Cybersecurity briefing, 2026-10-01

Zimbra mail servers were actively exploited through an optional package path that enabled unauthenticated remote code execution.

• GTIG Says AI Is Compressing Exploit Timelines
• Zimbra Flaw Opened Mail Servers to Silent Intrusion
• Star Blizzard Scales Espionage Phishing With One Reply
• CSuite Phishing Adds Endpoint Control to Mailbox Theft
• ChatGPT Custom GPTs Carried ClickFix Lures
• OpenInfra Europe Artifactory Breach Threatens Downstream Builds
• AI Agents Are Becoming Privileged Users
• OpenSSL DTLS Bug Leaks Heap Data in Handshakes
• WatchGuard Widens Fixes Beyond the Firebox
• AI Agents Pushed Private Screenshots Into Public GitHub
• ScreenConnect Installer Turned Trust Into Access
• Bitget Breach Became a Control-Plane Attack
• Zammad Chain Left Root Access Open

Recent editions

• Wednesday, September 30, 2026: Zimbra Flaw Opened Mail Servers to Silent Intrusion · 17 stories
• Tuesday, September 29, 2026: Artifactory Login Bypass Hits Supply-Chain Trust · 17 stories
• Monday, September 28, 2026: JadePuffer Used Azure Identities to Wipe Recovery Paths · 15 stories
• Sunday, September 27, 2026: AI Agents Leak Screenshots, Prompt Data Escapes Again · 4 stories
• Saturday, September 26, 2026: GitLab Flaw Hits KEV Under Active Exploitation · 14 stories
• Friday, September 25, 2026: GitLab Flaw Hits KEV Under Active Exploitation · 18 stories
• Thursday, September 24, 2026: Roundcube SQL Injection Hits Before Login · 16 stories