Cybersecurity briefing, 2026-09-28

Your web application firewall blocks the path it sees.

• JadePuffer used Azure identities to wipe recovery paths
• Apple CoreGraphics PoC lowers the exploit bar
• Citrix NetScaler exploitation hits gateways in the wild
• GitLab flaw hits KEV under active exploitation
• Roundcube SQL injection hits before login
• Team Cymru finds AI proxy layer hiding abuse origins
• Bitget’s backend became the thief
• Infostealers now reach developer AI sessions
• NVIDIA pushes Agent Safety into hardware enforcement
• AI agents are becoming privileged users
• UpGuard finds Supabase databases exposing user data
• Cloudflare fixed cross-tenant storage leakage
• Carbonato turns exposed Docker daemons into botnet hosts
• Microsoft links NeedyMantis to Storm-3069 campaign
• Bitget breach became a control-plane attack

Recent editions

• Sunday, September 27, 2026: AI agents leak screenshots, prompt data escapes again · 5 stories
• Saturday, September 26, 2026: GitLab flaw hits KEV under active exploitation · 15 stories
• Friday, September 25, 2026: Roundcube SQL injection hits before login · 18 stories
• Thursday, September 24, 2026: CISA flags TeamCity as a ransomware entry point · 18 stories
• Wednesday, September 23, 2026: Dutch arrest splits ShinyHunters leadership story · 17 stories
• Tuesday, September 22, 2026: GitLab flaw hits KEV under active exploitation · 19 stories
• Monday, September 21, 2026: Zyxel switch exploit kept the door open · 20 stories