Cybersecurity briefing, 2026-10-07

The newest ClickFix variant needs no download.

• HFS Cookie Flaw Opens a Remote Code Execution Path
• FBI Breach Followed a Missed PeopleSoft Patch
• ClingSTUN Switched From Discovery to Active Exploitation
• Gentlemen Affiliate Broke the RaaS Money Flow
• ClickFix Uses Browser Cache to Evade Run Limits
• Langflow Exploitation Turns AI Builders Into Secret Vaults
• CrowdStrike Finds a Blind Spot in LLM Guards
• Blinder Tunnel Hides Iranian Intrusions in GitHub
• Wikimedia Links OpenAI Agents to Wikipedia Outage
• Atlassian File-Read Flaw Still Matters On-Prem
• Nikkei Mailbox Hijack Reached Journalistic Sources
• ASOS App Alert Turned Extortion Channel
• WordPress Plugin XSS Leaves Backdoors Behind
• Fake ChatGPT Sites Steal Ad Accounts
• Ploutus Arrest Could Link ATM Jackpotting Crews
• Rapid7 Sees Backdoors Copy Local Email Security Brands
• Forescout Finds PQC Bottleneck in Medical Hardware

Recent editions

• Tuesday, October 6, 2026: ClingSTUN Switched From Discovery to Active Exploitation · 19 stories
• Monday, October 5, 2026: Rejetto HFS Cookie Forgery Opens Remote Code Execution · 19 stories
• Sunday, October 4, 2026: Acronis Reframes RMM Security Around Recovery · 3 stories
• Saturday, October 3, 2026: Acronis Reframes RMM Security Around Recovery · 13 stories
• Friday, October 2, 2026: Acronis Reframes RMM Security Around Recovery · 19 stories
• Thursday, October 1, 2026: Cisco SD-WAN Bypass Hits the Control Plane · 19 stories
• Wednesday, September 30, 2026: Citrix NetScaler Escalates Past Chrome’s Routine Fix · 17 stories