Talos: China-nexus UAT-11587 hits Asian governments with Antino
Cisco Talos ties China-nexus UAT-11587 to spear-phishing on 16 government and policy targets across 8 Asian countries, deploying the Rust 'Antino' backdoor via M365 dead drops.
Newsroom
Zammad zero-days (CVE-2026-102489/102490) chained to root; patch now
DIVD says two Zammad zero-days were chained for unauthenticated root RCE — and that its own network was breached by an autonomous AI agent. Fix is in version 7.
Bitget blames $387M crypto theft on zero-days in security appliances
Bitget says attackers stole roughly $387M by exploiting zero-days in two third-party security appliances, then spoofed its payout authorization; the exchange suspects North Korea.
Malicious custom GPT 'Plus 5.6' funnels users into ClickFix RAT
Huntress found a weaponized ChatGPT Custom GPT that pushes victims through a Google Sites ClickFix page to a PowerShell-delivered RAT. At least 40 incidents investigated.
Cisco patches exploited SD-WAN Manager auth bypass (CVE-2026-76504)
Cisco fixed CVE-2026-76504 (CVSS 9.8), an unauthenticated API auth bypass in Catalyst SD-WAN Manager already exploited in the wild. CISA added it to KEV the same day.
France's DGFiP breach: 350k+ people hit via stolen passwords
ANSSI's report on the French tax administration breach: attackers used stolen staff credentials against password-only portals, exfiltrating data on 350k+ individuals over seven undetected weeks.
Kiteworks patches critical Advanced Forms flaw in release 9.5.1
Kiteworks took systems offline for a weekend on federal threat intel, then found and patched a critical flaw in its Advanced Forms feature. Fix is in release 9.5.1; no CVE assigned yet.
Microsoft Entra ID to enforce CSP, blocking sign-in script injection
From mid-October 2026, Entra ID enforces a Content Security Policy on login.microsoftonline.com, allowing only Microsoft-trusted scripts. Extensions and tools that inject code into sign-in will break.
CISA flags pre-auth root RCE in MikroTik RouterOS (CVE-2026-84411)
CISA warns of CVE-2026-84411, a CVSS 9.8 pre-auth integer underflow in RouterOS web management that yields root code execution. Fixed in 7.24 and 7.23.7 LTS; no known exploitation yet.