Storm claimed ransomware impacting First Secure Bank Group, a U.S.-based community-focused financial services organization operating in the United States. #UnitedStates
The ransomware incident claimed to be carried out by the emperador threat actor targeted CSA Car Service Abschlepp- & Bergungsdienst GmbH, impacting Car Service Abschlepp in the transportation sector. Archived personal and corporate data of employees and customers were compromised, with impacted country(s): #Germany
Pantaneiro Capas (BR) reported a ransomware incident potentially linked to the arcusmedia threat actor, impacting operations at www.pantaneirocapas.com.br. The incident remains subject to ongoing investigation with Deadline: 2026-10-04 11:32:00.000000. #Brazil
Two newly uncovered, unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway are being actively exploited in the wild, according to watchTowr. Administrators are being urged to isolate or shut down appliances while awaiting Citrix guidance, as no fix, workaround, or indicators of compromise have yet been published. #Citrix #NetScalerADC…
Microsoft SharePoint vulnerability CVE-2026-65660 is being actively exploited, with evidence of attacks appearing soon after Microsoft’s August 2026 patch and Viettel Security’s technical disclosure. The flaw allows authenticated attackers with low-level access to execute arbitrary code, and CISA has already added it to the KEV catalog with a rapid federal patch…
![Cybersecurity News | Daily Recap [26 Sep 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [26 Sep 2026]")
Daily Recap, Kiteworks urged customers to stop using its platform and then ordered a 6-hour server shutdown after suspected zero-day attacks, while CISA warned that SharePoint, WSO2, and Adobe Commerce flaws are being actively exploited and Elementor can be abused to create admin accounts. On the intrusion side, compromised GitHub Actions resumed running Mini Shai-Hulud and PamStealer updates improved macOS C2 payload decryption and persistence, with additional pressure from SOC visibility coverage gaps, Labcorp’s $2.3 million security settlement, and a Supreme Court ruling tied to the SAVE database.
#Kiteworks #MiniShaiHulud #PamStealer #GitHubActions #CISA #SharePoint #WSO2 #AdobeCommerce #Elementor #Grav #Clop #ShinyHunters #Labcorp #ATTSnowflake #SAVE
This roundup covers major cybersecurity developments, including new malware and backdoors, critical vulnerabilities, phishing schemes, AI-agent abuse, and large-scale data breaches affecting organizations such as ZyXEL, Check Point, Elsevier, Google, and Microsoft. It also highlights growing risks from malicious bots, deepfakes, impersonation scams, and emerging security challenges tied to AI, cloud services, and critical infrastructure. #TASKSTOMP #ZyXEL #Elsevier #CheckPoint #EvilTokens #Gyazo #OpenAI #Google #Microsoft
Storm ransomware reportedly targeted Magna Legal Services, a US-based nationwide provider of litigation support and legal services headquartered in Philadelphia, disrupting services used by law firms, corporations, insurance companies, and government organizations. The incident affected legal operations supporting the full litigation process across the country where Magna operates, including court reporting, deposition services, and related support functions. #UnitedStates
Metalware Corporation (CA), a Montreal-based manufacturer of industrial steel shelving and storage systems, reported a ransomware claim attributed to threat actor thegentlemen. The incident impacted Metalware Corporation in #Canada
Guardrisk (South Africa) is a Sandton, Johannesburg-based specialist insurance group and cell captive insurance pioneer, founded in 1993 and operating licensed insurers for life, non-life, and microinsurance, with international cells in Mauritius and Gibraltar; it is wholly owned by Momentum Group since 2013–14. The ransomware claim alleges that the threat actor “thegentlemen” targeted guardrisk.co.za, impacting South Africa. #southafrica
Storm ransomware targeted Applied Composites, a leading U.S. manufacturer of advanced composite components and engineering support for aerospace, defense, and space applications, potentially disrupting its vertically integrated design, tooling, manufacturing, and testing operations. The incident affected operations in the United States. #UnitedStates
Apollo 21—Quality Truck, Bus & Trailer Spare Parts South Africa in ZA reported a ransomware attack attributed to the BlackLocks threat actor, impacting their operations and data. The incident resulted in significant disruption, with effects limited to #southafrica
Cipher Systems (US) reported a ransomware incident allegedly involving the m3rx threat actor, with contact +1 703-672-0051 cited in connection with the claim. The compromised data claim is associated with United States. #UnitedStates
ARCA UNLIMITED Architects in South Africa reported a ransomware attack by the BlackLocks threat actor, with 49 views observed related to the incident. The attack resulted in disruption and file/data encryption affecting their operations in #SouthAfrica
Organizations are learning that securing AI agents must start with visibility, because enforcement controls cannot protect what has not been inventoried or attributed. Recent incidents involving Hugging Face, METR, and shadow AI use show that autonomous workflows can expose sensitive data, consume large resources, and evade traditional monitoring unless discovery and…