CyberWatch Newsroom Live Intel

Moderate Help Net Security

2026-10-01 Help Net Security

BlackFog adds prompt protection and governance for agentic AI

BlackFog has announced the launch of ADX Vision 2.0, expanding its AI security capabilities to help organizations govern and control the use of generative and agentic AI across the enterprise. As employees move from simply interacting with AI tools to deploying agents capable of making decisions and acting on corporate data, the security challenge for organi…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate CVE-2026-86950 The Hacker News

2026-10-01 The Hacker News

Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path

Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals. The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the m…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Important SANS Internet Storm Center

2026-10-01 SANS Internet Storm Center

ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)

Threat Actors do not always use top-notch techniques or very complex malware to perform their attacks. Sometimes, they just abuse of existing applications...

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Moderate Help Net Security

2026-10-01 Help Net Security

Many expect AI in the SOC to make entry jobs harder to get

A junior analyst in a security operations center, or SOC, has usually learned the job the slow way. You work the same phishing lure dozens of times, chase the same familiar malware pattern and write up the same case note at the end of the shift. Eventually you know what normal looks like, which is how you notice when something isn’t. AI tools handle a lot of…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical The Hacker News

2026-10-01 The Hacker News

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft

Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security products, citing ongoing investigation findings from SlowMist. "Their investigation identified malicious activity involving third-party security products, including a zero-day vulnerability, and recovered a…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate The Hacker News

2026-10-01 The Hacker News

MetaMask Security Incident Prompts Exit of Affected Ethereum Validators

MetaMask on Thursday said it's responding to what it described as an "ongoing security incident" impacting part of its infrastructure. "We are actively addressing and remediating the issue internally, in coordination with external partners and security advisors," the software cryptocurrency wallet maker said. "At this time, we have identified no immediate th…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Important Help Net Security

2026-10-01 Help Net Security

The vulnerabilities AI finds are the ones attackers want

Attackers exploited a flaw found by an AI research agent within four days of its public disclosure, and they are exploiting more vulnerabilities overall, according to new research by Google Threat Intelligence Group (GTIG). The researchers examined vulnerability disclosure and exploitation data from January 2025 to August 2026. Disclosures doubled, exploitat…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important The Hacker News

2026-10-01 The Hacker News

Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. LevelBlue's Threat Hunt Operations & Research (THOR) team, which analyzed the exploitation activity across multiple customer environments, said it i…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate Help Net Security

2026-10-01 Help Net Security

Employment scam victims tripled at financial firms in 21 countries

Reported victims of employment scams more than tripled over the past 12 months at more than 370 banks and other financial institutions in 21 countries. The 258% rise outran every other scam type, while total reported scams across the same institutions grew 35%. Scams by the numbers (Source: BioCatch) Researchers at BioCatch, a fraud-detection vendor, compile…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Critical Help Net Security

2026-10-01 Help Net Security

Google says Gemini 4 Argon can find and patch critical software flaws

Google announced Gemini 4 Argon, its new frontier AI model, and is rolling it out to a set of trusted cyber defenders through its Fairwind Program. Google says the model can locate critical software vulnerabilities, validate them, and patch them without human help, and it will release a version without cyber guardrails to those defenders and to its own inter…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-01 Help Net Security

Product showcase: Proton Drive end-to-end encrypted cloud storage

Proton Drive is an end-to-end encrypted cloud storage service for storing, synchronizing, backing up, and sharing files. It also includes Proton Docs and Proton Sheets, allowing users to create and collaborate on documents and spreadsheets within the same encrypted environment. Proton Drive is available through the web and dedicated apps for Windows, macOS, …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-01 Help Net Security

Google’s SynthID Bio can watermark AI-designed protein binders without breaking them

Google DeepMind has built SynthID Bio, a watermark for AI-designed proteins, and shown in wet-lab tests on protein binders that it leaves their function intact. The method hides a signature in the amino acid sequence of a designed protein and in the atomic coordinates of a predicted 3D structure. DeepMind says the signature can be checked on the physical pro…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate SANS Internet Storm Center

2026-10-01 SANS Internet Storm Center

ISC Stormcast For Thursday, October 1st, 2026 https://isc.sans.edu/podcastdetail/10118, (Thu, Oct 1st)

Latest threat intelligence analysis from SANS Internet Storm Center: ISC Stormcast For Thursday, October 1st, 2026 https://isc.sans.edu/podcastdetail/10118, (Thu, Oct 1st).

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Important The Record by Recorded Future

2026-09-30 The Record by Recorded Future

US sanctions 10 over ATM malware scheme tied to Tren de Aragua

Treasury’s Office of Foreign Assets Control (OFAC) targeted multiple Venezuelan nationals and several companies they control that are part of the effort to launder the money stolen from dozens of ATMs.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Moderate Dark Reading

2026-09-30 Dark Reading

Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure

In yet another ClickFix-style campaign, threat actors abuse legitimate domains from OpenAI and Google to fool unsuspecting users.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Moderate Dark Reading

2026-09-30 Dark Reading

Trump, Tech Giants Strike Voluntary AI Safety Accord

The new White House Accord on so-called "Super Intelligence" calls on companies to implement greater controls and oversight over AI safety.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory

Important BleepingComputer

2026-09-30 BleepingComputer

Russian state hackers use new RedFlick technique to push malware

The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed "RedFlick" to deploy its signature CosmicPulse backdoor. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate The Record by Recorded Future

2026-09-30 The Record by Recorded Future

Automakers routinely share personally identifiable connected-car data with third parties, report says

A new study reveals fresh details about how drivers are exposed to a web of large corporations participating in the advertising ecosystem.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Critical CVE-2026-88771 Palo Alto Unit 42

2026-09-30 Palo Alto Unit 42

Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)

Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) appeared first on Unit 42 .

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

APT Threat Hunting

Advisory

Critical BleepingComputer

2026-09-30 BleepingComputer

DIVD says Zammad zero-days enabled AI-driven network breach

The Dutch Institute for Vulnerability Disclosure (DIVD) says that the breach of its network was possible by exploiting a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate The Record by Recorded Future

2026-09-30 The Record by Recorded Future

After reports on suicide deaths, Pentagon puts Cyber Command on notice

An August 31 memo obtained by Recorded Future News shows that the Pentagon's assistant secretary for cyber policy made specific demands of U.S. Cyber Command leadership after reports of a cluster of suicide deaths.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Critical CVE-2026-86131 SecurityAffairs

2026-09-30 SecurityAffairs

WatchGuard fixes critical Fireware OS flaw allowing remote code execution

WatchGuard fixes 15 Fireware OS flaws, including a critical RCE bug that could give attackers root access to vulnerable Firebox appliances. WatchGuard has released security updates for Fireware OS that address 15 vulnerabilities , including a critical code injection flaw, tracked as CVE-2026-86131 (CVSS score of 9.2), that could allow an attacker to execute …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Important The Record by Recorded Future

2026-09-30 The Record by Recorded Future

Google: Vulnerability disclosures double to 10,000 per month as AI fuels exploitation

Vulnerability disclosures continue to skyrocket, doubling over the course of the year to more than 10,000 each month, Google researchers warned.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Moderate Dark Reading

2026-09-30 Dark Reading

As AI Reshapes the SOC Career Ladder, Satisfaction Rises for 91%, but Entry Gets Harder for Nearly Half

New Swimlane research underscores a paradox: While AI detection and response is essential to giving defenders an edge, one in four security pros say AI limits their skill development.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Infosec

Advisory