September 16, 2026
- NeuralOverride puts an LLM into a RAT’s planning loop, but its ICS capability appears incomplete. Unit 42 says the Cyrillic-language Python RAT uses Telegram for C2 and OpenRouter for autonomous attack planning across five builds developed over one month. Its SCADA tasking references a missing
scada_commander.py, indicating stubs rather than a working OT module (Unit 42). · AI & Agent Security
in CVE-2026-76461 Gives Remote Attackers Root on Cisco Email Gateways