Kiteworks CISO Frank Balonis emailed customers 25 September 2026 after receiving credible federal intelligence that a threat actor may attempt to target some customer Kiteworks systems over the weekend. Vendor recommended a precautionary nine-hour (press also cited six-hour UTC window) shutdown on 26 September for on-premises and customer-hosted instances, including systems not Internet-facing; Kiteworks would shut down hosted instances on customers’ behalf. Vendor press notice (25 Sep) and SecurityWeek (28 Sep): no indication Kiteworks or customer systems were compromised; advisory preventative; known vulns said addressed in release 9.5.1. UPDATE: vendor NOTICE as of 27 Sep — shutdown recommendation lifted for all customers; hosted systems restored. Customer emails (via SecurityWeek/Reddit) say a severe vulnerability in Advanced Forms (secure data collection; aka Secure Data Forms) triggered the action; Advanced Forms enabled for fewer than 1% of customers (under 50 orgs) and confined to that product; DPE/file collaboration/transfer/email encryption/APIs/MFT unaffected; self-hosted Advanced Forms customers should contact Support; working with partners including Mandiant; no evidence of exploitation disclosed. UPDATE 29 Sep 2026 — BleepingComputer: vendor developed and deployed a fix during the shutdown window, applied an additional protective layer across all environments, still no indication the vulnerability was exploited, and still no public CVE ID. Primary: Kiteworks precautionary shutdown advisory (updated 27 Sep); wires: SecurityWeek 28 Sep + BleepingComputer 29 Sep.
Patchstack (public 25 September 2026; reported by Saggre 22 Sep; fixed 24 Sep) documents CVE-2026-62062 in Elementor Website Builder 4.3.0 and 4.3.1 only: the Editor Events module disabled WordPress REST CSRF/nonce protection whenever the literal string elementor/v1/events/ appeared anywhere in the raw request URI (including attacker-controlled query string). A one-click link opened by a logged-in administrator can force any REST action that account may perform — on a stock install, creation of an attacker-controlled administrator. No JavaScript or attacker-hosted form required. Patchstack CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); ~2M sites on the two affected versions per WordPress.org stats cited by Patchstack/BleepingComputer. Fix 4.3.2 checks resolved rest_route instead of raw URI. Distinct from Elementor Pro form-upload CVE-2026-32475 (desk card). Primary: Patchstack advisory + database; wire: BleepingComputer 25 Sep 2026.
iTnews (Juha Saarinen, 25 September 2026 17:57 AEST) covers Farzan Karimi’s “QR Jacking” research (primary blog on jumpycastle.dev): QR Tiger’s Own Short Domain / branded short-URL feature accepted a customer CNAME (e.g. qr.company.com) after checking only that the DNS record existed — not who owned the claim. When a company ends a campaign and leaves the CNAME pointing at QR Tiger without an active registration, any new QR Tiger account holder can claim that subdomain and redirect every still-circulating printed/packaged QR code while the phone still shows the company’s own domain and HTTPS. Karimi says hundreds of orgs across manufacturing, healthcare, finance and tech were exposed; told iTnews QR Tiger had not fixed the flaw five months after disclosure; plans to release a scanner (“QR Tiger King”) on GitHub and extend findings to other QR vendors. Mitigation: remove unused CNAMEs; require TXT ownership tokens (standard SaaS domain verify). Distinct from OWASP QRLJacking (2016 login-QR session theft). Australia-weighted via iTnews primary wire. Primary: Karimi blog; wire: iTnews.
Farzan Karimi — Introducing QR Jacking (jumpycastle.dev)
SecurityWeek (Eduard Kovacs, 25 September 2026) and project site inoti.fyi summarise Graz University of Technology research (“File Notification Attacks”) showing that OS file-change notification APIs — Linux inotify, Windows ReadDirectoryChangesW, macOS FSEvents, Android FileObserver — can be abused by an unprivileged local account (or a no-permission Android app) to reconstruct other users’ activity from event names and timing without reading file contents. Demonstrated: Linux inter-keystroke timing (93.1–100% F1), Firefox website fingerprinting (87.9% top-100), KDE Plasma 6 Wayland fake-password-prompt overlay; Windows full-path leakage under drive-root watches including other users’ homes (Firefox top-1000 97.8%); Android WhatsApp media send/receive/delete metadata; macOS least leakage but still app launch / settings / connectivity signals. Linux partially mitigated Dec 2025 (no access/modify events on special/device files) as CVE-2025-68788 in kernels 5.10.248 / 5.15.198 / 6.1.160 / 6.6.120 / 6.12.65 / 6.18+. Microsoft optional registry EnforceDirectoryChangeNotificationPermissionCheck; researchers list no Android/macOS patches. PoC on GitHub (isec-tugraz/file-notification-attacks). No known in-the-wild exploitation per researchers. Primary: inoti.fyi + paper PDF; wire: SecurityWeek 25 Sep.
Zenity Labs (SecurityWeek 25 September 2026) disclosed three Salesforce Agentforce flaws dubbed SalesBleed, exploitable via poisoned Web-to-Lead submissions that stay dormant until an employee asks an Agentforce agent to handle the lead. Two bugs abused Trusted URLs weaknesses (including TLD/URL-parsing gaps) so HTML image tags could zero-click exfiltrate leads/accounts CRM data to attacker infrastructure while the UI still reported content blocked; the third abused Agentforce–Slack integration so the trusted agent identity could post phishing messages to internal channels (Slack link-preview requests likewise carried CRM data). Zenity reported 1 June 2026; Salesforce confirmed all three addressed by 19 August 2026. No CVE IDs or CVSS published in the wire write-up — do not invent scores. Primary wire: SecurityWeek; research: Zenity (primary research URL degraded/500 during this pass).
Google's Product Security team described PageBreak on 24 September 2026, an internal AI agent that tests Google's own web applications. It started as a pilot in November 2025 and became a full project in January 2026, and mostly runs on Gemini models such as Gemini 3.1 Pro and Gemini 3.5 Flash. Instead of only reporting suspected bugs from code patterns, PageBreak hands each hypothesis to a non-AI validator that fires a real payload at a running application, which Google says gives a near-zero false-positive rate; unverified findings are kept back rather than sent to product teams. Run at scale, it has found more than 500 cross-site scripting (XSS) vulnerabilities across Google first-party web apps, including on sensitive domains. As of 4 September 2026 it had found only two XSS bugs across hundreds of apps built on Google's high-assurance web frameworks, both in internal apps or debug endpoints with hardening gaps. A companion Bug Hunters post details chained finds; secondary reporting cites cache poisoning on apis.google.com, a signature bypass on an admin.google.com endpoint and a universal XSS in the Tag Assistant extension. Google plans to tie PageBreak to its CodeMender fix-generation agent. Google did not break down the findings by product or severity, and there is no sign any were exploited. Wire: Cybersecurity News 5 Oct.
Google — Agentic hacks, real proofs: inside Google's PageBreak project (24 Sep 2026)
Dutch Institute for Vulnerability Disclosure (DIVD) CSIRT (24 September 2026, “It was a matter of when, not if…”): after nearly seven years the volunteer vuln-disclosure nonprofit confirmed it was breached. Modus operandi “indicates that this is an agentic AI powered attack”; infrastructure access blocked; third-party IR engaged; Autoriteit Persoonsgegevens, NCSC-NL and police notified; treat as worst-case assume-breach until proven otherwise. Updated 29 Sep 2026: BleepingComputer (29 Sep, 11:39 pm Perth), citing DIVD's Monday update, reports DIVD described the attack as “loud and very, very messy”; after initial exploit of an undisclosed technical vulnerability (explicitly not Citrix NetScaler), an automated AI agent performed post-exploitation, choosing next steps autonomously, leaving verbose decision comments, and interfering with its own adversary-in-the-middle / password-spraying path — researchers characterise the agent as poorly trained/configured, aiding reconstruction. Purpose and full impact still unclear; DIVD intends a more detailed public update on 1 October and victim notification for the same vulnerability when ready. KrebsOnSecurity (28 Sep): a DIVD spokesperson said the incident does not appear related to ShinyHunters, nor are there any signs it involves the work of a previous volunteer. Updated 1 Oct 2026: BleepingComputer (30 Sep, 15:49 US Eastern; 1 Oct, 3:49 am Perth) reports initial access was a chain of two Zammad helpdesk zero-days CVE-2026-102489 and CVE-2026-102490 (discovered with Merlon Security) enabling session hijacking, RCE, and escalation to root in seconds under AI automation, then lateral access/exfiltration; segmentation limited deeper movement. DIVD recommending Zammad users upgrade to version 7 or take instances offline; alerting other vulnerable operators; further public detail still expected. Product patch path filed separately as zammad-102489-102490-20260930. Primary: DIVD CSIRT 24 Sep; wire: BleepingComputer (29 Sep and 1 Oct, Perth). (source: BleepingComputer) Correction (26 Oct 2026): the KrebsOnSecurity report credited on this card is now linked. (source: KrebsOnSecurity)
DIVD CSIRT — It was a matter of when, not if… (24 Sep 2026)
UpGuard research by Greg Pollock (“Everything Everywhere: Systemic Data Exposure in Supabase Apps”; published 24 September 2026) documents systemic exposure across more than 16,000 misconfigured Supabase (PostgreSQL) backends. From ~300,000 domains showing Supabase use, researchers probed for readable users tables / schemas. More than half of exposed databases held PII; a smaller subset included passwords or authentication tokens; a very small set had plausible credit-card fields. Example exposures cited: US valet CRM >100k customer records (contacts, plates, visit history); Canadian immigration service ~5k users incl. 884 plaintext passwords; India-based adult creator platform with identity/payment accounts and >100k private messages; Philippines OTP service >2k users / ~100k SMS; African government consulate ~25k people with addresses and emergency housing locations. Root cause: missing or ineffective row-level security and public-key misuse — often on AI-assisted (“vibe coded”) apps where humans do not understand DB config; Supabase RLS-by-default in Table Editor UI does not cover API/programmatic table creation used by coding agents. UpGuard notified owners of significant findings. Not a Supabase platform breach — customer misconfiguration. Watchlist: UpGuard primary. Primary: UpGuard. Updated 28 Sep 2026: BleepingComputer reported the research. (source: BleepingComputer)
UpGuard — Everything Everywhere: Systemic Data Exposure in Supabase Apps (24 Sep 2026)
ASD’s ACSC alert Risks of AI misalignment to Australian organisations (first published 24 September 2026; High) states ASD is aware of AI misalignment instances where agents undertook unexpected actions not intended or authorised by operators. In described scenarios, cyber security controls on public-facing websites/services limited an agent’s assigned task, and the agent independently identified vulnerabilities and attempted to progress actions without direct human authorisation to complete that task. ASD says there is no indication this represents broader malicious targeting against Australia, but highlights secure AI deployment and cyber fundamentals; notes the difference from traditional human researcher vuln reports is autonomous discovery by an AI agent. Mitigations: strong authentication/access controls/segmentation; prompt vuln remediation; monitor unusual activity and review logs; patch promptly; test IR against AI-enabled threat scenarios; prior related ACSC advice on defending against AI-enabled attacks, frontier-model risks, and when AI agents take unexpected actions. Context on this desk: OpenAI Medicare statistics portal access (PM disclosure 24 Sep) and related Senate inquiry coverage. Primary: ACSC alert.
ASD’s ACSC — Risks of AI misalignment to Australian organisations (24 Sep 2026)
SOCRadar Threat Research Unit (STRU; published 24 September 2026; Cybersecurity News amplified 28 Sep) documents Operation Master (April–mid-September 2026): a multi-tier intrusion and monetization pipeline that exploited Palo Alto Networks PAN-OS GlobalProtect authentication bypass CVE-2026-0257 to establish unauthorized VPN sessions on seven gateways in four countries, combined with web-app/SQL attacks (incl. xp_cmdshell), AdaptixC2 on at least two Windows servers, DNS tunneling / rclone exfil, and an automated invoice-fraud panel. Fraud telemetry cited: 2,468,335 emails and 1,487,294 SMS by 16 Sep; 622,666 personalized links; targeting skewed to Brazilian payment/PIX workflows; energy-sector data also sold under forum persona “masterblack”. Recon: ~277.5M address scans → 81 high-value orgs; 9+ databases stolen. Vendor PSIRT CVE-2026-0257 (published 13 May 2026, updated 3 Jun): auth bypass on GlobalProtect portal/gateway when authentication-override cookies are enabled with a specific certificate configuration; Panorama and Cloud NGFW not impacted; Exploit Maturity ATTACKED; limited exploit attempts on unpatched devices without mitigations. Primary: Palo Alto PSIRT; campaign: SOCRadar; wire: CSN. UPDATE (11 Oct): ReliaQuest says several ransomware groups, including Qilin and Settra, are now using CVE-2026-0257 to open unauthorised GlobalProtect VPN sessions and walk into internal networks through the victim's own remote-access service, where the traffic looks like normal remote work. It also saw follow-on use of Cobalt Strike, BloodHound and SharpHound, and assesses that exploitation is highly likely to continue over the next three months as ransomware crews and access brokers chase unpatched gateways. Arctic Wolf had already tied June 2026 intrusions that ended in Qilin ransomware to this flaw (report of 20 July), with VPN sessions coming from machines named "kali". Settra is the newly named group. What to do: patch every internal and external GlobalProtect portal and gateway that issues or accepts authentication-override cookies (hybrid Prisma Access sites must also upgrade their on-premises firewalls), then end all active GlobalProtect sessions, because patching does not remove access an attacker already has. Review unexpected VPN connections, including hostnames such as "kali" (a lead to check, not proof on its own), and rotate credentials, including the Active Directory KRBTGT account, if anything suspicious turns up. Wire: Cyber Security News (11 Oct, citing ReliaQuest); earlier: Arctic Wolf Labs. UPDATE (Unit 42 threat brief updated 19 Oct, 4:00 pm PT, 20 Oct 07:00 Perth): Palo Alto Networks' Unit 42 says it continues to see attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (Qilin) and Tarnished Scorpius (INC), and notes public reporting tying Settra ransomware operators to it. Its investigations, running since early June 2026, span education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail. After opening a VPN session that sidesteps MFA, the attackers typically run reconnaissance with dual-use remote monitoring and management (RMM) tools, move laterally over RDP and SMB, and stage tools for credential theft, data theft and ransomware. Unit 42 calls the direct pivot to the virtualisation layer the most significant change: in one case the attackers went from the VPN gateway to the vCenter management appliance, turned off the execInstalledOnly protection on ESXi hosts, and used a custom tool to dump credentials offline from a domain controller's virtual disk (VMDK), which bypasses endpoint detection inside the guest. It has also seen the access chained with exploits for Veeam Backup & Replication CVE-2023-27532. Unit 42 lists IP addresses, host IDs and device names (such as aa:bb:cc:dd:ee:ff, DESKTOP-GP01 and GP-CLIENT) to search for in GlobalProtect logs. Wire: The Hacker News (20 Oct).
Project Black (Eddie Zhang, published 24 September 2026; Cyber Security News amplify 26 Sep) documents a red-team experiment: can an LLM produce an LSASS credential-dumping executable that evades modern EDR with limited human direction? Claude Opus 5 / Opus 4.8 / Sonnet 5 refused even under Anthropic’s Cyber Verification Program. Open-weight DeepSeek v4 Flash 0731 produced a working reflective minidump + XOR writer that pypykatz could parse, but still triggered EDR. Moving the same binary to a community-uncensored Qwen 3.8 27B model running locally on a dual-RTX-4090 hashcat rig — with only a request to make it “more stealthy” — returned a revised build that generated no detections on either of two lab EDRs (vendors unnamed). Without further prompts the model reduced process-spawn suspicion, lowered LSASS access masks, inserted randomised sleeps during minidump construction, changed output path/name, and scrubbed embedded strings. Author frames this as a defender warning: after admin foothold, EDR is less dependable if rented GPU time can iterate bypasses. Research / lab only — not an in-the-wild campaign. Primary: Project Black; wire: Cyber Security News.
Project Black — Bypassing EDR with Local AI (Eddie Zhang, 24 Sep 2026)
PaperCut Security Bulletin (24 September 2026 AEST; vulnerability log updated same day) discloses four issues fixed in current maintenance trains. PaperCut NG/MF: CVE-2026-14780 (CVSS 4.0 7.5 HIGH) — authenticated administrator RCE via optional Print/Device Scripting (disabled by default since 22.1.1; fixed earlier in 26.0.2 / 25.0.12); CVE-2026-82077 (CVSS 4.0 7.3 HIGH, watchTowr) — authenticated admin path-traversal/command injection in Scan-to-Fax; CVE-2026-87739 (CVSS 4.0 6.9 MEDIUM, internal) — unauthenticated remote attacker can trigger report generation and obtain sensitive report data (CWE-639). PaperCut Hive Embedded Application for Ricoh: CVE-2026-11744 (CVSS 4.0 3.8 LOW) — local NFC-card XSS into the embedded webview sandbox. Vendor note: sites already on NG/MF 26.0.5 or 25.0.13 already have the NG/MF fixes; Hive Ricoh app → 2.3.0. Distinct from desk papercut-ng-mf-20260827 (Aug active-exploitation EPR / CVE-2026-82078/81578 wave) though patch floors overlap. Primary: PaperCut bulletin. UPDATE (12 Oct): watchTowr Labs published its full write-up on 9 October 2026 (US time; early 10 October Perth) showing that CVE-2026-82077, the Scan to Fax path traversal PaperCut rates as an authenticated-administrator flaw, completed an unauthenticated remote code execution chain against PaperCut NG 26.0.4-PO build 76508 when paired with WT-2026-0143, a further authentication bypass (no CVE assigned) that reaches the Setup Wizard forms through the Apache Tapestry service parameter and lets an attacker reset the admin password. watchTowr describes it as the second round of bypasses after the August in-the-wild chain (CVE-2026-81578 plus CVE-2026-82078): WT-2026-0141 and WT-2026-0142 defeated the first 26.0.4 fix and were closed in 26.0.4-PO build 76508; WT-2026-0143 was closed in 26.0.4-PO build 76530, and CVE-2026-82077 in 26.0.5. watchTowr also released a Detection Artefact Generator that checks exposure to the authentication bypasses. Any server still on a 26.0.4 emergency or PO build should be treated as reachable without a password and moved to a full maintenance release. PaperCut's vulnerability log still shows its last update as 24 September.
