Cybersecurity News — 2026-10-02

Generated: 2026-10-02 | Sources: CISA, Fortinet, Citrix, MikroTik, TeamViewer, Microsoft, Sucuri, UpGuard, Truffle Security, Huntress, DIVD, Europol, The Hacker News, SecurityWeek, BleepingComputer, Dutch NCSC

1. A Flaw in Fortinet's Email Gateway Is Being Attacked and There Is Still No Patch

FortiMail is an email security gateway — the box or virtual appliance that filters spam and malware out of a company's mail before it reaches anyone's inbox. It is sold to businesses of all sizes and is very often installed and run by an IT supplier rather than by the company itself. CVE-2026-104286, rated 9.8 out of 10, is a path traversal flaw combined with mishandling of a special character: an attacker sends a crafted web request and can write files of their choosing onto the appliance, with no password and nothing for anyone to click. Fortinet confirmed on 1 October that this is already being used in real attacks. The important and unusual detail is that there is no fix yet. Fortinet has named the versions that will carry it — 7.4.9, 7.6.7 and 8.0.2 — but has given no release date. Affected versions are 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6 and 8.0.0–8.0.1. CISA added it to its known-exploited list and gave US federal agencies three days to act.

Why it matters for your business: when no patch exists, the workaround is not a holding action — it is the only protection available, so it has to be treated as the fix. Fortinet's advice is to switch off the IBE feature (identity-based encryption, the part that lets recipients outside your company open encrypted mail through a web page) and to stop the management interface being reachable from the internet, restricting it to your own network. If you have a FortiMail appliance, send your IT supplier one message today asking whether both of those have been done, and asking them to tell you when the patched version is actually installed rather than when it is released. "We are waiting for the fix" is not an answer while the attacks are running.

2. Citrix Remote-Access Appliances Were Attacked for Weeks Before Anyone Knew

Citrix NetScaler ADC and Gateway sit at the edge of a network and handle staff logging in from outside the office. Citrix confirmed on 27 September that two previously unknown flaws, CVE-2026-88771 and CVE-2026-88772, both rated 9.5, were already being exploited. The first lets an attacker with no credentials run commands on the appliance, and it applies to every deployment. The second is a memory-handling flaw that needs a protocol called DTLS switched on — which is the default where the box is acting as a VPN server. The Dutch national cyber security centre said exploitation had been confirmed at multiple Citrix customers around the world, and that the attacks had been running for weeks before the flaws were public. Patches are out (bulletin CTX697096), and Citrix told anyone who could not install them straight away to reduce the appliance's exposure to the internet in the meantime. Researchers have since documented what attackers do once inside: create a hidden administrator account, and install a web shell — a small file that gives them a command prompt on the device through an ordinary-looking web address — so that patching alone does not remove them.

Why it matters for your business: that last point is the transferable one, and it applies far beyond Citrix. Patching closes the door; it does not evict anyone already in the building. If you run anything that has been publicly reported as exploited before you patched it, the patch is step one and checking for leftover access is step two — new administrator accounts you do not recognise, files on the device that nobody deployed, logins at odd hours from unfamiliar addresses. Ask whoever maintains the device to confirm they looked, and keep their answer.

3. A Critical Flaw in MikroTik Routers Can Be Triggered With a Single Request

MikroTik makes inexpensive routers that are extremely common in small offices, cafés, rented workspaces and small internet providers — frequently bought years ago, plugged in, and never touched again. CISA published an advisory on 30 September for CVE-2026-84411, rated 9.8, in RouterOS, the operating system these devices run. It is an integer underflow — a maths error in how the device handles the size of an incoming web-management request — and it lets an attacker on the network, with no login, run code on the router as root, meaning full control, or simply knock it offline. One crafted request is enough. Every version before RouterOS 7.24 is affected and 7.24 or later fixes it. To be precise about the risk: CISA did not report confirmed exploitation in the wild. MikroTik flaws are a long-standing favourite of botnet operators, so the gap between a public advisory and real attacks has historically been short, but as of this week this is a warning rather than an ongoing incident.

Why it matters for your business: that distinction matters for how you respond, and this week handed us three versions of it — a flaw being exploited with no patch available (FortiMail), one being exploited with a patch available (Citrix), and this one, where the patch is out and the attacks have not arrived. The third is the comfortable case, and the only one where you get to act on your own schedule. Use it. Log into your router's admin page, check the RouterOS version, and update if it is below 7.24. While you are there, confirm the admin page itself is not reachable from the internet — it almost never needs to be, and CISA's other advice amounts to the same thing.

4. TeamViewer Patched Five Flaws, One of Which Lets a Remote Attacker Take Over a Session

TeamViewer is the remote-access tool a great many small businesses use to let an IT supplier fix a computer without visiting, or to reach the office PC from home. On 30 September the company published fixes for five vulnerabilities in its Full Client and Host software on Windows, Linux and macOS, and urged customers to install them "as soon as possible". The most serious, CVE-2026-92370, is a failure in how access to a remote session is controlled, which can let an attacker perform actions they should not be able to. The others cover a path traversal, a memory overflow, a race condition and weak checking of file paths; between them they allow remote code execution, and allow someone already on the machine to raise their privileges to full system or root level. All five are fixed in version 15.82 and in the supported maintenance and legacy releases. TeamViewer says it is not aware of any public exploit or any attacks using these.

Why it matters for your business: remote-access software deserves a different level of attention from ordinary applications, because it exists specifically to let someone operate your computer from somewhere else. That is its purpose when it works and the attacker's goal when it breaks. Open TeamViewer on each machine that has it, check the version, and update to 15.82. Then do the thing that costs nothing: look at the list of devices in your account and remove every computer and every person who no longer needs to be there — the laptop that was replaced, the contractor who finished in spring. Unused remote access is the kind of exposure nobody notices because nobody is looking at it.

5. A WordPress Backdoor That Puts Itself Back After You Delete It

Last week's WordPress story was about a race to patch a flaw in the software itself. This one is about what happens after an attacker gets in, whichever way they got there — and it is the reason "we cleaned it up" is often untrue. Sucuri published analysis on 1 October of a backdoor that spreads copies of itself across eight separate locations on a hacked site: a hidden configuration file that makes the server load it automatically, a loader file, a hidden duplicate of that loader, two WordPress drop-in files, the theme's own functions file, and two plugin installations. Each copy can rebuild the others. As Sucuri's analyst put it: delete the plugin and a drop-in rewrites it; delete the drop-in and the theme rewrites it. It also keeps a copy in shared memory — a scratch area the server holds in RAM — which survives deleting files and cleaning the database. Sucuri did not establish how this particular site was first broken into, and did not publish a figure for how many sites are affected.

Why it matters for your business: the practical consequence is that removing a website infection by hand, file by file, usually fails, and you will not know it failed until the site starts redirecting visitors or sending spam again weeks later. If your site is ever compromised, the reliable route is to rebuild it: a clean WordPress installation, fresh copies of the theme and plugins from their original sources, your content restored from a backup made before the infection, and every password and key changed afterwards. That is only possible if the backups exist and go back far enough, so the thing to check this week — while nothing is wrong — is how many days of backups you actually hold and whether anyone has ever tried restoring one.

6. Over 16,000 Databases Behind Small Web Apps Were Found Wide Open

Supabase is a popular service that gives a website or app a ready-made database and login system, and it is heavily used by small development shops and by people building software with AI assistance. UpGuard examined roughly 300,000 domains and found more than 16,000 Supabase databases that would simply hand over the contents of their tables to anyone who asked. The cause is not a flaw in Supabase: it is a protection called row-level security being left off or configured wrongly, together with misuse of the public key the service gives you. Row-level security is the rule that says a logged-in customer can see their own records and nobody else's; without it, the key that is meant to be published in your website's code becomes a key to everything. More than half the exposed databases held personal data, a smaller number held passwords and authentication tokens, and a few appeared to hold card data. Concrete examples included over 100,000 customer records at a valet service and 5,000 user records with 884 passwords stored in plain text at an immigration advice service. UpGuard notes that over 60% of new databases on the platform are now created with AI assistance.

Why it matters for your business: if someone built you an app, a booking system or a customer portal in the last couple of years — a freelancer, an agency, or you with an AI assistant — this is the single most useful question you can ask them: "can you show me that a logged-out stranger cannot read our database?" Not "is it secure", which invites a yes. The answer is demonstrable in minutes by someone who knows the platform. Under UK GDPR this is squarely your responsibility, not your developer's, and the type of exposure found here — personal data readable by anyone who looks — is the kind the Information Commissioner's Office treats as a reportable breach.

7. More Than 540,000 Working Passwords and Keys Are Sitting in Public Code Repositories

Truffle Security scanned 224 million public repositories on GitHub and 58 billion files, and found 543,699 unique credentials that still worked — not expired, not revoked, live. These are the keys that connect software to other services: cloud account credentials, database connection strings containing a username and password, API keys for paid services. Among the findings, 69,041 of nearly 127,000 exposed Google Cloud service-account credentials were still valid. The number that should concern anyone is how long they sit there: the median credential had been publicly visible for 784 days, and about one in ten working keys was more than six years old, the oldest dating from 2009. GitHub's automatic push protection, on by default since early 2024, has cut exposures of the credential types it recognises by 53% — but just over half the live credentials found were of types it does not block, and 36.8% were published after the protection was switched on.

Why it matters for your business: a leaked key is worse than a leaked password in one specific way — nobody has to log in as anybody, so there is no failed-login alert and nothing looks unusual. The spending on your cloud account or the mail sent through your email service simply continues, from a stranger. If anyone has ever written software for you, ask them one question: were any of our keys ever committed to a repository, including a private one that was later made public or a repository that no longer exists? If the answer is yes or unclear, rotate them — generate new keys and revoke the old ones. Deleting the file does not help, because the history keeps it.

8. A Phishing Campaign Installs Two Legitimate Remote-Control Tools So It Looks Like IT Work

Microsoft published research on 30 September on a campaign that does not deploy malware in the usual sense. The victim is sent a file with a convincing name — a meeting invitation, a PDF reader update, an Adobe Acrobat document, a government statement, an RSVP e-card — and running it installs a genuine, properly signed copy of MSP360, a remote monitoring and management tool of the kind IT support companies legitimately use. That then quietly downloads a second one, ConnectWise ScreenConnect. Microsoft calls this dual-RMM: two independent remote-control channels on the same computer, so losing one does not cost the attacker their access. The reason it works is that neither tool is malicious, so security software has little reason to object, and an administrator glancing at the machine sees software that looks exactly like the IT department's.

Why it matters for your business: this is the attack that defeats "we have antivirus", because there is nothing for the antivirus to find. The defence is knowing what is supposed to be there. Ask your IT supplier to write down which remote-access tool they use — one name — and tell your staff that if anything else ever asks to be installed, or if they are ever contacted by someone claiming to be IT and asked to install a support tool, the answer is to stop and phone a number they already have. Then ask the supplier to check your machines for remote-access software other than their own. Most small businesses have never asked, and a surprising number find something.

9. A Fake ChatGPT Add-On Was Used to Talk People Into Running Malware

Huntress found a malicious custom GPT — a user-created version of ChatGPT, hosted on OpenAI's own site — named "Plus 5.6", used to send victims onward to a fake "checking your browser" page and persuade them to run a PowerShell command. PowerShell is the command tool built into Windows. The command installed a remote access trojan: software that gives the attacker the desktop, the microphone, the camera, the ability to search files and the ability to install more. It kept itself running through a scheduled task innocuously named "Canon Configuration Reader". This is the ClickFix technique, which this briefing covered last week on a hijacked domain used in programming tutorials; what is new is the delivery. The link arrived from chatgpt.com, a domain staff have no reason to distrust and which no sensible blocklist includes. OpenAI removed the first version by 25 September; Huntress found a second on 27 September. OpenAI has separately said it will retire custom GPTs on 11 December.

Why it matters for your business: the defence does not change, and that is the encouraging part — the same single rule covers both versions of this. No legitimate website, and no AI tool, will ever ask you to copy something, press Windows+R and paste it in, or to paste a command into PowerShell. Not to prove you are human, not to fix an error, not to install anything. If a page asks, close the tab and tell someone. The reason to repeat it even though it was said last week is precisely this story: the technique keeps arriving through more trustworthy-looking front doors, so checking where a link came from will eventually fail, while the rule about what you are being asked to do still holds.

10. A Security Organisation Was Breached in Seconds by Software Operating on Its Own

The Dutch Institute for Vulnerability Disclosure, a non-profit that reports security flaws to the organisations affected by them, disclosed on 30 September that its own network had been broken into. The route in was its helpdesk system, Zammad, through two previously unknown flaws — CVE-2026-102489 and CVE-2026-102490 — chained together to hijack a session, run code, and escalate from the helpdesk's own limited account to root, full control of the machine. What makes this worth your attention is not the victim but the operator: DIVD concluded the intrusion was run by an autonomous AI agent making its own decisions without a human directing it, and that it moved from access to stealing data in a matter of seconds. DIVD described the attack as "loud and very, very messy" — the agent left clear explanations of its own reasoning behind, which is how the sequence was reconstructed — and its network segmentation stopped the agent going further. The fix is Zammad version 7, or taking the system offline until it is applied. There is a through-line running across several of this week's stories: AI turns up not as the thing being attacked but as the thing doing the work — breaking in here, building the leaky databases in story 6, and hosting the lure in story 9.

Why it matters for your business: the honest reading is that speed is what changed, not technique. Chained flaws, stolen sessions and privilege escalation are all decades old; an agent doing them in seconds rather than days removes the window in which a human might have noticed. Two things follow for a small business. First, the controls that did work here were the dull structural ones — segmentation meant the breach stayed in one place — so keeping your systems separated, rather than everything reachable from everything, is worth more than it was. Second, and more immediately: an internal business system does not need to be reachable from the internet just because it was easier to set up that way. A helpdesk, a file server or an admin panel that only staff use can sit behind a VPN.

11. Police Shut Down a Ransomware Operation Run, Allegedly, by a 16-Year-Old

An international operation led by German authorities, with police from the UK, Belgium, Finland, Greece, the Netherlands, Romania, Spain, Switzerland and the US, took down the KillSec ransomware group. Investigators seized five core servers, took control of the site where the group published stolen data, and recovered at least 110 terabytes taken from victims. Three people were provisionally arrested and eight homes searched, including in the UK. The suspected administrator and main operator is 16; a suspected developer turned 18 in August. Authorities identified roughly 500 successful attacks, with around 450 victims named on the leak site. The detail most worth noting is how the group got in: not through sophisticated exploits, but through known software flaws and weakly protected entry points, with cloud storage left accessible a particular favourite.

Why it matters for your business: it is tempting to read the age of the suspects as reassuring and it is the opposite — ransomware is now a service other people rent, so the skill needed to run a campaign against 500 organisations is administrative rather than technical. The actionable part is the entry method, because it describes what was available rather than what was clever: unpatched software and cloud storage anyone could reach. Both are things you can check. Find out where your business keeps files in the cloud — including the shared drive someone set up for one project three years ago — and confirm each location requires a login. Public-by-accident cloud storage is one of the most common ways a small business loses its data, and nobody attacks it; they just find it.

Sources

Summaries are compiled from public threat-intelligence feeds and security news sources. This digest is for awareness purposes only and does not constitute professional security advice.

Cybersecurity News