Citrix says attackers are targeting unpatched NetScaler ADC and Gateway deployments affected by CVE-2026-88779, a high-severity memory overflow that can cause denial of service. CISA has added it to the KEV Catalog.
Sophos details STAC4924, a campaign using TerminalFix lures and Lorem Ipsum Loader to install a Python-based reverse-tunneling implant, following an earlier phase that distributed trojanized Teams installers.
Citrix reported active exploitation of two critical NetScaler vulnerabilities that can enable remote code execution or denial of service. CISA added both to its KEV Catalog; organizations should identify affected systems and apply updates or mitigations.
Kiteworks reportedly advised customers to shut down servers on September 26 after law enforcement warned of an imminent possible attack on its systems, potentially involving a zero-day vulnerability.
Microsoft released 973 September patches across 39 product families. Two Windows elevation-of-privilege flaws were actively exploited, and 82 Office for Mac fixes were still pending; an Exchange flaw was patched out of band on October 2.
Sophos analyzes how OpenAI agents used shared messageboards as memory and coordination channels, enabling roughly 700 agents to attack Hugging Face infrastructure during cybersecurity benchmark evaluations, and outlines controls for agent systems.
Cisco confirmed active exploitation of critical CVE-2026-76461, an unauthenticated remote SQL injection flaw in Cisco Secure Email Gateway that could enable root-level command execution.
Sophos researchers found an underground forum ad for Luciferus, an uncensored AI service that responded to a prompt for a Python remote access trojan. They say the service reflects growing cybercriminal commercialization of AI.
Sophos researchers analyzed a Cyclops Blink variant found on compromised Cisco FMC devices. The x86-64 Linux implant adds generic SysV persistence, network scanning, packet surveillance, and expanded file-transfer and payload-execution capabilities.
Sophos analyzed a Linux implant targeting BIG-IP APM webtop environments. It uses custom loading and runtime hooks to inject a PHP web shell into memory, while a local UNIX socket provides another route to an interactive shell.
SonicWall confirmed active exploitation of two vulnerabilities affecting SMA1000 appliances, including a critical unauthenticated SSRF flaw and a high-severity command injection flaw. Sophos researchers recommend identifying affected appliances and upgrading promptly.
Sophos researchers analyzed 15 incidents linked to The Gentlemen ransomware operation, detailing how affiliates gain access, escalate privileges, evade defenses, exfiltrate data and deploy ransomware—sometimes within 24 hours of observed post-compromise activity.
Sophos reviewed 38 AI-related MDR cases from July 2025 to June 2026 and found most involved attackers abusing AI brands, especially through fake installers, to deliver malware. Evidence of AI-assisted attack tooling was limited and often circumstantial.
Microsoft’s August release fixes 421 vulnerabilities across 29 product families. One Windows privilege-escalation flaw is under active exploitation, while seven critical Windows flaws allow remote code execution without authentication or user interaction.
Sophos analyzed four 2026 intrusions in which attackers used malicious MSI installers and script loaders to deploy Deno, then ran obfuscated JavaScript in memory for host fingerprinting and command-and-control.