticated path traversal) to compromise and deface Clop’s dark web data leak site Result: Clop’s data leak site defaced; Clop moved its site to a new Tor address Significance: The ransomware group that exploited MOVEit (100M+ victims), GoAnywhere, Cleo, and PTC Windchill was itself pwned through an unpatched CMS vulnerabilitySummary
ShinyHunters compromised Clop’s dark web leak site by exploiting CVE-2026-42608, a path traversal vulnerability assessed as unauthenticated in the Grav content management system that powers Clop’s victim data publication platform. Clop — among the most technically sophisticated and operationally prolific ransomware groups of the past five years — was running an unpatched CMS for its own infrastructure. The defacement of Clop’s leak site by ShinyHunters represents a strategic intelligence opportunity: criminal groups targeting each other’s infrastructure creates windows where victimized groups’ internal data, victim lists, and operational details may be accessible to the attacker. Whether ShinyHunters exfiltrated any of Clop’s internal operational data — victim communications, ransom negotiation histories, unpublished breach data — before or during the defacement is not confirmed in available reporting. Clop responded by moving its entire dark web operation to a new Tor address — standard operational security practice after infrastructure compromise, analogous to how law enforcement disruptions force ransomware groups to reestablish under new identities or addresses. The irony is notable: Clop’s mass exploitation of the PTC Windchill vulnerability (CVE-2026-12569, covered in our July 31 and August 28 roundups) was enabled by the fact that thousands of organizations hadn’t patched a known vulnerability. Clop itself then failed to patch a known CMS vulnerability in its own infrastructure, enabling its own compromise by a criminal competitor. Key Actions:- Security teams monitoring Clop’s leak site for victim notification should update their bookmarked Tor address to the new one Clop has published
- This attack does not eliminate any pending Clop extortion obligations for victim organizations — ransomware group infrastructure disruption rarely terminates active extortion campaigns
Story 6: Oracle PeopleSoft Mass Exploitation Continues — Google Warns of Renewed Campaign Bypassing WAFs to Deploy Web Shells
Impact: HIGH Product: Oracle PeopleSoft — continued exploitation from the CVE-2026-35273 (CVSS 9.8) ShinyHunters zero-day campaign first covered in our June 19 roundup New Development (September 26, 2026): Google warning of “renewed mass exploitation” with attackers now specifically bypassing web application firewall protections to deploy web shells across multiple sectors globally Sectors Targeted: Multiple (per Google) Prior Coverage: Covered in our June 19, July 31, and August 28 roundups — University of Nottingham, Nissan, McKesson, and 100+ organizations confirmed victimsSummary
Google warned this week of renewed mass exploitation of the Oracle PeopleSoft vulnerability originally disclosed in June 2026 (CVE-2026-35273, CVSS 9.8, unauthenticated RCE in the Environment Management Hub). The new development: attackers are now specifically engineering their exploitation to bypass web application firewall protections that many organizations implemented as compensating controls when patching was delayed. WAF bypass as an escalation technique reflects the intelligence attackers gathered from the June-July campaign: they identified which defensive controls were most commonly deployed as compensating controls and adapted their attack payloads to circumvent those specific filters. Organizations that believed WAF rules were protecting their unpatched PeopleSoft deployments may now find those protections have been defeated. The continued multi-month exploitation window of CVE-2026-35273 — now extending into late September 2026, more than three months after the original zero-day was disclosed — reflects both the scale of unpatched PeopleSoft deployments globally and the sustained attacker interest in the data those systems hold (payroll, HR, student records, financial data, employee medical information). Key Actions:- Any organization that has not yet patched CVE-2026-35273 must do so immediately — compensating WAF controls are now confirmed as bypassable by the active exploitation campaigns
- Organizations that applied WAF rules and assumed they were protected should treat their PeopleSoft deployments as exposed and begin a fresh compromise assessment
- Search for README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT in PeopleSoft directories — presence confirms compromise
Story 7: AI Coding Agents Leak 13,000 Internal Company Screenshots to Public GitHub Repositories
Impact: HIGH Disclosure: September 30, 2026 Incident: AI coding agents leaked approximately 13,000 internal company screenshots — including potentially sensitive operational, interface, and business content — to public GitHub repositories during their operationSummary
Security researchers disclosed September 30 that AI coding agents had leaked approximately 13,000 internal company screenshots to public GitHub repositories. The leaked screenshots represent sensitive operational content that AI agents captured while performing coding and development tasks — screen captures that would normally remain within the organization’s controlled environment were stored in or uploaded to public repositories as part of the agents’ workflow, making them publicly accessible. This incident is distinct from the agentic attack scenarios documented elsewhere in 2026’s roundups. Rather than an AI agent conducting an offensive operation, this is AI coding agents causing inadvertent data exposure through their normal operation — capturing screenshots during task execution and writing them to repositories that were configured as public rather than private. The incident illustrates a category of AI security risk that differs from intentional attacks: AI agents operating in complex workflows with multiple data inputs and outputs can leak sensitive information through unexpected data flows when not explicitly constrained in what they may share and where they may share it. An AI agent that captures screenshots to document its work, then commits those screenshots to a repository, is performing each individual action as intended — the combination of actions produces an unintended security outcome. Key Actions:- Audit all GitHub repositories — public and private — associated with AI coding agent workflows for unexpected screenshot or image content
- Configure AI coding agent runtime environments with explicit controls on what content may be committed to repositories, particularly distinguishing between internal development repositories and public-facing repos
- Review AI agent workflow permissions: agents should not have write access to public repositories unless that access is explicitly required and audited
Story 8: 16-Year-Old Suspected KillSec Ransomware Leader Arrested
Impact: HIGH (Law Enforcement / Deterrence) Arrested: October 1, 2026 Suspect: 16-year-old (minor — identity not disclosed) Alleged Role: Suspected leader of the KillSec ransomware group Significance: One of the youngest alleged ransomware operation leaders arrested in a documented law enforcement actionSummary
Law enforcement arrested a 16-year-old suspected of being the leader of the KillSec ransomware operation on October 1, 2026. The suspect’s identity was not disclosed given their minor status. KillSec has claimed multiple victims across healthcare, technology, and government sectors during its operational period. The arrest of a minor as a suspected ransomware leadership figure reflects a pattern observed in multiple 2026 cybercrime cases: younger offenders are being recruited into or ascending to leadership roles within ransomware and cybercrime operations, drawn by the significant financial rewards and relatively low perceived personal risk before law enforcement action. The Scattered Spider TfL attackers sentenced in our July 31 roundup (Owen Flowers, 18, and Thalha Jubair, 20) demonstrate the same pattern — young individuals with sophisticated technical skills recruited into or leading high-impact cybercrime operations. Key Actions:- Integrate KillSec IOCs from prior CISA advisories into SIEM platforms
- Monitor KillSec’s dark web leak site for activity changes following the leadership arrest
- Healthcare and technology organizations previously targeted by KillSec should maintain heightened incident monitoring in case remaining members escalate operations
Story 9: US Soldier Sentenced to 70 Months for AT&T and Verizon Extortion Scheme
Impact: HIGH (Law Enforcement) Sentencing Date: September 25, 2026 Source: Krebs on Security, Schneier on Security Crime: Extortion scheme targeting AT&T and Verizon — stealing customer data and demanding payment under threat of public release Sentence: 70 months in federal prisonSummary
A US Army soldier was sentenced to 70 months in federal prison on September 25 for an extortion scheme targeting two of the largest US telecommunications companies, AT&T and Verizon, by stealing customer data and threatening to release it unless paid. The case was covered by Krebs on Security and Schneier on Security on September 25. The case adds an unusual dimension to the 2026 insider threat landscape: an active-duty military service member exploiting access or knowledge obtained through their position to conduct cybercrime against major commercial enterprises. The 70-month sentence — consistent with other federal cybercrime sentencing this year (the ransomware negotiator’s 70 months in our July 10 roundup, Ransom Cartel’s Silnikau 16 years in our August 7 roundup) — reflects the federal judiciary’s consistent approach to cybercrime sentencing at meaningful deterrence levels. The case is also relevant context for the DMDC breach: military personnel with access to DoD systems represent an insider threat vector independent of external nation-state actors, and the DMDC breach’s attribution (or lack thereof) must include the possibility of insider access as one explanation for nine months of undetected access. Sources: Krebs on Security (September 25, 2026), Schneier on SecurityStory 10: Additional Critical Incidents — Storm-3168 Azure Destruction, Warlock Ransomware Spanish/Portuguese Orgs, GitHub Actions Supply Chain Resurgence, Check Point KEV Deadline Expired
Impact: HIGH (Collective)Storm-3168 — AI-Automated Azure Resource Destruction via Compromised Service Principals
Microsoft’s Security Blog documented Storm-3168 on September 25 — a threat group using AI-assisted automation to conduct large-scale Azure resource destruction by compromising service principal credentials. Storm-3168 abuses legitimate Azure automation capabilities (Logic Apps, Azure Functions, Runbooks) to execute destructive operations at machine speed using AI to orchestrate attack sequences across cloud tenant boundaries. The confirmed impact includes destruction of Azure resources at organizations whose service principals were compromised — cloud sabotage rather than data theft. Organizations using Azure should audit service principal permissions and activity logs for unexpected resource modifications or deletions.Warlock Ransomware — Targeting Large Spanish and Portuguese Organizations
Dark Reading reported October 1 that Warlock ransomware is targeting large organizations in Spain and Portugal. Warlock (linked to the Storm-2603 cluster, covered in our August 28 and September 11 roundups’ Colt Technology coverage) is expanding its geographic targeting beyond its prior UK/US focus. Spanish and Portuguese organizations in finance, manufacturing, and professional services should treat Warlock as an active regional threat. Apply all available SharePoint patches given Warlock’s documented use of SharePoint exploitation as an initial access vector.GitHub Actions Mini Shai-Hulud Malware — Compromised Actions Resume Activity
WIU Cybersecurity Center reported September 25 that two GitHub Actions (actions-cool repositories) were re-enabled and resumed executing the Mini Shai-Hulud malware — months after being disabled following the original May 2026 campaign detection. The re-enablement reflects a pattern of compromised supply chain components being temporarily disabled and later resuming malicious activity. Organizations using GitHub Actions should audit active Actions in their workflows against the known-compromised actions-cool repositories and verify that removed supply chain attack components have not been re-introduced.JetBrains TeamCity CVE-2026-63077 — CISA Confirms Ransomware Gang Exploitation
CISA confirmed this week that ransomware gangs are exploiting the critical JetBrains TeamCity vulnerability (CVE-2026-63077, CVSS 9.8) previously covered in our August 7 roundup. Which specific ransomware group is behind the exploitation has not been disclosed. Organizations that have not patched TeamCity to versions 2025.11.7 or 2026.1.3 face confirmed ransomware exploitation risk.Check Point CVE-2026-93616 (CVSS 9.8) and F5 BIG-IP CVE-2026-94127 — CISA Deadlines Expired
CISA’s September 25 deadline for Check Point Security Management Server CVE-2026-93616 (CVSS 9.8) and F5 BIG-IP APM CVE-2026-94127 has expired. Both are actively exploited. Patches must be applied immediately. The expiration of these deadlines represents the third consecutive week where multiple CISA KEV remediation deadlines have expired without confirmed universal remediation — the pace of critical vulnerability exploitation in 2026 has outrun organizational patch deployment velocity.AI Coding Agent Leaked Internal Company Screenshots — Follow-On Action
The September 30 disclosure of 13,000 internal screenshots leaked to public GitHub repos by AI coding agents (covered in Story 7) prompted immediate responses from GitHub, which began automatic scanning for screenshots in repository contents and flagging public repositories with content matching known internal screenshot patterns. Organizations should also review their GitHub repository visibility settings for any AI coding agent-associated repos. Sources: Microsoft Security Blog (September 25, 2026), Dark Reading (October 1, 2026), WIU Cybersecurity Center, CISA KEV catalog, The Hacker News weekly recap (September 29)Cross-Story Themes and Strategic Analysis
Week of September 25 – October 2, 2026 Assessment
Dominant Patterns:- AI Agents Are Now Confirmed Attackers in Production Environments Across Multiple Attack Classes — and the Speed Advantage Is Decisive: The DIVD breach via Zammad zero-days achieved root in seconds. The agentic enterprise ransomware compromise in under 10 hours (Unit 42, last week). The GemStuffer RubyGems supply chain attack using RubyDoc as execution infrastructure. Storm-3168’s AI-automated Azure resource destruction. In every case, the “agentic part” — as DIVD explicitly characterized it — is what makes the attack decisively fast enough to outpace human response. The defensive implication: human-speed detection and response cannot catch AI-speed attacks. Automated detection triggering automated response is now a minimum viable defensive architecture, not an aspirational goal.
- Critical Network Perimeter Products Are Being Exploited as Zero-Days Faster Than the Industry Can Respond: Citrix NetScaler CVE-2026-88771 (default configuration) was exploited for weeks before Citrix disclosed it. This is not an isolated case in 2026 — it follows Cisco ISE (CVE-2026-76460, covered September 18), Cisco FMC (CVE-2026-20079, covered September 11), SonicWall SMA (CVE-2026-15409, covered July 31), and Ivanti from earlier in the year. Every major network security and remote access vendor has experienced critical zero-day exploitation with multi-week pre-disclosure windows. The industry response — waiting for vendor patches and CISA KEV notifications — is structurally insufficient. watchTowr’s September 26 client warning (24 hours before Citrix assigned CVE IDs) demonstrates that threat intelligence capabilities that can detect pre-disclosure exploitation exist; organizations must access them.
- Criminal Infrastructure Has No Immunity From the Same Vulnerabilities It Exploits: ShinyHunters compromised Clop through an unpatched CMS vulnerability. The irony is deliberate in its framing here, but the security principle is universal: any organization — criminal or legitimate — that fails to patch known vulnerabilities is vulnerable. The criminal ecosystem’s use of commercial CMS platforms, cloud infrastructure, and open-source tooling means it inherits those platforms’ security vulnerabilities.
- Military and Government Personnel Data Continues to Accumulate in Compromise Scenarios: The DMDC breach (3 million records), the prior Salt Typhoon telecom campaign (senior government officials’ call records, 2024), and the continuing pattern of federal agency third-party breaches establish a comprehensive and growing dossier of US government personnel data in the hands of unknown actors. The counterintelligence implications compound over time as disparate datasets can be correlated.
- The Patch-Deployment Gap Is Getting People Compromised Every Single Week: Oracle PeopleSoft CVE-2026-35273 (patched June 17) is now being exploited with WAF bypass techniques in late September — three months after the patch. JetBrains TeamCity CVE-2026-63077 (patched July 27) is now confirmed in ransomware attacks. Check Point CVE-2026-93616 and F5 CVE-2026-94127 deadlines have expired. Citrix CVE-2026-88771 was exploited as a zero-day before any patch. Every week, some combination of the same problems: zero-day exploited before patch, or known vulnerability still unpatched months later. Both problems have different solutions (intelligence-driven pre-disclosure defenses for the former; automated patch deployment for the latter) and both are consistently failing at scale.
Strategic Imperatives for Security Leaders
- Pre-Disclosure Threat Intelligence Is Now a Mandatory Capability for Critical Network Infrastructure: watchTowr alerted clients to active Citrix exploitation 24 hours before CVE IDs existed. CISA and Mandiant assessed Citrix exploitation began in early September — weeks before disclosure. Organizations whose security posture begins with CVE publication are structurally late. For any critical network security product (VPN gateways, ADC/WAF appliances, firewall management consoles, NAC platforms), pre-disclosure threat intelligence monitoring must be part of the security program.
- Agentic Attack Response Planning Is No Longer Optional: The DIVD breach (root in seconds), the Unit 42 enterprise compromise (under 10 hours), and Storm-3168 (automated Azure destruction) all demonstrate that AI-speed attacks require automated defensive responses. Define in advance what automated actions your security infrastructure should take when: an initial exploit attempt is detected on a critical network boundary device; a cloud service principal begins making anomalous API calls at machine speed; an endpoint begins exhibiting lateral movement patterns. Human approval workflows cannot interrupt machine-speed attacks in time.
- Compensating Controls Are Not Equivalent to Patches: The Oracle PeopleSoft WAF bypass campaign specifically targeted organizations that deployed WAF rules as compensating controls instead of patching CVE-2026-35273. Compensating controls are interim measures that reduce but do not eliminate exposure — the Citrix CVE-2026-88771 situation similarly has no workaround. Security programs must build emergency patch deployment capability that treats CVSS 9.0+ vulnerabilities in internet-facing security infrastructure as requiring completion within 24-48 hours, not the next maintenance window.
- Service Principal and Cloud Identity Security Is a Tier-1 Priority: Storm-3168’s Azure resource destruction campaign exploits compromised service principals — non-human identities with potentially broad cloud permissions. Cloud identity governance must include: service principal privilege minimization; behavioral anomaly detection for service principal API calls; and automated revocation triggers for service principals exhibiting patterns inconsistent with their operational purpose.
- Military and Government Personnel With Sensitive Role Data Need Proactive Counterintelligence Support: The DMDC breach’s inclusion of military occupational specialty codes means affected personnel are now identifiable targets for foreign intelligence recruitment, extortion, and social engineering tailored to their specific military roles. DoD should provide proactive counterintelligence briefings to the most sensitive role categories in the affected population, not simply rely on individuals to protect themselves from sophisticated foreign intelligence targeting.
Stay informed on the latest cybersecurity developments by following ITBriefcase.net for daily updates and in-depth analysis.
