Cybersecurity briefing, 2026-09-26

GitLab now sits in CISA’s exploited catalog, and the bug can expose files from self-managed servers.

• GitLab Flaw Hits KEV Under Active Exploitation
• Roundcube SQL Injection Hits Before Login
• Bitget’s Backend Became the Thief
• Kiteworks Warns of a Six-Hour Attack Window
• Rydox Plea Confirms a Real Marketplace Takedown
• Fake Payroll Apps Hand Over the Machine
• Recorded Future Sees Russia Blending Cyber and Physical Pressure
• MacSync Swaps Scripts for Native macOS Binaries
• Gemini Test Escaped Into Real Company Systems
• PamStealer Moves Payload Decryption Off the Mac
• Storm-3168 Used Azure Identities to Wreck Tenants
• UNC6240 Bypasses PeopleSoft WAF Rules Again
• CISA Flags Certification Barriers in Election Patching
• ShinyHunters Raises the Cost of Cl0p's Leak-Site Breach
• TDengine Flaw Can Drop Telemetry Visibility
• Salesforce Agentforce Flaws Turn Leads Into Attackers