October 8, 2026
CVE-2026-21589 in Atlassian Data Center products moved to active exploitation within two hours of public PoC release, with honeypots catching scanner traffic replaying exact traversal URLs. LMCache carries an unauthenticated pickle-deserialization RCE (CVE-2026-105192, CVSS 9.8) in multiprocess mode with no fix available, running as root in official containers. FortiBleed credential harvesting reached 86,644 Fortinet device credentials across 194 countries, with access being distributed to initial-access brokers and ransomware affiliates including INC and Lynx. Threat actors are moving C2 infrastructure onto blockchain smart contracts to enable rapid botnet repointing, while UAC-0099 / Earth Sirrush uses steganographic PNG images to hide ZIP payloads in spear-phishing campaigns.
September 23, 2026
ClosedQuorum, a Go-based Windows implant, queries DeepSeek, Qwen, and other commercial LLMs to autonomously vote on post-compromise actions including credential theft, code injection, and lateral movement via Discord webhooks, marking the first reported AI-integrated C2 malware. Gambit Security discovered a financially motivated operator using three open-source AI harnesses to compromise e-commerce sites at roughly $25 per target, spending over $7,000 on Claude Opus 4.6 API calls and stealing 600,000+ card records across 27+ companies. Microsoft dismantled EvilTokens, an AI-assisted OAuth device-code phishing service linked to 12,000+ compromised inboxes at 10,000+ organizations, with two UK arrests. Four vulnerabilities entered CISA's KEV catalog including Check Point CVE-2026-93616 (pre-auth RCE), Arista VeloCloud CVE-2026-93952 (CVSS 10.0, actively exploited), and F5 BIG-IP APM CVE-2026-94127; separately, ShinyHunters claimed a breach of the FBI's jobs portal via an unpatched Oracle PeopleSoft zero-day, allegedly accessing 2–3TB of employee data in AWS GovCloud.