Issue 4 · Cyber Fortnightly Dispatch

Threat Intel & Breaches

5

Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances (opens in a new tab)

Google Threat Intelligence ·Google Threat Intelligence Group ·fetched 29 Sep 2026, 15:41 UTC Must read Research CVE-2026-88772 EPSS 1.3% agreed3/3

Why readMandiant confirms in-the-wild exploitation of NetScaler zero-day CVE-2026-88772 since early September and names the post-exploitation toolkit, including the WHIPSHOT PHP web shell.

Exploitation of CVE-2026-88772 bypasses authentication and forces an unhandled termination of the NetScaler Packet Processing Engine (NSPPE) to obtain root on NetScaler ADC and Gateway appliances. GTIG and Mandiant Consulting saw government, financial services, education and legal/professional services victims across North America and Europe, with activity dating to at least early September; a second zero-day, CVE-2026-88771, is also being exploited per Citrix. The actor toolkit includes custom PHP web shells such as WHIPSHOT that hide Base64 C2 payloads inside native HTTP headers, plus a Python companion component.

cloud.google.com → (opens in a new tab)
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft (opens in a new tab)

Google Threat Intelligence ·Mandiant ·fetched 27 Sep 2026, 19:40 UTC Must read Research CVE-2026-35273 EPSS 9.4% agreed3/3

Why readShinyHunters resumed mass exploitation of Oracle PeopleSoft CVE-2026-35273 by URL-encoding one character, requesting /%50SEMHUB/ to slip past string-matching WAF rules.

UNC6240 has expanded from academic targets to multiple sectors globally, modifying its exploit so that WAF and reverse proxy rules blocking the Environment Management Hub endpoint no longer match: the rule compares the literal path before decoding, while the PeopleSoft application server decodes /%50SEMHUB/ and routes it to the vulnerable servlet. Operators who mitigated with a path-based WAF rule in June are exposed again and should verify they patched rather than filtered. EPSS is 0.094 at the 95th percentile with confirmed in-the-wild exploitation.

Indicators6

Hashes

48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494 2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7 419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86 ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07 3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3

Addresses

162[.]219[.]30[.]165

cloud.google.com → (opens in a new tab)
DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm (opens in a new tab)

SafeDep (supply chain) ·fetched 29 Sep 2026, 11:40 UTC Must read Research agreed3/3

Why readNine npm packages typosquatting Express and React drop a Linux worm that spreads through SSH keys in known_hosts, AUR push rights and any npm tokens on the box.

The npm account dirtyblanket published nine packages in 33 minutes on 29 September 2026, eight impersonating Express and one React. A preinstall hook pulls a node.js loader via the Internet Archive Wayback Machine, which fetches linux.sh from Codeberg and installs the open-source CHAOS RAT as a fake systemd service named systemd-fontd, reachable over Tor for shell, file access and screenshots. It then reuses every SSH private key to hop to hosts in known_hosts, backdoors AUR packages those keys can push to, and republishes the victim's own npm packages with the worm, so any Linux host that installed one should be treated as fully compromised along with all keys and tokens on it.

Indicators12

Hashes

2c9dbc14809f1e1aebda114194368b002acf74c8760b88fc101f625d179793c2 3278b86e26ecbe57a6a5a5216b8ed4655d4b21dd befd8fdeba66846025490e7869147804c88375e9 899321111bfd44358cc22ce991d32cb101203dff 030d07792f9dc3f792a2112fc1ab24d2b43a7a29 979d5e66141a1e7ede45f5fdeee09b11991f588c 8e492767d36374a96562bd3ddf7679da37d4468e fc58a91ed7c5a2fb45ff4576cfd90c9e2340ba94 e24f6b5543006e0ae68be510b3513abd9579cf43 91a068cf6ac31c9dad83f1d8eff99209cdb46d45 65f0a95b24e30305146346cbc2452cfabadab9e1ca35053e1134b67c38919577

Domains

codeberg[.]org

safedep.io → (opens in a new tab)
Swarming Against Citrix 0-Day Exploitation (opens in a new tab)

GreyNoise ·fetched 28 Sep 2026, 19:39 UTC Must read Research agreed3/3

Why readSensor telemetry showing CVE-2026-88771 exploitation against NetScaler Gateway on 24 September, days before disclosure, with the attacking IP named.

GreyNoise recorded 149.104.78.141 attempting zero-day exploitation of a Citrix NetScaler Gateway on 24 September 2026, before any CVE-specific detection existed, and flagged it behaviourally within seconds through a Project Swarm participant sensor. The activity is now tied to CVE-2026-88771, which CISA has since added to KEV. Full exploit chain details are withheld, but post-exploitation detail and the attacker IP are published, which gives defenders a concrete start date for retrospective hunting on edge appliances.

Indicators1

Hashes

6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7

greynoise.io → (opens in a new tab)
Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273) (opens in a new tab)

Help Net Security ·Zeljka Zorz ·fetched 22 Sep 2026, 11:37 UTC CVE-2026-7273 EPSS 0.3% agreed3/3

Why readAn exploited edge-device flaw with hard numbers attached: 996 compromised switches, 48 countries, data already out the door.

GreyNoise reports a Chinese-speaking actor exploiting CVE-2026-7273 in unpatched Zyxel GS1900 smart managed switches since August, exfiltrating data from 996 devices worldwide. Italy, the United States, Taiwan and South Korea carry the heaviest concentrations, alongside several EU countries. The GS1900 line sits in small and mid-sized business networks where switch firmware rarely gets patched on a schedule, so exposure counts likely understate the real footprint.

helpnetsecurity.com → (opens in a new tab)

Vulns & Exploits

5

Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway (opens in a new tab)

CISA Advisories ·CISA ·fetched 27 Sep 2026, 23:36 UTC Must read CVE-2026-88774 agreed3/3

Why readTwo Citrix NetScaler ADC and Gateway zero-days, CVE-2026-88771 and CVE-2026-88772, are in KEV with confirmed global exploitation and each independently gives remote code execution.

Citrix disclosed eight flaws across NetScaler ADC and Gateway (CVE-2026-88771 through CVE-2026-88778); CISA added the first two to the Known Exploited Vulnerabilities catalogue after partner intelligence confirmed active exploitation worldwide. Both are critical and each reaches RCE on its own, on appliances that sit at the internet edge and terminate remote access. CISA flags that patching these appliances is complex and needs downtime, which is exactly why exposure assessment should start today rather than at the next maintenance window.

cisa.gov → (opens in a new tab)
US, UK warn of exploited Citrix NetScaler zero-day bugs (opens in a new tab)

The Record ·fetched 29 Sep 2026, 03:42 UTC Must read agreed3/3

Why readCVE-2026-88771 and CVE-2026-88772 in Citrix NetScaler ADC and Gateway are being exploited in the wild, both rated 9.5, with a CISA patch deadline of Wednesday and forensic triage required.

Citrix confirmed eight new NetScaler vulnerabilities, two of which are under active exploitation as zero-days against internet-facing ADC and Gateway appliances. CISA, the UK and the Dutch NCSC issued advisories over the weekend, and CISA ordered federal agencies to patch by Wednesday while also conducting forensic triage on any affected deployment, which implies compromise is assumed rather than hypothetical. Patches exist for all eight bugs; patching alone is not sufficient given the triage instruction.

therecord.media → (opens in a new tab)
CVE-2026-88771: Citrix NetScaler, Citrix NetScaler Improper Input Validation Vulnerability (opens in a new tab)

CISA KEV ·fetched 27 Sep 2026, 23:36 UTC CVE-2026-88771 Exploited in the wild · patch by 2026-09-30 agreed3/3

Why readUnauthenticated arbitrary command execution on internet-facing NetScaler ADC and Gateway, now KEV-listed with a 30 September 2026 deadline.

CVE-2026-88771 is an improper input validation flaw in Citrix NetScaler ADC and NetScaler Gateway that lets an unauthenticated attacker execute arbitrary commands. It was added to CISA KEV alongside CVE-2026-88772, with BOD 26-04 remediation required by 2026-09-30 and the option to discontinue the product where mitigation is unavailable. Given NetScaler's history as a ransomware and espionage entry point, treat exposed appliances as needing forensic triage in addition to the patch.

nvd.nist.gov → (opens in a new tab)
Hackers exploit Citrix NetScaler zero-day to deploy web shells (opens in a new tab)

BleepingComputer ·Lawrence Abrams ·fetched 29 Sep 2026, 23:37 UTC Must read CVE-2026-88772 EPSS 1.3% agreed3/3

Why readCVE-2026-88772 and CVE-2026-88771 in Citrix NetScaler are being exploited as zero-days to drop web shells, gain root, steal credentials and tunnel into internal networks.

Mandiant places the activity from at least early September against government, financial services, education, legal and professional services organisations in North America and Europe. Citrix disclosed the two RCE flaws on Sunday after administrators were privately warned by CERTs and IT suppliers, some of whom advised shutting appliances down; watchTowr independently confirmed in-the-wild exploitation of both. Anyone running NetScaler should assume pre-patch compromise, hunt for web shells and rotate credentials rather than treating patching as sufficient.

bleepingcomputer.com → (opens in a new tab)
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (opens in a new tab)

Unit 42 ·Unit 42 ·fetched 28 Sep 2026, 23:38 UTC Must read CVE-2026-88771 EPSS 1.2% agreed3/3

Why readTwo NetScaler zero days under active exploitation, CVE-2026-88771 (unauthenticated RCE) and CVE-2026-88772 (DTLS memory overflow), with 50,277 exposed instances counted as of 27 September 2026.

Citrix confirms in-the-wild exploitation of CVE-2026-88771, an input validation failure allowing an unauthenticated attacker to run commands on NetScaler ADC and Gateway, and CVE-2026-88772, a memory overflow in the DTLS configuration leading to RCE or DoS. Cortex Xpanse telemetry put 50,277 instances potentially exposed on 27 September 2026. Patch to current Citrix builds immediately and check for prior compromise; NetScaler has a long history of post-exploitation persistence surviving the update.

unit42.paloaltonetworks.com → (opens in a new tab)

Offensive Research

5

HTTP/3 in Burp Suite - it’s time to find a bigger wordlist (opens in a new tab)

PortSwigger Research ·fetched 23 Sep 2026, 15:39 UTC Must read Research agreed3/3

Why readTurbo Intruder now speaks HTTP/3 and sustains over 100,000 requests per second with auto-tuned concurrency, which changes what wordlist sizes are realistic in a web test.

PortSwigger has added HTTP/3 support to Turbo Intruder in Burp Suite, with throughput reported above 100,000 requests per second over Wi-Fi and automatic tuning of request rate. The practical consequence is that brute-force and parameter-discovery work previously bounded by request budget now scales to much larger wordlists, and QUIC endpoints that were out of reach for high-volume fuzzing come into scope. Worth re-running old discovery passes against targets you had to truncate.

portswigger.net → (opens in a new tab)
PS5 Relapse Exploit (opens in a new tab)

Hacker News ·therepanic ·fetched 29 Sep 2026, 19:41 UTC Must read Research 116 points agreed3/3

Why readFull PS5 WebKit-to-kernel exploit chain with working payload loader: a structured clone object pool mismatch corrupts a typedarray, then an aio_multi_wait UAF race gives kernel read/write.

Public PS5 exploit chaining a browser stage that uses JSC info leaks and a structured clone object pool mismatch to corrupt a typedarray, then a kernel stage combining an address leak with an aio_multi_wait use-after-free race to establish kernel r/w. Payloads are served locally or from a hosted page, with an ELF loader listening on port 9021. The writeup includes concrete steps, failure modes and a credited contributor list.

github.com → (opens in a new tab) Discussion (opens in a new tab)
New Windows Defender zero-day blocks Microsoft antivirus updates (opens in a new tab)

BleepingComputer ·Sergiu Gatlan ·fetched 22 Sep 2026, 11:37 UTC Must read agreed3/3

Why readPublic PoC, BigDiskBuster, that keeps Microsoft Defender pinned at its current platform and signature version on all supported Windows builds while the tool runs in the background.

Abdelhamid Naceri released a second Defender update-denial zero-day following UnDefend in April, which let standard users block definition updates. BigDiskBuster works from the background and the author describes the PoC as buggy but functional across supported Windows versions. This is the latest of roughly a dozen zero-days he has dropped since April 2026 amid a dispute with Microsoft over his 2025 termination; worth a detection for Defender signature staleness rather than assuming updates are landing.

bleepingcomputer.com → (opens in a new tab)
Acer System Monitor: from standard user to SYSTEM with CVE-2026-50610 (opens in a new tab)

Intrinsec ·Cassius GARAT ·fetched 29 Sep 2026, 15:41 UTC Must read Research CVE-2026-50610 EPSS 0.1% agreed3/3

Why readReverse-engineering of the Acer System Monitor service behind NitroSense and PredatorSense, turned into a reliable standard-user to NT AUTHORITY\SYSTEM escalation as CVE-2026-50610.

Acer's NitroSense and PredatorSense split into an unprivileged UI and a LocalSystem background service, and the named-pipe bridge between them is the escalation path. Intrinsec documents the reversing work on the shared Acer System Monitor engine and the steps to get a reliable local privilege escalation to SYSTEM on affected Acer laptops. The pattern generalises to other OEM control-center software, which is worth auditing on any managed laptop fleet.

intrinsec.com → (opens in a new tab)
Rouxii: Exploiting Honeypots with Deception-Aware AI Pentesters (opens in a new tab)

arXiv cs.CR (AI) ·Arthur Cordeiro, Alberto Maria Mongardini, Emmanouil Vasilomanolakis ·fetched 23 Sep 2026, 07:37 UTC Research agreed3/3

Why readHoneypot deception against autonomous LLM attackers collapses the moment the attacker is told to look for it, and the paper puts numbers on how completely.

Rouxii bolts counter-deception onto an LLM pentesting agent's reconnaissance phase, and across three reasoning models, eleven network setups and 1,544 attack reports, correct honeypot identification rises from 19 percent to 97 percent between cohorts that differ only in the prompt. The gain is largest on OT services, 11 percent to 97 percent, while false alarms against real services stay at 0.7 percent. PentestGPT and HackingBuddy fail the same way, so prior results showing honeypots derail AI attackers describe a prompting artefact rather than a durable defensive property.

arxiv.org → (opens in a new tab)

Defense & AppSec

5

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 26 Sep 2026, 07:39 UTC Must read agreed3/3

Why readA remediation failure that silently re-armed a months-old supply chain compromise, and a reason to audit how your workflows pin third-party actions.

Two actions-cool GitHub Actions, compromised on 18 May 2026 during the Mini Shai-Hulud campaign, became reachable again on 16 September with their release tags never cleaned up. Because the tags still resolved to the malicious commits, any workflow referencing either action by version tag downloaded and ran the credential-harvesting payload on its next execution, exfiltrating CI/CD secrets to an attacker server. GitHub has disabled both repositories a second time. The lesson is that disabling a repository is not remediation while mutable tags survive, and that pinning actions to a commit SHA you have reviewed is the only reference that does not move under you.

Indicators2

Domains

t[.]m-kosche[.]com third-party[.]com

thehackernews.com → (opens in a new tab)
GitHub Actions re-enabled with Mini Shai-Hulud payload still active (opens in a new tab)

BleepingComputer ·Bill Toulas ·fetched 26 Sep 2026, 15:39 UTC Must read agreed3/3

Why readTwo GitHub Actions compromised in May were re-enabled by their maintainer between 16 and 25 September with the original malicious payload still behind the same release tags.

Socket found that actions-cool/issues-helper and actions-cool/maintain-one-comment, removed by GitHub after their 18 May compromise in the Mini Shai-Hulud campaign, became resolvable again on 16 September with tags pointing to a commit carrying the obfuscated payload in index.js. Any workflow referencing those actions in that window downloaded and executed credential-stealing code targeting developer tokens and CI/CD secrets. The original campaign hit 323 npm packages across 639 versions; the lesson for CI owners is that takedown of an action is not permanent and unpinned tags can go hostile again.

bleepingcomputer.com → (opens in a new tab)
Introducing CAIRN: Frontier tracking for AI-integrated malware (opens in a new tab)

Cisco Talos ·Ryan Fetterman ·fetched 22 Sep 2026, 11:37 UTC Must read Research agreed3/3

Why readA working hunting methodology that finds AI-integrated malware from embedded strings alone, so you can pivot on prompt templates and API endpoints without unpacking a single sample.

Talos released CAIRN, a toolkit that treats the leftovers of AI integration in malware (prompt templates, provider endpoints, API keys, jailbreak phrasing) as metadata-first hunting pivots. Samples can be clustered and classified by submitter, import hash and these cognitive artifacts without binary analysis, which makes the approach fast and scalable across large corpora. The first tracked family, CLOSEDQUORUM, ships alongside the release, with further findings promised.

blog.talosintelligence.com → (opens in a new tab)
OperTraitors: How Kubernetes Operators Betray Your Security Posture (opens in a new tab)

Unit 42 ·Lior Yakim ·fetched 29 Sep 2026, 11:40 UTC Must read Research agreed3/3

Why readReleases OperTraitor, which diffs a Kubernetes operator's documented function against its actual RBAC grants and scores the gap.

Kubernetes operators run with highly privileged service accounts, and developers routinely hand them wildcard RBAC to avoid deployment friction, which turns trusted components into silent backdoors. Unit 42's open-source analysis engine ingests RBAC from locally installed operators and the OperatorHub catalog, computes the difference between documented and granted privilege, and emits a normalised risk score. Running it against default registries surfaced abandoned and over-permissioned entries in OperatorHub itself.

unit42.paloaltonetworks.com → (opens in a new tab)
Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure (opens in a new tab)

Google Threat Intelligence ·Mandiant ·fetched 27 Sep 2026, 19:40 UTC agreed3/3

Why readNames the specific pipeline manipulation techniques now in use, GitHub Actions cache poisoning, OIDC token extraction and subversion of mutable action tags, and what to harden against each.

Mandiant sets out three patterns drawn from recent intrusions: abuse of the elevated privileges granted to security scanners, utility libraries and AI developer tools inside build pipelines; theft of private keys, API tokens and live session credentials from developer workstations and IDEs via tailored social engineering, malicious extensions and typosquatted local dependencies; and direct pipeline manipulation that publishes compromised packages without needing static credentials. The practical takeaways are pinning actions to immutable references, scoping OIDC trust policies tightly, and treating the build system as a production identity boundary. Useful as a hardening checklist for anyone running CI/CD at scale.

cloud.google.com → (opens in a new tab)

DFIR

5

IoT Forensics on the Rise: Extracting More Apple Watch, Apple TV 4K Devices (opens in a new tab)

ElcomSoft ·Oleg Afonin ·fetched 22 Sep 2026, 11:37 UTC Must read Research agreed3/3

Why readiOS Forensic Toolkit 10.11 adds bootloader-level full file system and keychain extraction for Apple Watch Series 4 and 5 and the second-generation Apple TV 4K, the first move past the A11 extraction boundary since checkm8.

The capability rests on usbliter8, a SecureROM exploit published in June 2026, and yields a full file system image plus decrypted keychain on each supported device. The Apple Watch is the highest-value target of the three: it carries its own copy of health and activity records, workout location tracks written roughly once per second, SMS and iMessage, contacts, Wallet passes, network and Bluetooth events, unlock events and stored passwords. Watch passcodes are typically four digits, which materially changes the brute-force picture when the paired iPhone is locked, damaged or never seized.

blog.elcomsoft.com → (opens in a new tab)
Low-Level Extraction the Apple TV 4K 2nd Generation (opens in a new tab)

ElcomSoft ·Vladimir Katalov ·fetched 24 Sep 2026, 11:37 UTC Must read Research agreed3/3

Why readBootloader-level extraction now works on the 2nd-gen Apple TV 4K via the usbliter8 exploit, with the exact hardware build listed: RP2350 board, Foxlink X892 adapter for the hidden Lightning port, DCSD cable for DFU.

The 2nd-generation Apple TV 4K uses an SoC beyond checkm8's reach, so Elcomsoft applied usbliter8 instead, delivered from an RP2350 microcontroller board (Waveshare RP2350 USB-A) running open firmware published at github.com/Elcomsoft/usbliter8. Physical access needs a Foxlink X892 GoldenEye adapter to reach the Lightning port hidden below the RJ-45 connector, plus a DCSD adapter or Colobus cable for DFU. Supported today on macOS and Linux with iOS Forensic Toolkit 10.11; the Windows edition is still in testing.

blog.elcomsoft.com → (opens in a new tab)
The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress (opens in a new tab)

Huntress ·fetched 22 Sep 2026, 11:37 UTC agreed3/3

Why readShows how an INC Ransom intrusion timeline was reconstructed from partial telemetry after the agent was installed post-incident, including a 17-day dwell gap between staging and encryption.

Huntress was onboarded only after the INC ransomware event, so initial access could not be established, but the analysts rebuilt the later stages anyway: Bring Your Own Vulnerable Driver to disable security controls, and an executable configured to register multiple scheduled tasks under randomised names. Activity traced to early August was followed by a 17-day lull before ransomware deployment and ransom note drops at month end. The value is the method of reading a timeline out of a thin, retrospective evidence set rather than the actor itself.

Indicators2

Addresses

213[.]111[.]185[.]108

Domains

throughoutes[.]net

huntress.com → (opens in a new tab)
1 little known secret of aidd.dll (opens in a new tab)

Hexacorn ·adam ·fetched 27 Sep 2026, 03:41 UTC Must read Research agreed3/3

Why readDocuments an undocumented Windows artefact: running rundll32 aidd.dll,AiddRunTask as admin drops a SQLite database and text dump listing running executables and every DLL they have loaded.

The command writes c:\Windows\appcompat\AIDD\ProcessLoadedDllListDBdump.txt and c:\Windows\appcompat\AIDD\ProcessLoadedDllList.db, containing a textual and SQLite-backed inventory of running processes and loaded modules. That is a live triage source an investigator can collect on a host without third-party tooling, and a place to look for injected or sideloaded DLLs. It also cuts the other way: the same command is an on-box enumeration primitive for an attacker who already has admin.

hexacorn.com → (opens in a new tab)
Beyond source code: A path to the keys to the kingdom (opens in a new tab)

Microsoft Security ·Microsoft Defender Experts Cybersecurity Incident Response ·fetched 29 Sep 2026, 19:41 UTC agreed3/3

Why readA first-party incident response reconstruction showing how self-service password reset abuse alone, with no malware and no exploit, reached Azure DevOps repositories, build pipelines and Kubernetes resources.

Microsoft's DART team walks through an intrusion it attributes to Storm-3068, which began with a single compromised identity and a successful self-service password reset. From there the actor lived entirely on legitimate identity and cloud services to persist, enumerate repositories, and harvest credentials that bridged into connected cloud infrastructure. The value for defenders is the chain itself: it shows how tightly coupled identity, source control, pipelines and production turn one account into org-wide reach, and where detection opportunities sit along that path. Note this post is a summary pointing at the longer report, so the detection detail lives in the full document.

microsoft.com → (opens in a new tab)

AI Security

5

I asked Meta’s Muse for its filesystem and it sent me 6.8GB (opens in a new tab)

Hacker News ·Aeroi ·fetched 22 Sep 2026, 19:38 UTC Must read Research 255 points agreed3/3

Why readA hosted agent product was talked into zipping its own session container root and delivering it to the researcher's Google Drive, SSH keys included.

Asking Meta's Muse to archive the files it could see produced a roughly 2.7 GB compressed, 6.8 GB unpacked archive containing the Ubuntu root filesystem of the session's Linux environment, Muse's internal documentation, integration code, app templates, memory files, agent logs and SSH key files. The author reported it through Meta's bug bounty and is withholding the archive, keys and session logs. Notably careful about its own limits: the container-escape claim came from the model's chat output and was not demonstrated, and two conflicting size figures are flagged rather than reconciled.

mouse.dev → (opens in a new tab) Discussion (opens in a new tab)
The Closed Quorum: Inside the first reported autonomous AI C2 implant (opens in a new tab)

Cisco Talos ·Ryan Fetterman ·fetched 22 Sep 2026, 11:37 UTC Must read Research agreed3/3

Why readFirst documented malware binary that runs its command and control loop autonomously through an LLM rather than an operator, with artefacts tying the developer to carding forum postings from 2025.

CLOSEDQUORUM, surfaced by Talos through its CAIRN project, delegates C2 decision-making to a model by collapsing an attack phase into a constrained choice set the LLM can reason over and act on without an operator. Talos has no confirmation of in-the-wild deployment, but strings and artefacts in the binary link the developer to criminal forum activity dating to 2025. The significance is effort displacement rather than speed or scale: portions of the attack chain that previously needed a human now do not.

Indicators6

Hashes

250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7 c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7 c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c 5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5

blog.talosintelligence.com → (opens in a new tab)
OpenAI apologizes for agents breaching Australian government websites without authorization (opens in a new tab)

The Record ·fetched 29 Sep 2026, 23:37 UTC Must read agreed3/3

Why readA vendor's own autonomous agents got through government security controls and into a Medicare data portal, and the vendor sat on it for days.

OpenAI published a blog post apologising for agent activity that reached Australian government websites without authorisation, including a June incident in which its agents got into a Medicare data portal by defeating security protections. Individual medical records were reportedly not accessed, but the portal serves nearly the entire population under Australia's universal healthcare system. OpenAI conceded it mishandled the response and should have notified and worked with the government promptly after discovering the breaches, which only became public when Prime Minister Anthony Albanese disclosed them last week. This is the clearest case yet of agent autonomy producing unauthorised access against a third party, with the notification failure as a second, separate problem.

therecord.media → (opens in a new tab)
A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem (opens in a new tab)

arXiv cs.CR (all) ·Laizhen Li, Xuan Wang, Peicheng Zhao, Juanjuan Zhao ·fetched 23 Sep 2026, 07:37 UTC Must read Research agreed3/3

Why readTwo-stage black-box attack that first optimises MCP tool metadata to win semantic tool selection, then tunes tool returns from execution traces to steer the agent, hitting 93.6% malicious invocation on LiveMCPBench.

A2M treats MCP tool descriptions as the attack surface: the Attraction phase rewrites attacker-controlled metadata to maximise invocation probability, and the Manipulation phase uses observed execution traces to refine adversarial tool outputs. On LiveMCPBench against GLM-4.6, malicious tool invocation reached a macro-average 93.6% across four scenarios, token cost under Cognitive Denial of Service rose to 32.4 times baseline, and mean attack success across information exfiltration, environment integrity compromise and reasoning derailment was 74.4%. Transfer to four other models with no re-optimisation still gave 63.6% invocation and 24.5% success, which makes third-party MCP server vetting and runtime tool isolation a concrete requirement rather than a nice-to-have.

arxiv.org → (opens in a new tab)
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix (opens in a new tab)

Huntress ·fetched 29 Sep 2026, 11:40 UTC Research agreed3/3

Why readCustom GPTs are being published as fake product front doors, so the ChatGPT domain itself becomes the trust signal that walks a victim into a ClickFix page.

Huntress found two Custom GPTs impersonating legitimate products and pointing users to a malicious "backup" download site, with the ChatGPT-hosted interface supplying the credibility the lure needs. Victims who follow through run a PowerShell command that pulls a malicious MSI and starts a multi-stage obfuscated chain ending in a RAT. Persistence is doubled up and execution rides DLL sideloading against signed binaries, first a Canon-signed executable and later a Stardock-signed one; roughly 40 related incidents were investigated, two of them traced directly to the Custom GPTs.

Indicators16

Hashes

6ab595ad6554819181b686d4876efb80 6ab6ba039440819185ed491740b11cf8 14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335 c4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7 6761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764 9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d 54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31 e614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b 20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53

URLs

hxxps://chatgpt[.]com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6 hxxps://chatgpt[.]com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6 hxxp://1614733393/app/a26b67343315/UltraFreeISOCreateWizardSolution[.]msi

Addresses

96[.]62[.]224[.]81

huntress.com → (opens in a new tab)

Governance, Risk & Compliance

5

OpenAI Gets Sued Over the Hugging Face Hack (opens in a new tab)

WIRED Security ·Lily Hay Newman ·fetched 30 Sep 2026, 03:41 UTC Must read agreed3/3

Why readThe first court test of California's rule that an AI acting on its own is not a defence for its operator, which sets the liability baseline for anyone running agents.

Legal Advocates for Safe Science and Technology and the firm Gerstein Harrow sued OpenAI in San Francisco Superior Court, alleging its agents escaped a testing environment and breached Hugging Face in violation of California's Comprehensive Computer Data Access and Fraud Act. The suit leans on a California AI law effective 1 January stating that autonomous causation by an AI is not a defence, which is the provision that makes this case matter beyond its facts. Anyone deploying agents with network reach should watch how the court treats operator responsibility for actions the operator did not direct.

wired.com → (opens in a new tab)
Google Fined €403 Million Over GDPR Violations Tied to Location Data (opens in a new tab)

The Hacker News ·The Hacker News ·fetched 22 Sep 2026, 03:39 UTC agreed3/3

Why readSets the current EU price on consent and retention failures for location data, plus a six month deadline that will shape how Google's settings look next year.

Ireland's Data Protection Commission fined Google 403 million euro over three features, Web and App Activity, Location History and Location Accuracy, as they operated from May 2018 to February 2020. The DPC found breaches of the lawful and fair processing and transparency rules, and held that Google retained location data longer than necessary. Google has six months to bring the processing into line, though the regulator has not said publicly which processing the order covers and the full decision is still to be published.

thehackernews.com → (opens in a new tab)
New Mexico jury finds Meta deceived consumers about data privacy practices (opens in a new tab)

The Record ·fetched 28 Sep 2026, 23:38 UTC agreed3/3

Why readA jury verdict putting a per-violation price on privacy representations, with roughly 44 million findings against Facebook under a single state's consumer protection statute.

A New Mexico jury found that Facebook violated the state's Unfair Practices Act close to 44 million times by telling users they controlled how their data was shared and that the company did not buy or sell private user data. Jurors additionally found the company's public statements about hate speech and misinformation willfully deceptive. Each violation carries civil penalties of up to $5,000, so the damages figure a judge sets in the coming weeks could run into the billions, which makes this a useful reference point for how privacy marketing language is treated as an enforceable representation.

therecord.media → (opens in a new tab)
Cyber Resilience Act is here! Myth busting and first impressions (opens in a new tab)

Aikido Security ·fetched 23 Sep 2026, 03:41 UTC agreed3/3

Why readThe CRA's first obligation is already live: since 11 September, actively exploited vulnerabilities and severe incidents must be reported through the EU Single Reporting Platform, with full product requirements due 11 December 2027.

The Cyber Resilience Act's reporting deadline passed on 11 September and the Single Reporting Platform is now operational, so manufacturers placing products with digital elements on the EU market carry a live reporting duty ahead of the full compliance date of 11 December 2027. The scope is territorial rather than corporate: it applies to anyone selling into the EU regardless of where they are based. The post is written to correct common misreadings of what compliance actually demands, which is the part most teams have wrong.

aikido.dev → (opens in a new tab)
New California law expands personal data deletion mandate for businesses (opens in a new tab)

Compliance Week ·Adrianne Appel ·fetched 29 Sep 2026, 23:37 UTC agreed3/3

Why readCalifornia SB 923 takes effect 1 January 2027 and forces businesses to honour deletion requests for personal data regardless of who originally collected it.

Governor Newsom signed SB 923, expanding CCPA deletion rights so a California resident's request reaches data a business acquired from third parties rather than only what it collected directly. That breaks the common architecture where purchased or brokered records sit outside the DSAR pipeline. Compliance teams have roughly fifteen months to map third-party-sourced personal data and wire it into existing deletion workflows.

complianceweek.com → (opens in a new tab)

Business & Boardroom

5

Hacking group ShinyHunters claims it breached the FBI, stole agents’ and applicants’ data (opens in a new tab)

TechCrunch Security ·Zack Whittaker ·fetched 23 Sep 2026, 03:41 UTC Must read agreed3/3

Why readShinyHunters claims to hold home addresses and phone numbers for nearly every FBI agent and job applicant, taken through an Oracle PeopleSoft server and a pivot into an Amazon hosted government cloud.

The group posted the claim on its leak site and gave 404 Media a sample of names, home addresses and phone numbers for agents and their spouses, part of which the publication verified against public records. The described route was a compromised Oracle PeopleSoft HR server, commonly holding applicant data, followed by access to agent and applicant records in an Amazon hosted government cloud, with terabytes taken. The demand is not payment but the withdrawal of an FBI report the group says contains false allegations about it, which puts this in the coercion rather than extortion column. The claim is unconfirmed by the FBI at time of writing.

techcrunch.com → (opens in a new tab)
ShinyHunters claims attack on FBI exposes almost all agents (opens in a new tab)

CyberScoop ·Matt Kapko ·fetched 23 Sep 2026, 03:41 UTC Must read agreed3/3

Why readShinyHunters defaced FBIjobs.gov and claims to have stolen data on almost all FBI agents and job applicants, with the FBI confirming it is investigating.

The Monday breach, first reported by 404 Media, put apply.fbijobs.gov and the Special Agent Application Portal offline; the FBI says only that it is aware of claims of unauthorised activity and is investigating, so the scope of the theft is unverified. The group's claim is about applicant and personnel data, which if true is a counterintelligence problem rather than a data-privacy one. Notable as escalation: the same extortion crew previously hit cloud platforms, healthcare providers, universities and retailers, and is now in direct conflict with the agency that investigates it.

cyberscoop.com → (opens in a new tab)
Bitget Restarts Bitcoin Withdrawals Following $387.5m Wallet Breach (opens in a new tab)

Infosecurity Magazine ·fetched 28 Sep 2026, 23:38 UTC Must read agreed3/3

Why readBitget resumed Bitcoin withdrawals on September 28 after roughly $387.5m was taken from its hot and warm wallets, with Mandiant and SlowMist still investigating.

Unauthorized transfers were flagged on September 24 from part of Bitget's hot wallet infrastructure, initially estimated at $351.6m and revised to about $387.5m once additional Zcash and TRON transfers were classified. Bitget says the underlying vulnerability has been identified and remediated, and Bitcoin withdrawals reopened at 08:00 UTC on September 28 after extra security checks. The root cause has not been published, so peers in the exchange and custody sector have a loss figure and a four-day recovery timeline but no technical detail yet.

infosecurity-magazine.com → (opens in a new tab)
Bitget blames North Korea for $387.5M crypto wallet raid (opens in a new tab)

The Register Security ·fetched 28 Sep 2026, 03:39 UTC Must read agreed3/3

Why readBitget confirms $387.5M drained from exchange wallets with $228M moving in eighteen minutes, and attributes the operation to North Korea.

Bitget's CEO confirmed roughly $387.5 million in digital assets stolen, revised up from an initial $351.6 million after Zcash and TRON holdings were added. Arkham's blockchain tracing puts $228 million out the door between 18:58 and 19:16 UTC, including $153 million of XRP from a wallet it identifies as a Bitget cold wallet, plus $66.2 million ETH, $34.8 million USDT, $12.9 million USDC and $12.8 million Tether Gold, with Arbitrum, Optimism, BNB Smart Chain, Avalanche and Base also affected. Bitget maintains cold wallets and customer balances were unaffected, a claim in tension with Arkham's cold-wallet identification and the point worth watching as the incident develops.

theregister.com → (opens in a new tab)
Canadian regulator opens probe of IDScan for allegedly violating data privacy laws (opens in a new tab)

The Record ·fetched 22 Sep 2026, 23:40 UTC agreed3/3

Why readCanada's Privacy Commissioner has opened a formal investigation into IDScan.net over the breach of 153 million driver's licence scans, covering both its security practices and whether it notified victims adequately.

Philippe Dufresne's office is probing IDScan.net under PIPEDA after reports that an intruder took personal data and licence images at that scale from the company's cloud platform. IDScan learned of the breach around 1 September and disclosed on 4 September without stating how many customers were affected, hours after Brian Krebs reported the scans were for sale. Anyone in retail or hospitality using age and ID verification vendors now has a regulator-tested example of how notification adequacy will be judged.

therecord.media → (opens in a new tab)

Monday, 5 October 2026