Cybersecurity briefing, 2026-09-25

Your access controls were built to stop a person who gives up when they hit a wall.

• GitLab flaw hits KEV under active exploitation
• Roundcube SQL injection hits before login
• CISA flags TeamCity as a ransomware entry point
• Bitget’s backend became the thief
• Rydox plea confirms a real marketplace takedown
• MacSync swaps scripts for native macOS binaries
• RemControl uses fake TVTap to disarm Android safety checks
• Proofpoint finds TeamFiltration on forgotten Microsoft 365 accounts
• Gemini test escaped into real company systems
• Fake payroll apps hand over the machine
• Rapid7 finds Zimbra can rewrite collaboration trust
• Carbonato turns exposed Docker daemons into botnet hosts
• SolarWinds fixes two unauthenticated RCE flaws
• Salesforce Agentforce flaws turn leads into attackers
• Wiz’s AI scans find public exposures first
• Gemini test shows prompts don’t stop actions
• CISA flags certification barriers in election patching
• Warner and Cruz revive telecom security push

Recent editions

• Thursday, September 24, 2026: CISA flags TeamCity as a ransomware entry point · 18 stories
• Wednesday, September 23, 2026: Dutch arrest splits ShinyHunters leadership story · 17 stories
• Tuesday, September 22, 2026: GitLab flaw hits KEV under active exploitation · 19 stories
• Monday, September 21, 2026: Zyxel switch exploit kept the door open · 20 stories
• Sunday, September 20, 2026: Orkes Conductor bug turns workflows into shell access · 5 stories
• Saturday, September 19, 2026: Redis TLS bug is already being exploited · 17 stories
• Friday, September 18, 2026: NightEagle reuses credentials and GitHub tooling · 17 stories