Parse notes
Attackers are exploiting CVE-2026-73570 in Zimbra Collaboration Suite. A crafted email can trigger unauthenticated OS command execution when zimbra-snmp and SNMP notifications are enabled, and Microsoft observed web shells, reverse shells, privilege escalation, remote-access tools, email backups, and credential collection. Shadowserver found 274 compromised instances.
A single unauthenticated POST to /%6a_security_check mints an admin session on Cisco SD-WAN vManage through CVE-2026-76504, a critical authentication bypass Cisco disclosed on September 30 as an exploited zero-day. Cisco's login module checked the raw request URI while WildFly matched the decoded path, so the encoded request skipped the password check and fell into a session-continuation branch that trusted hardcoded internal usernames like viptela-reserved-cloudops. With ~1,500 vManage instances internet-exposed per VulnCheck, defenders should follow Cisco's advisory and hunt serviceproxy-access.log and vmanage-server.log for encoded j_security_check paths and viptela-reserved- usernames.
Attackers are exploiting CVE-2026-104286 as a zero-day, a CVSS 9.8 path traversal and NULL byte flaw in the FortiMail management interface that lets unauthenticated HTTP requests write arbitrary files and execute code. FortiMail 7.2.0 through 8.0.1 is affected, and fixed builds 7.4.9, 7.6.7, and 8.0.2 are not yet available, so admins should disable IBE or restrict the management interface to trusted networks. Compromise indicators include an added /data/etc/ld.so.preload and /data/lib/liblog.so, plus an archive account named archive234 pointing to 79[.]141[.]169[.]187, and CISA gave federal agencies until October 4 to triage and mitigate.
Uber faced two issues with agentic identity: its current identity model wasn't designed to account for agents acting on behalf of users, and provenance wasn't properly carried across different agents in a workflow. To address this, Uber implemented an identity system in which workflows begin by requesting a workload ID from SPIRE. That ID is then presented to a custom STS, which verifies in its agent registry that the requested agent is allowed to run on that workflow and returns a JWT with the relevant details to the workload. To simplify adoption, Uber built a standardized Agent-to-Agent client that provides an automatic, secure-by-default path.
It is pivotal to provide defenders with access to the most powerful, cyber-capable models, whether open-weight or frontier models. Instead of restricting access to these models, we should shift the paradigm to focus more on restricting attackers' access. Frontier labs should implement low-friction, cross-lab Know Your Customer (KYC) programs, do more to detect and block attackers, and publish time-to-detection-and-response metrics. Victims of AI cyberattacks should also be encouraged to share more detailed information about the attack and the attackers.
A zero-day in a third-party security product gave Bitget's attacker a foothold on August 31, 25 days before the $387.5 million theft. The attacker later planted a web shell and C2 on a second appliance and pivoted to the production wallet job server, where a custom withdrawal tool forged risk-control parameters and drained wallets in under three hours. The vendors remain unnamed, and the North Korea attribution comes only from Bitget's CEO, so the takeaway is to monitor security appliances like production hosts and enforce withdrawal risk checks outside the wallet host.
Google is releasing Argon first to trusted cyber defenders through its Fairwind Program. The model can find, validate, and patch vulnerabilities, including a healthcare flaw exposing patient data. It scored 68% on CWE-bench v1 and found exposures across 20 programming languages. Google is testing safeguards against prompt injection, misuse, and unsafe agent actions before wider access.
kunglao-agent is a Claude Code plugin for autonomous reverse-engineering tasks.
Drop allows users to create sandboxed environments that isolate programs and agents while attempting to preserve as much of the development environment (user, selected config files) as possible.
Monthly vulnerability disclosures doubled in 2026, reaching over 10,000 by midyear. High-risk flaws rose 167%, and exploited vulnerabilities averaged 18 per month, up from 10.5 in 2025. AI-discovered bugs more often enable remote code execution (50% vs 26%) and skew toward medium and low risk. Researchers saw rapid weaponization of n-days, including a BeyondTrust flaw exploited within four days of disclosure. AI-related CVEs also climbed, with 2,076 tracked since early 2025, though zero-days against AI infrastructure remain unconfirmed.
MetaMask is responding to an ongoing security incident affecting part of its infrastructure. The company is proactively exiting affected validators in its non-custodial staking operations, coordinating with clients and partners. Lido confirmed the exits are underway, with final validators expected to be exited by October 7, likely incurring foregone rewards and possible downtime penalties.
OpenAI detected an extraction campaign beginning July 1, with spikes on July 24–25 involving 16,000 requests from more than 4,000 users. Related activity affected over 15,000 users and was disrupted by July 28. Operators replayed encrypted reasoning and used cross-conversation prompts, with OpenAI linking a core cluster to Moonshot AI personnel, restricted accounts, closed replay paths, added output checks, and shared indicators with partners.
British Transport Police ran a six-month live facial recognition trial at London rail stations, scanning over 500,000 faces.
Antino, a new Rust-based Windows backdoor that runs C2 entirely through Microsoft Graph API calls to attacker-controlled Outlook and OneDrive, compromised roughly 350 endpoints across Asia in a China-nexus espionage campaign that Cisco Talos tracks as UAT-11587.
Signal 8.30 brought end-to-end encrypted on-device backups to iOS and desktop, completing the secure backups rollout across all platforms with a standardized format, though attackers have reportedly begun targeting the recovery keys.