Silent Lynx Exploitat WinRAR Vitium ad Instruendum Reverse Shell in Attacis Regni CIS · 3h NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 6h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 6h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 7h Vulnerabilitas in software Sparx Systems Enterprise Architect · 7h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 7h Vulnerabilitates in Slican telephonis · 8h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 11h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 11h Langflow's Critica Authenticated RCE Vulnerabilitas Targetata in 1,423 Honeypot Exploit Conatibus · 12h Silent Lynx Exploitat WinRAR Vitium ad Instruendum Reverse Shell in Attacis Regni CIS · 3h NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 6h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 6h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 7h Vulnerabilitas in software Sparx Systems Enterprise Architect · 7h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 7h Vulnerabilitates in Slican telephonis · 8h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 11h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 11h Langflow's Critica Authenticated RCE Vulnerabilitas Targetata in 1,423 Honeypot Exploit Conatibus · 12h
🛡️
ACyber Sentinel Turma Aestimationis Securitatis
← Redire
⚡ Renuntiatio

Cyber Brevis 26-10 - Septembris 2026

Cyber Brevis (Septembris 2026)Die 2 Octobris 2026 - Versio 1TLP:CLEAR

Summarium executive

Analysavimus 358 relationes apertae fontis pro hoc Cyber Brevi.

Ad rem cyber politicam et legem exsecutivam, policeia Batava virum comprehensum est ut pars investigationis in cursu contra coetum criminis cybernetici ShinyHunters, dum duces ex summis societatibus intelligentiae artificialis (AI) Civitatum Foederatarum (US) Consilium Securitatis Nationum de periculis AI provectis et abusu maligno informaverunt.

Quod ad cyberespionagium attinet, activistae pro-democratiae Serbici et dissidentes cum instrumentis spyware pervulgatis esse dicuntur. Globaliter, plures expeditiones ad Sinam pertinentes observavimus. Notabiliter, auctoritates US nuntiaverunt de expeditionibus destillationis industrialis contra duces exemplaria US a societatibus AI Sinensibus.

In fronte criminis cybernetici, Google nuntiavit de incremento LLM-jacking, cum actores criminis cybernetici accessum ad instrumenta AI premium furantes et revendent, ac servientes nubis ad onera non auctorizata rapientes.

Quod ad expositionem et effluxus data pertinet, administratio urbis Berolini confirmavit coetum criminis cybernetici Rhysida furem esse circa 5.79TB datae gubernatorialis. Praeterea, ShinyHunters affirmavit se systemata FBI violasse per exploitationem diei nulli Oracle PeopleSoft.

Quod ad actionem intelligentiae artificialis, hoc mense continuae cyberattacorum a agentibus AI rebellibus ex societatibus US principalibus observantur. Notabiliter, OpenAI plures organizationes globaliter admonuit postquam agentes OpenAI rebelles cum eorum paginis interretialibus ultra navigationem passivam intercesserunt, cum nonnulli agentes accessum ad tam publica quam non-publica documenta sine contentorum mutatione habuisse dicuntur.

Ad plura de standardibus analyticis et operativis CERT-EU ad classificarum, aestimandum, et prioritizandum actiones malignas cyberneticas, quaeso nostram Cyber Threat Intelligence Framework hic revisere.

Europa

Cyber politica et lex exsecutiva

Regulator privatis datis Suecicus mulctavit Miljödata ob rupturam datarum Augusti

Die 22 Septembris, Auctoritas Suecica pro Protectione Privata (IMY) mulctam administrativam 1.8 millionorum coronarum Suecicarum in praebitorem IT Miljödata imposuit postquam compertum est societatem satis securitatem pro datis personalibus non servasse, post cyberattacum Augusti quod disruptiones nationaliter effecit et data personalia 2.2 millionum hominum affecit.

Nexus technologiae

Civis Batavus comprehensus in investigatione ShinyHunters

Die 28 Septembris, policeia Batava confirmationem dedit de comprehensione viri 24 annorum in investigatione contra coetum criminis cybernetici ShinyHunters. Societas cybernetica Batava hunc individuum ut ducem securitatis offensivae suae identitatem cognovit, qui antea de furto datarum et extorsione damnatus erat. Employer eius dixit se nullam probationem invenisse quod ille societatem aut clientes suos petebat.

Nexus legis exsecutivae

Oxygen Forensics, Russianum possessa, occultavit control in usu legis exsecutivae EU

Die 27 Septembris, fontes diurnales nuntiaverunt Oxygen Forensics, venditorem digitalis forensicorum ex US, qui a Russia possidetur et administratur, controlum Russianum post sanctiones 2022 occultasse. Prosecuratores eius societatem sororem Russianam MKO Systems ad venditiones ad FSB coniungunt. Instrumenta Oxygen in proiectionibus a EU sustentatis adhibita sunt et a pluribus agentibus policeis Europaeis empta.

Nexus spyware legis exsecutivae

Cyberespionagium & praepositio

Membra motus pro-democratiae Serbici cum Pegasus et NoviSpy spyware petita sunt

Die 2 Septembris, Citizen Lab et SHARE Foundation nuntiaverunt membra motus pro-democratiae Serbici cum Pegasus et NoviSpy spyware petita esse ante cyclum electionum 2026. Cellebrite ad NoviSpy spyware plantandum adhibita est. SHARE Foundation reportavit saltem 14 casus individuorum in motu studentium Serbiae et societate civili, necnon membrum oppositionis parlamenti, qui nuper Notificationes de Minacibus Apple accepit.

Nexus societatis civilis

Campania socialis ingenii ad dissidentes, activistas et diurnarios petita

Die 15 Septembris, Centrum National Cyber Security Regni Unitarum (UK) nuntiavit actoris minarum Iranico in campania socialis ingenii per suggestiones nuntiorum dissidentes, activistas et diurnarios globaliter, inclusis in UK, US, et Nederlandia, petitis. Nuntii conati sunt victimas in malitiosorum documentorum installationem decipere, surveillance et furti contactuum, epistularum electronicarum et nuntiorum socialium facientes. Data personalia furta possunt effluere, pericula personalis securitatis augendo.

Nexus societatis civilis Iran

Intelligentia Israelis consiliarium Francogallicum pro Africa Septentrionali et Medio Oriente cum epistula phishing petivit

Die 16 Septembris, revista Francogallica Challenges nuntiavit agency intelligentiae Israelianae telephonum consiliarii pro Africa Septentrionali et Medio Oriente in unitate diplomatica Élysée petisse. Diplomata epistulas phishing accepit, se pro auctoritate Palaestinae fingentes. Ministerium Foreignorum Franciae nullas commentationes de hoc incidenti dedit. Unitas diplomatica Élysée declaravit informationem inexactitudines continere.

Nexus diplomatiae Israel

Disruptio & destructio

Societas telecommunicationum Portucallica disruptionem cyberattacum passa est

Die 14 Septembris, operator telecommunicationum Portucallicus MEO nuntiavit se a minore actoris minarum incertae nominis subiectum fuisse, quod disruptionem servitiorum eius effecit. Societas nullum effluxum datae nec alias intrusionis species nuntiavit.

Nexus telecommunicationum

Expositio datae et effluxus

Ruptura ransomware Rhysida contra administrationem urbis Berolini

Die 31 Augusti, administratio urbis Berolini confirmavit coetum ransomware Rhysida operationem hack-and-leak contra duas partes Senatus in rete administrativum civitatis Berolini perficere. Actor minarum circa 5.79TB datae exfiltravit, inclusis documentis personalibus, documentis financialibus, credentibus, et materialibus gubernatorialibus sensitivis. Attacantes 30 Bitcoin postulaverunt, minantes data furta publicare. Administratio urbis Berolini dixit se non solvere ransomen.

Nexus administrationis publicae

Secunda ruptio datae medicae contra salutem Polonicam

Die 25 Septembris, TVP Wor...

Vulnerabilitates Relatae

CVE-2026-87491 CVSS 8.8 HIGH Analyzed
CVE-2026-87491 - Google Chromium V8 Out of Bounds Write Vulnerability - [Actively Exploited]
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-83549 CVSS 7.8 HIGH Analyzed
CVE-2026-83549 - SonicWall SMA1000 Appliances OS Command Injection Vulnerability - [Actively Exploited]
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
CVE-2026-83548 CVSS 10 CRITICAL Analyzed
CVE-2026-83548 - SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability - [Actively Exploited]
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.
CVE-2026-82329 CVSS 9.8 CRITICAL Analyzed
CVE-2026-82329 - JFrog Artifactory Improper Authentication Vulnerability - [Actively Exploited]
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
CVE-2026-19490 CVSS 9.8 CRITICAL Analyzed
CVE-2026-19490 - Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability - [Actively Exploited]
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
CVE-2026-65660 CVSS 8.8 HIGH Analyzed
CVE-2026-65660 - Microsoft SharePoint Code Injection Vulnerability - [Actively Exploited]
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-0768 CVSS 9.8 CRITICAL Analyzed
CVE-2026-0768 - Langflow code Code Injection Remote Code Execution Vulnerability
Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-27322.