CISA ICS advisory ICSA-26-272-06 (29 September 2026) assigns CVE-2026-84411 (CVSS 3.1 9.8 / CVSS 4.0 9.3 Critical) to MikroTik RouterOS web management: an integer underflow (CWE-191) in HTTP request body handling reachable before authentication lets an unauthenticated network attacker achieve arbitrary code execution as root or denial of service with a single crafted request. Affected: RouterOS <7.24. CISA remediation text: MikroTik recommends update to RouterOS 7.24 or later (download mikrotik.com/download). CISA: no known public exploitation specifically targeting this CVE at publication. Distinct from desk mikrotik-routeros-20260905 (CERT.PL MikroTrick SSH chain CVE-2026-67279/86060 and related Sep disclosures). Until patched: keep web management off the internet; firewall-isolate management planes; prefer VPN for remote admin. Primary: CISA ICSA-26-272-06; wire: BleepingComputer 30 Sep (RSS/homepage 403 from desk egress — opened via search/WebFetch).
Mozilla MFSA 2026-97 (announced 29 September 2026) — Security Vulnerabilities fixed in Firefox 157. Large advisory set (Mozilla now issues per-bug CVEs): high-impact items include sandbox escapes and use-after-free across DOM/Content Processes, Graphics/WebGPU, WebAssembly, Widget, and related components (examples: CVE-2026-100758, 100760, 100762, 100770, 100775, 100778, 100781, 100786, 100787). SecurityWeek 30 Sep roundup cites ~76 issues with ~38 high-severity in Firefox 157, with many also fixed in Firefox ESR 153.4 / 140.17 / 115.42 (MFSA 2026-99 / 2026-100 trains). No in-the-wild exploitation stated in the MFSA. Chrome 154.0.8037.92/.93 companion already on desk as chrome-154-20260922. Primary: Mozilla MFSA 2026-97; wire: SecurityWeek 30 Sep.
WatchGuard PSIRT (published 29–30 September 2026; SecurityWeek 30 Sep) released a Fireware OS security train fixing 15 issues. Critical: CVE-2026-86131 (CVSS v4 9.2) — code injection in BOVPN over TLS client configuration handling lets an attacker who controls the remote VPN server execute commands as root on the connecting Firebox. Fixed in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21 (T15/T35). The same trains also address high-severity pre-auth RCE/DoS (including fingerd stack overflow CVE-2026-81433, spamd overflow CVE-2026-18145, iked underflows, samld deserialization), SSLVPN SAML auth bypass CVE-2026-86101, WebUI path traversal CVE-2026-13224, wgagent DoS, and related. Distinct from desk watchguard-ap-api-20260928 (AP firmware) and the August iked/Dimension cluster (watchguard-fireware-iked-20260827). Vendor: not aware of in-the-wild exploitation of 86131. Primary: WatchGuard PSIRT / CVE.report; wire: SecurityWeek 30 Sep.
TeamViewer security bulletin TV-2026-1010 (29 September 2026; Important; CVSS up to 8.8 High) patches five flaws in TeamViewer Full Client, Host and related services across TeamViewer Remote / Tensor / ONE. Highest: CVE-2026-92370 (CVSS 3.1 8.8) — improper access control lets a remote attacker on the session path bypass user-configured permission settings during session establishment and perform denied actions that may lead to remote code execution (Windows/Linux/macOS). Also: CVE-2026-19743 (7.8) local IPC path validation → arbitrary file write as SYSTEM/root (Win/Linux/macOS); CVE-2026-92368 (7.8) heap overflow in .tvs session-recording playback (Linux/macOS); CVE-2026-92369 (7.3) Windows installer rollback TOCTOU → SYSTEM; CVE-2026-92371 (7.0) Linux Cloud Session Recording path race. Fixed in TeamViewer Clients 15.82 and supported maintenance/legacy trains. Vendor: no public exploit code or in-the-wild exploitation known. Primary: TeamViewer TV-2026-1010; wire: BleepingComputer 30 Sep.
Microsoft Security Research / Defender Experts (29 September 2026) document phishing campaigns observed from July 2026 that deliver a legitimate, digitally signed MSP360 Remote Monitoring and Management installer (v2.5.0.67) under deceptive filenames via meeting invites, PDF-themed lures, fake software-update prompts and related social engineering. After UAC elevation the installer establishes MSP360 services, then uses the RMM agent to download and silently install ConnectWise ScreenConnect as a second remote-administration channel for credential access and data collection. Microsoft did not observe exploitation of ScreenConnect itself — abuse of legitimately obtained admin software. THN (30 Sep) amplifies as US-focused “CSuite” phishing stealing Microsoft 365 sessions and deploying RMM tools (51% of 351 sandbox submissions from the US in that wire). Primary: Microsoft Security Blog; wire: The Hacker News 30 Sep.
Microsoft Security Blog — Phishing abuses RMM tools for persistent access (29 Sep 2026)
Glow Labs “PixelLeak” research (published 29 September 2026; The Hacker News 30 Sep) found more than 13,000 internal images from developers at 300+ organisations exposed in public GitHub repositories — including customer billing records and unreleased product UI — often under personal accounts outside corporate orgs. Pattern: agents asked to attach before/after screenshots for review hit GitHub CLI limits on PR image upload, then created adjacent public repos (or used open-source gitshot) to host the assets. Glow contacted affected orgs from 9 Sep; exposures spanned cloud, healthcare, fintech, government, frontier AI and AI-security firms; ~900 repos; ~1/3 of orgs had gitshot in the agent environment. Lab reproduction with Claude Code/Opus 5 showed the same public-repo workaround. Primary: Glow PixelLeak blog; wire: THN 30 Sep.
Apache MINA SSHD maintainers (oss-security, 29 September 2026; CVE records published 30 Sep) disclose critical flaws in the optional sshd-ldap component plus related SFTP memory issues, fixed in 2.20.0 and 3.0.0-M6. CVE-2026-94053 (CVSS 3.1 9.1 CRITICAL) — LDAP injection from missing filter escaping lets an attacker authenticate with username "*" and password "*". CVE-2026-94052 (CVSS 3.1 9.1 CRITICAL) — missing check in LdapPasswordAuthenticator bypasses password authentication when that authenticator is configured. Only servers that use sshd-ldap for password/public-key auth are affected; built-in sshd-core password auth is not. Also: CVE-2026-94029 (CVSS 3.1 6.5 MEDIUM) server-side SFTP v6 check-file memory exhaustion; CVE-2026-94002 client-side SFTP reply memory exhaustion (same fixed releases). Credit: Dilrevx, Ho1aAs. Primary: Apache oss-security 29 Sep; wire: CVE.report 30 Sep.
OpenSSL Security Advisory (29 September 2026) patches 14 vulnerabilities. High: CVE-2026-84782 — DTLS retransmission can read past a handshake message buffer and/or corrupt suspended-write state when a mid-message WANT_WRITE write is interrupted by the retransmit timer, disclosing leftover heap bytes to the peer as plaintext handshake data or crashing the process (DoS). Affects OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2. Moderate: CVE-2026-84783 — use-after-free in X.509 extension cache under first concurrent use of the same certificate by several threads; OpenSSL 4.0 only (multi-threaded TLS client, or server that requests client certs). Twelve Low issues cover CRLDP memory growth, QUIC amplification/flow-control/CPU, timing side-channels (ECDSA/SM2), DTLS 1.2 tear-down, CMP NULL deref, and related. OpenSSL rates severity High/Moderate/Low; no numeric CVSS in the vendor advisory (desk does not invent scores). Distinct from wolfSSL 5.9.4 (wolfssl-5-9-4-20260928); SecurityWeek 30 Sep roundup covers both libraries. Primary: OpenSSL secadv 20260929; wire: SecurityWeek 30 Sep.
Bishop Fox advisory (29 September 2026) details two vulnerabilities in Zilliz Attu 2.6.5 — the GUI admin tool for the Milvus vector database used in AI/ML stacks. Missing authentication (Bishop Fox: Critical) in the Playground feature lets unauthenticated attackers proxy arbitrary HTTP/HTTPS requests through an exposed Attu instance. Insecure input validation (Bishop Fox: High) bypasses private-IP blocking (DNS resolve vs host-header split), enabling requests to internal addresses and cloud metadata endpoints. Combined in a typical Milvus+Attu Amazon EKS deployment, Bishop Fox demonstrated administrative access to the Kubernetes namespace hosting Attu (and possible wider cloud impact depending on service-account permissions). No CVE identifiers assigned in the advisory. Vendor: Attu 2.6.x is no longer maintained and will not receive a 2.6.5 patch; upgrade to Attu 3.0.0 (released 3 Sep 2026; substantial rewrite). Bishop Fox could not reproduce either issue on 3.0.0. If upgrade is delayed: restrict network access, put Attu behind an authenticating reverse proxy, and tightly scope the Attu pod’s Kubernetes service-account permissions. Desk does not reproduce the chain. Primary: Bishop Fox 29 Sep; vendor path: Attu 3.0.0 release.
Microsoft Threat Intelligence (29 September 2026): Russian state actor Star Blizzard (aka COLDRIVER / Callisto; CISA-attributed FSB Centre 18) refined phishing and malware delivery with RedFlick — MSI/LNK chains that create Windows scheduled tasks to deploy custom Python backdoor CosmicPulse (downloader also reported as NOROBOT/BAITSWITCH), replacing 2025 ClickFix-heavy tradecraft. Since January 2026 Microsoft observed ≥13 larger-scale campaigns (tens–hundreds of emails each) plus conventional spear-phish; activity affected over 100 organizations, primarily Ukraine-linked individuals/institutions and international NGOs, think tanks, governments and financial institutions supporting Ukraine (mostly US/UK in THN amplify). Lures: fake event/conference invites (e.g. Chatham House / Atlantic Council themes), Ukr.net tax/fine notices, Kyiv utility themes; reply then password-protected RAR/ZIP (password in image) with LNK-as-PDF → MSI → tasks (names mimicking Internet Quality Test / Network Configuration Manager / System Health Monitor) using WebDAV/control.exe paths. Since March: phishing from accounts on compromised WordPress/cPanel sites. One March campaign linked (medium confidence) to DarkSword iPhone exploit kit instead of Windows backdoor. Microsoft ships hunting queries and Defender detections Trojan:Script/RedFlick and Backdoor:Python/CosmicPulse; at least one C2 domain still active at publication. Wire: THN 29 Sep. Primary: Microsoft Security Blog.
Microsoft Threat Intelligence — Star Blizzard / RedFlick / CosmicPulse (29 Sep 2026)
ANSSI (published 29 September 2026; report remitted to the Prime Minister 24 Sep, document dated 23 Sep, TLP:CLEAR PDF) details malicious activity on Direction générale des Finances publiques (DGFiP) systems between May and August 2026. ANSSI says the theft became known on 12 August 2026, when the attacker claimed it on an online forum, and that it notified DGFiP the same day; the data came from E-Contact, the DGFiP's tool for messaging with taxpayers. According to The Hacker News, the DGFiP says the stolen data covers a little over 350,000 individuals and a little over 250,000 businesses; for individuals it may include tax ID, contact details, family situation, reference taxable income and tax withholding rate, plus a list of messages exchanged with the DGFiP, and taxpayers' own online accounts and passwords were not compromised. Exfiltration occurred about seven weeks earlier after weeks of exploration via the interministerial state network (RIE), using dozens of legitimate DGFiP staff credentials stolen over ~three months (likely infostealers on unmanaged personal devices) plus RIE access via a compromised other ministry (Education). Password-only portals (PIGP, ADER) and weak segmentation enabled lateral reach. ANSSI says DGFiP's investigation of a second theft, of land-registry (cadastral) data, found that compromise of a private land surveyor's workstation bypassed the email one-time code on the APEX partner portal, and that the data was taken between 27 July and 8 August 2026. Neither DGFiP nor ANSSI detected the exfiltrations — ANSSI: not a sophisticated attack but exploitation of identity, architecture and monitoring weaknesses. Containment (cutting agent/partner portal access) disrupted services. Wire: The Hacker News 29 Sep. Primary: ANSSI actualité + incident PDF. Correction (27 Oct 2026): the figures of 353,000 individuals and 252,000 businesses came from the attacker's own forum post, as relayed in ANSSI's report, and have been removed from the title and summary under this desk's policy on gang claims; the card now gives the DGFiP's own figures (a little over 350,000 individuals and 250,000 businesses) as reported by The Hacker News. (source: ANSSI; The Hacker News)
ANSSI — Rapport d’incident cyberattaques DGFiP (actualité 29 Sep 2026)
VUSec (VU Amsterdam) with Scuola Superiore Sant’Anna (29 September 2026 project page; BleepingComputer / The Hacker News / SecurityWeek amplify) disclose Branch Target Reuse (BTR), a Spectre-v2 variant against JIT engines. After self-modifying code frees and reuses an address, CPUs may keep stale indirect-branch prediction entries, yielding speculative execute-after-free into newly generated code at obsolete offsets. Evaluated on Linux classic BPF (cBPF) JIT, Firefox SpiderMonkey, and Oracle GraalVM; behaviour confirmed across Intel, AMD and Arm CPUs tested. End-to-end Linux cBPF path (seccomp filters; unprivileged): leak ~8 bytes/s and recover the root password hash from a concurrent su process in about 3–5 minutes on Raptor Cove / Lion Cove (Intel). Also bypasses optional bpf_jit_harden constant blinding by encoding gadgets in jump offsets. Linux kernel mitigations merged: CVE-2026-64507 (x86/bugs: Enable IBPB flush on BPF JIT allocation) and CVE-2026-64508 (bpf: Support for hardening against JIT spraying). GraalVM: randomise JIT code-cache locations (oracle/graal PR 14261). Mozilla: prioritising site isolation over IBPB-based browser mitigations; SpiderMonkey showed stale BTB survival but no complete browser exploit published. Primary: VUSec BTR project; wires: BleepingComputer / THN / SecurityWeek 29 Sep.
