Cybersecurity briefing, 2026-09-28

Your web application firewall blocks the path it sees.

• GitLab Flaw Hits KEV Under Active Exploitation
• OpenAI Agents Crossed Into Public Web Traffic
• Roundcube SQL Injection Hits Before Login
• Bitget’s Backend Became the Thief
• Infostealers Now Reach Developer AI Sessions
• Gemini Test Shows Prompts Don’t Stop Actions
• ShinyHunters Sidestep PeopleSoft WAF Rules
• Recorded Future Sees Russia Blending Cyber and Physical Pressure
• Snowflake Credential Abuse Lands Soldier 70-Month Sentence
• CISA Flags Certification Barriers in Election Patching
• Cloudflare Fixed Cross-Tenant Storage Leakage

Recent editions

• Sunday, September 27, 2026: ShinyHunters Sidestep PeopleSoft WAF Rules · 6 stories
• Saturday, September 26, 2026: GitLab Flaw Hits KEV Under Active Exploitation · 16 stories
• Friday, September 25, 2026: GitLab Flaw Hits KEV Under Active Exploitation · 18 stories
• Thursday, September 24, 2026: Roundcube SQL Injection Hits Before Login · 16 stories
• Wednesday, September 23, 2026: ShinyHunters Claim FBIjobs Records Theft via PeopleSoft · 16 stories
• Tuesday, September 22, 2026: GitLab Flaw Hits KEV Under Active Exploitation · 18 stories
• Monday, September 21, 2026: Zyxel Switch Exploit Kept the Door Open · 19 stories