Oct 1-2, 2026
CRITICAL
Vulnerability
Fortinet FortiMail Zero-Day Exploited in the Wild (CVE-2026-104286)
A critical path traversal flaw (CVSS 9.8) in Fortinet's FortiMail email security gateway allowed unauthenticated attackers to write arbitrary files to the underlying server via crafted HTTP/HTTPS requests. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog and ordered all U.S. federal civilian agencies to patch by October 4, 2026. Affected versions span FortiMail 7.2 through 8.0.1.
▶ Key Takeaway
Path traversal lets attackers escape the intended directory to access or write files anywhere on a server. This is a Top 10 OWASP vulnerability. CompTIA Tech+ objective: understanding common attack types and why unpatched software is dangerous. Patch management is not optional.
Oct 1, 2026
CRITICAL
Vulnerability
Cisco SD-WAN Authentication Bypass Exploited (CVE-2026-76504)
Attackers exploited an API authentication vulnerability in Cisco's Catalyst SD-WAN Manager that allowed crafted HTTP requests to bypass login entirely and gain admin-level access. This was the fifth Cisco zero-day exploited in 2026. Organizations running affected versions (20.9 through 26.2) were ordered by CISA to remediate by October 3. Successful exploitation hands attackers complete control of an entire corporate network.
▶ Key Takeaway
Authentication bypass occurs when an attacker tricks a system into skipping the login check. SD-WAN manages traffic across entire corporate networks -- bypassing its auth is like handing over all the building keys at once. CompTIA Tech+ concept: access controls and authentication failures. Always monitor API endpoints for suspicious patterns.
Jul-Sep 2026 (disclosed Oct 2)
CRITICAL
Ransomware
Nation-State
Warlock Ransomware (China-Linked) Breaches Water Utility & Telecom via SharePoint
A China-linked ransomware group called Warlock exploited Microsoft SharePoint vulnerabilities to breach critical infrastructure: a water utility, a telecom provider, a regional government, and a university. Within two hours of initial access, attackers disabled security software on 40+ systems using an AV/EDR-killer tool and deployed ransomware on 33 hosts. Techniques included web shells, VS Code tunneling, and BYOVD driver exploitation.
▶ Key Takeaway
Critical infrastructure (water, power, communications) is a prime target because disrupting it causes real-world harm to people. BYOVD (Bring Your Own Vulnerable Driver) lets attackers disable security tools using legitimate but outdated software. CompTIA Security+ concept: impacts to availability in the CIA triad.
Oct 2, 2026
CRITICAL
Data Breach
ShinyHunters Breach FBI Jobs Portal via Oracle PeopleSoft Vulnerability
The hacking group ShinyHunters exploited CVE-2026-35273 in Oracle PeopleSoft to compromise the FBI's job application platform (apply.fbijobs.gov). Sensitive personal information belonging to individuals in high-risk investigative and intelligence roles was exposed. The FBI's jobs portal and special agent recruitment pages were taken offline. A suspected group member was simultaneously detained by Dutch authorities.
▶ Key Takeaway
Third-party software (like Oracle PeopleSoft) is a major attack vector even in the highest-security environments. If the FBI can be breached through a vendor's unpatched software, any organization can. CompTIA Tech+ concept: supply chain risk and vendor management. Apply vendor patches promptly -- especially for public-facing applications.
Sep 27, 2026
CRITICAL
Vulnerability
Citrix NetScaler RCE Zero-Days Actively Exploited (CVE-2026-88771 & CVE-2026-88772)
Two critical remote code execution (RCE) vulnerabilities in Citrix NetScaler ADC and Gateway were confirmed to be under active attack before patches were available. CVE-2026-88771 (CVSS 9.5) requires no authentication and affects default configurations. CVE-2026-88772 exploits a memory overflow when DTLS is enabled. NetScaler devices control all remote access and application delivery for corporate networks.
▶ Key Takeaway
Remote Code Execution (RCE) lets an attacker run any command on a server without being physically present -- the most dangerous class of vulnerability. Edge devices like NetScaler are especially high-value targets because they control access to everything behind them. CompTIA Tech+ concept: vulnerability types and the impact of unauthenticated RCE.
Disclosed Oct 1 (breach: Oct 2025 - Jul 2026)
CRITICAL
Data Breach
Pentagon DMDC Data Breach: 3 Million Defense Personnel Records Exposed
A flaw in a file-sharing system at the Defense Manpower Data Center (DMDC) allowed unauthorized access to unencrypted records for over 3 million people -- active-duty military, veterans, retirees, civilians, contractors, and their families. The breach went undetected for 9 months (October 2025 to July 16, 2026). Exposed data included Social Security numbers, dates of birth, addresses, and military occupational specialties.
▶ Key Takeaway
Data at rest should always be encrypted -- storing unencrypted SSNs and military records in a file-sharing system is a critical security failure. This breach also illustrates dwell time: attackers had 9 undetected months inside the system. CompTIA Tech+ concept: encryption, data classification, and why detection is as important as prevention.
Sep 29, 2026
CRITICAL
Vulnerability
Apple Patches Core Graphics Zero-Day in "Extremely Sophisticated" Attacks (CVE-2026-86950)
Apple released emergency patches for an out-of-bounds write vulnerability in its Core Graphics framework -- the system handling all image and PDF rendering on iPhones, iPads, and Macs. Attackers were exploiting the flaw in targeted attacks before the patch existed. Discovered and reported by Meta Product Security. Apple described the attacks as "extremely sophisticated." Fix: iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1.
▶ Key Takeaway
An out-of-bounds write lets attackers write data past the end of a memory buffer, often leading to code execution. Because this flaw is in a media-handling library, simply opening a malicious image or PDF could compromise your device. CompTIA Tech+ concept: memory safety vulnerabilities and why "update now" alerts should never be dismissed.
Jan-Sep 2026 (ongoing)
HIGH
Nation-State
Phishing
Russia's Star Blizzard (FSB) Targets 100+ Organizations with RedFlick Phishing Technique
Russia's FSB-linked hacking group Star Blizzard refined its phishing operations using a new technique called "RedFlick" -- fake event invitations containing malicious .LNK files disguised as PDFs. Opening the file silently creates a hidden Windows scheduled task that installs the CosmicPulse backdoor. Targets included 100+ government bodies, NGOs, think tanks (Chatham House, Atlantic Council), Ukrainian civil society organizations, and international financial institutions.
▶ Key Takeaway
Nation-state APTs (Advanced Persistent Threats) are government-backed hacking teams with large budgets and patience. Star Blizzard operates for Russia's FSB. Their RedFlick technique uses scheduled tasks for persistence -- the malware automatically restarts after every reboot. CompTIA Tech+ concept: social engineering, phishing, and APT threat actors. Red flag: unsolicited invitations with password-protected attachments.
Sep 26-28, 2026
HIGH
Data Breach
AI/Emerging
16,000 Supabase Databases Publicly Exposed by AI "Vibe-Coded" Apps
Security firm UpGuard discovered 16,326 Supabase databases that anyone on the internet could read with no password required. The cause: developers using AI coding tools to rapidly build apps ("vibe coding") failed to enable row-level security or properly configure authentication tokens. Exposed data included passwords in plain text, one-time passwords, passport scans, financial records, 100,000+ SMS messages, and data from a government consulate.
▶ Key Takeaway
AI-generated code is not automatically secure. "Vibe coding" skips critical security configuration steps. Row-Level Security (RLS) is a database feature that controls what each user can access -- most of these apps never turned it on. CompTIA Tech+ concept: security misconfiguration (OWASP Top 10). AI writes code fast, but human security review remains essential.
Zero-Day Vulnerability
A software flaw unknown to the vendor with no patch available. Developers have "zero days" to fix it before it is exploited. This week featured four zero-days: Fortinet FortiMail, Cisco SD-WAN, Citrix NetScaler, and Apple Core Graphics.
Path Traversal
An attack that tricks a web server into accessing files outside the intended directory using sequences like ../ in a URL. In CVE-2026-104286, attackers used this to write arbitrary files anywhere on the FortiMail server with no login required.
Remote Code Execution (RCE)
A vulnerability allowing an attacker to run any command on a remote machine over a network -- without physical access. Considered the most severe category of vulnerability because it gives attackers full control. Both Citrix CVEs this week enabled unauthenticated RCE.
Authentication Bypass
When an attacker circumvents a login system without valid credentials. The Cisco SD-WAN flaw (CVE-2026-76504) used improper URL encoding handling to skip authentication entirely, granting admin access to any attacker who sent a crafted request.
BYOVD (Bring Your Own Vulnerable Driver)
An advanced attack technique where hackers load a legitimate but outdated kernel driver to gain elevated privileges and disable security software. Used by Warlock ransomware to kill AV/EDR tools on 40+ systems within two hours of initial access.
Advanced Persistent Threat (APT)
A well-funded, often government-backed hacking group conducting long-term targeted intrusions. Star Blizzard (linked to Russia's FSB) is an APT. Unlike opportunistic criminals, APTs are patient and methodical -- sometimes staying hidden for months or years.
Dwell Time
How long an attacker remains inside a network undetected after gaining initial access. The Pentagon DMDC breach had a dwell time of approximately 9 months (October 2025 to July 2026). Longer dwell time typically means more data stolen and a harder recovery.
Row-Level Security (RLS)
A database security feature controlling which rows of data each user may see or modify. The 16,326 exposed Supabase databases had RLS disabled -- every record in every table was publicly readable by anyone on the internet, no account needed.