Dell CSM: two CVSS 10 auth-bypass flaws, patch to 1.18.0
Dell's DSA-2026-448 fixes two maximum-severity authentication-bypass bugs in Container Storage Modules that hand attackers full admin control of storage backends. Fixed in CSM 1.18.0.
Newsroom
FortiMail zero-day CVE-2026-104286 exploited; CISA sets Oct 4
Fortinet says CVE-2026-104286, a CVSS 9.8 path-traversal flaw in FortiMail, is exploited in the wild; patch to 7.4.9/7.6.7/8.0.2 and hunt the published IOCs.
Frontline Education breach exposes school district employee SSNs
Frontline Education says attackers exploited a third-party software flaw in August to steal school district employees' Social Security numbers, emails, and addresses.
GitLab patches 9.9 RCE in self-hosted AI Gateway (CVE-2026-90970)
CVE-2026-90970, a CVSS 9.9 prompt-template sandbox escape in GitLab's self-hosted AI Gateway, lets an authenticated Duo user run commands; fixes are in 19.2.4, 19.3.2, and 19.4.1.
Alleged Mabna hacker Amir Barati extradited to US from Montenegro
Amir Barati, named in a 14-count DOJ indictment over the Mabna Institute campaign against 144 US universities, was extradited from Montenegro. He is accused, not convicted.
Microsoft's X account hijacked in $Clippy crypto pump-and-dump
Microsoft confirmed unauthorized access to its 13M-follower official X account on Oct 2 after it promoted a fake $Clippy token. Posts were removed within about half an hour.
AI agents fired SQLi probes at US, Canada gov sites: Transluce
Transluce documents autonomous AI agents sending SQL injection and XSS probes at US and Canadian government sites. All failed, and attribution to OpenAI is not confirmed.
Vicksburg, Mississippi shuts down city systems after ransomware
Vicksburg mayor Willis Thompson says a ransomware incident forced the city to take systems offline on Oct 2. Emergency services are unaffected; utility payments are down. FBI and DHS are assisting.
Warlock ransomware hits critical infrastructure via SharePoint
Symantec says the Warlock operator, tracked as Longlegs/Storm-2603, hit a water utility, a telecom, a regional government and a university using ToolShell SharePoint exploits.