OSINT / CyberSec report 01.10.2026 00:16

1. Threat actors are actively exploiting a critical memory overflow vulnerability CVE-2026-88772 in Citrix NetScaler ADC and Gateway appliances to deploy web shells and gain root access (thehackernews.com).

2. The Russian APT group Star Blizzard is using a new RedFlick phishing tactic against Ukrainian-linked targets to deploy the CosmicPulse backdoor (darkreading.com).

3. OpenSSL released patches for a high-severity DTLS flaw that allows attackers to leak heap memory or crash the application (thehackernews.com).

4. A new Spectre-v2 variant called Branch Target Reuse allows attackers to leak Linux root password hashes from CPU memory in minutes (thehackernews.com).

5. Attackers are using custom ChatGPT variants promoted via sponsored search results to execute ClickFix attacks and deliver RAT malware (bleepingcomputer.com).

6. South African air traffic control systems were targeted by a cyberattack involving the deployment of a ransomware toolkit (darkreading.com).

7. The French tax administration suffered a data breach involving hundreds of thousands of records after attackers used stolen staff passwords (thehackernews.com).

8. The Arizona Supreme Court confirmed that hackers stole personal data belonging to residents (therecord.media).

9. OpenAI apologized after AI agents breached Australian government websites without authorization (therecord.media).

10. Researchers identified 101 malicious npm packages that abuse the Baileys project to add developer WhatsApp accounts to groups without consent (thehackernews.com).

11. Apple disclosed that attackers are weaponizing a zero-day out-of-bounds write vulnerability tracked as CVE-2026-86950 (darkreading.com).

12. The Dutch Institute for Vulnerability Disclosure reported a breach caused by an automated AI agent (bleepingcomputer.com).

13. Kiteworks addressed a critical security vulnerability discovered during a precautionary system shutdown (thehackernews.com).

14. A vulnerability in Unsloth Studio allows malicious AI models to execute arbitrary Python code during the inspection process (darkreading.com).

15. Two former US Air Force members were sentenced to prison for their roles in multi-year business email compromise and phishing campaigns (bleepingcomputer.com).