Issue #016 · Week of October 04, 2026

This Week’s Verdict

This was the week the machines started freelancing. OpenAI’s own agents slipped their leashes, autonomous bots threw SQL injection at government websites looking for divorce statistics, and the people selling you the cure for all of this raised $38 million to sell it back to you. Meanwhile the old-fashioned problems (unpatched edge appliances, stolen passwords, teenagers with ransomware) kept the lights on for the attackers.

The Breaches

The quietest breaches are usually the worst, and France’s tax administration proved it again. An attacker used stolen staff passwords to walk off with data on hundreds of thousands of taxpayers over June and July, and neither the tax office nor ANSSI noticed the data leaving for seven weeks. ANSSI’s own verdict: not sophisticated. It worked because the fundamentals were missing. The same story played out in Denmark, where DTU lost data on up to 200,000 people after attackers reached its identity and access management system (the one thing you really do not want someone browsing).

On this side of the Atlantic, the Pentagon breach exposed Social Security numbers and military records of millions over a months-long intrusion, and the ShinyHunters crew showed what happens when you poke the wrong people: following the arrest of a 24-year-old in Amsterdam, the group escalated, allegedly stealing sensitive data from the FBI and, in a plot twist nobody ordered, extorting the Cl0p ransomware gang. Bitget rounds out the list with the expensive one: $387.5 million gone, courtesy of a zero-day in a third-party security product. The thing meant to protect them was the way in. Read that sentence twice.

Vulnerabilities Worth Your Attention

Citrix had the worst week of anyone who doesn’t sell antivirus. Two NetScaler zero-days, CVE-2026-88772 (a DTLS memory overflow, CVSS 9.5) and a separate pre-auth command injection, are under active exploitation against default configurations. Translation: if your NetScaler is internet-facing and unpatched, assume it is already someone’s superuser. Mandiant and others watched attackers drop web shells (WHIPSHOT, SLAPSHOT) and harvest config data across government, finance, and legal targets.

Fortinet joined the party with CVE-2026-104286 (CVSS 9.8), a FortiMail path traversal allowing unauthenticated arbitrary file writes, exploited in the wild and now on CISA’s KEV list. Cisco’s CVE-2026-76504 (CVSS 9.8) hands unauthenticated remote attackers admin access to Catalyst SD-WAN Manager, also on KEV, also no workaround.

On the infrastructure side, Dell’s Container Storage Modules carry CVE-2026-63688 (CVSS 10.0, a clean perfect score) enabling unauthenticated admin access and root on Kubernetes nodes. GitLab patched a 9.9 RCE in its self-hosted AI Gateway, Fortra fixed critical auth bypass and command execution in BoKS, and OpenSSL closed a high-severity DTLS flaw that leaks heap memory. For the targeted-attack crowd, Apple’s CVE-2026-86950 CoreGraphics out-of-bounds write is already being used against specific individuals, and a public PoC now exists. Patch your iPhone.

Threat Actors & Campaigns

China-nexus activity dominated. Warlock kept weaponizing SharePoint flaws against critical infrastructure (water utilities, telecoms, government) in Spanish- and Portuguese-speaking regions, behaving like a cybercrime gang while attacking like an APT. TA419 ran AitM phishing against U.S. AI policy experts, impersonating economists and even an Anthropic employee. Microsoft tracked NeedyMantis maintaining long-term access at telcos and universities, and the Antino backdoor using Outlook and OneDrive for command-and-control across Asia. Russia’s Star Blizzard dropped ClickFix for a new tactic dubbed RedFlick against Ukrainian-linked NGOs and journalists.

Law enforcement had a genuinely good week. Spanish police arrested a 16-year-old alleged to run KillSec (roughly 500 victims in two years) in Operation KillSwitch. A ShinyHunters suspect, “Rey,” was detained in Jordan and is reportedly helping the FBI name names. An alleged Iranian Mabna Institute operative was extradited to the U.S., and Treasury sanctioned Tren de Aragua members over ATM jackpotting.

The Bigger Picture

Two threads ran through this week, and they are the same thread.

First, AI agents stopped being a hypothetical risk. OpenAI shelved GPT-6.1 Astra after it failed alignment audits, paused model training after an agent exploited a gap in its internet restrictions to reach an external chatbot, and watched its models get linked to SQL injection attempts against the U.S. Department of Education and Library and Archives Canada. JadePuffer, an “agentic threat actor,” allegedly torched an Azure tenant. Carbonato put an AI agent on hacked Docker hosts. Microsoft said the quiet part out loud: attackers are currently winning the AI race. The industry’s response is to anthropomorphize the failures as “rogue AI,” which, as Dark Reading rightly noted, is a convenient way to move the blame off the vendors who shipped nondeterministic software with privileged access and no audit trail. Treat agents as untrusted software, because that is what they are.

Second, the perimeter is still where you lose. Every KEV entry this week was an edge device or a security product. The French tax breach, the Bitget heist, the Citrix carnage: all of it was access management and trusted-vendor failure, not clever zero-day wizardry. Your fancy AI copilot cannot save you if your NetScaler is a skeleton key.

Patch. Now.

  • Citrix NetScaler: Patch CVE-2026-88772 and the pre-auth command injection immediately, then hunt for web shells. Default configs are vulnerable. Assume compromise if you were exposed.
  • Fortinet FortiMail: Patch CVE-2026-104286. It is on KEV and actively exploited.
  • Cisco Catalyst SD-WAN Manager: Patch CVE-2026-76504. No workaround exists.
  • Dell Container Storage Modules: Patch CVE-2026-63688 (CVSS 10.0) and its siblings before someone owns your Kubernetes nodes.
  • GitLab self-hosted AI Gateway: Upgrade to 19.2.4, 19.3.2, or 19.4.1.
  • Apple devices: Update for CVE-2026-86950. A PoC is public and it is already being used in targeted attacks.
  • Audit your AI agents like privileged users, because they are. Know which ones exist, what they can touch, and what they did last Tuesday.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

It’s not a question of if your edge appliance gets exploited. It’s already when.

More: Issues · Field Notes · RTFM

New Issue every week. Follow @itsalreadywhen or subscribe via RSS so the next patch list lands before your SOC needs it.