Skip to content
Friday, October 2, 2026 · Daily edition · Vol. 1, No. 14Back issue

Vol. 1, No. 14Composed Oct 3 · 05:10 UTC

SitRep

An independent cybersecurity briefing — what matters, with its sources.

1 critical · 2 elevated5 stories on the wire

You are reading a back issue. Go to the latest edition →

The situation

City of Vicksburg Shuts Down After Ransomware

FortiMail CVE-2026-104286 exploited in the wild; patch within 3 days per BOD 26-04; enable workarounds now.

Composed by SitRep’s AI editors from 4 sources — Breaches.net, SecurityWeek, BleepingComputer, The Hacker News

The City of Vicksburg shut down municipal computer systems and disconnected internet operations following a ransomware incident, impacting a water and gas office that serves more than 10,000 utility accounts. This outage underscores the immediate risk to critical infrastructure even as defenders confront an exploited FortiMail zero-day (CVE-2026-104286) with federal patching requirements and constrained mitigation windows.

Context

Internet-facing appliances and platform components are the focal point: FortiMail email gateways are under active exploitation (CVE-2026-104286) and Dell Container Storage Modules expose unauthenticated admin access. Organizations running on-prem appliances, self-hosted gateways, or legacy SharePoint deployments are exposed and face rapid blast radius through web-facing management interfaces and chained post-exploit tooling.

“Defenders must pair urgent patching with immediate mitigations for management interfaces and focused detection on web request and SharePoint abuse patterns.”
From the analysis
The move

5 things to do today

  1. Patch FortiMail to 8.0.2, 7.6.7, or 7.4.9+ immediately or apply workarounds: disable IBE and restrict FortiMail web management access to trusted management networks (CVE-2026-104286).
  2. Upgrade Dell CSM to 1.18.0+ and verify storage management plane network segmentation and RBAC for PowerStore/PowerScale/PowerFlex/PowerMax/Unity XT (CVE-2026-63688, CVE-2026-63692).
  3. Patch self-hosted GitLab AI gateways to 19.2.4 / 19.3.2 / 19.4.1 and audit authenticated gateway commands (CVE-2026-90970).
  4. Hunt for ToolShell web shells, anomalous SharePoint file writes, and rapid lateral movement; collect and preserve SharePoint and IIS logs for investigation (Warlock activity, CVE-2025-1055).
  5. Monitor Microsoft 365 mailbox and OneDrive traffic for unusual automated C2 patterns and implement conditional access / disable legacy auth to reduce Antino C2 efficacy.

On the wire

  • 1critical
  • 2elevated
  • 2moderate
  • 0low
P0Exploit

FortiMail Zero-day CVE-2026-104286 Actively Exploited

FortiMail versions 7.2.0–8.0.1 are vulnerable to an unauthenticated arbitrary file write (CVSS 9.8) exploited in the wild; CISA added the CVE to KEV and issued a 3-day federal patching requirement. Patch to FortiMail 8.0.2 / 7.6.7 / 7.4.9+ immediately where possible; if not, disable IBE, restrict web management access to trusted networks, and deploy Fortinet IoCs for web-request detection.

Previously in SitRep Oct 1: FortiMail CVE-2026-104286 Actively Exploited; KEV Deadline Oct 4

SECURITYWEEK · Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action

Copy link to “FortiMail Zero-day CVE-2026-104286 Actively Exploited”

P1Patch

Dell CSM Flaws Allow Unauthenticated Admin Access — Upgrade Required

Two max-severity CSM flaws (CVE-2026-63688, CVE-2026-63692) and four additional critical issues impact Dell CSM connecting storage arrays to Kubernetes. Upgrade to CSM 1.18.0+ on PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT and validate RBAC and network access controls on storage management interfaces.

BLEEPINGCOMPUTER · Dell Patches Max Severity CSM Flaws, Urges Immediate Patch

Copy link to “Dell CSM Flaws Allow Unauthenticated Admin Access — Upgrade Required”

P2Vulnerability

GitLab AI Gateway Critical Flaw CVE-2026-90970 Patched for Self-hosted Gateways

A critical 9.9 flaw in GitLab AI Gateway could let a logged-in user with Duo Agent Platform access execute commands on the gateway. Patch self-hosted AI gateways to 19.2.4, 19.3.2, or 19.4.1 and review gateway logs for suspicious authenticated command execution attempts.

THE HACKER NEWS · GitLab Patches Critical 9.9 AI Gateway Flaw in Self-Hosted

Copy link to “GitLab AI Gateway Critical Flaw CVE-2026-90970 Patched for Self-hosted Gateways”

P1Ransomware

Warlock Ransomware Exploits SharePoint to Breach Utilities and Telecoms

Warlock actors exploited SharePoint (ToolShell) to deploy web shells, an AV/EDR killer, and a BYOVD workflow leveraging a K7RKScan driver (CVE-2025-1055), leading to breaches across utilities and telecoms. Prioritize hunts for web shells, unauthorized SharePoint file changes, credential misuse, and disable legacy SharePoint services where possible.

BLEEPINGCOMPUTER · Warlock Ransomware Exploits SharePoint Against Utilities and Telecom

Copy link to “Warlock Ransomware Exploits SharePoint to Breach Utilities and Telecoms”

P2Espionage

Antino Backdoor Uses Outlook/OneDrive for C2 in Regional Espionage Campaign

Cisco Talos links the Antino Rust backdoor (UAT-11587) to a China-nexus campaign abusing Outlook and OneDrive for C2 across 16 entities in eight Asian countries. Monitor Microsoft 365 activity for anomalous mailbox/OneDrive access patterns and block suspicious automation or legacy protocol abuse.

THE HACKER NEWS · Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage

Copy link to “Antino Backdoor Uses Outlook/OneDrive for C2 in Regional Espionage Campaign”

Vulnerabilities named in this edition

CVE-2026-104286 · CVE-2026-63688 · CVE-2026-63692 · CVE-2026-90970 · CVE-2025-1055

Known exploited

Added 2 Oct2 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-102489Zammad GmbH Zammad2 Oct5 Oct
CVE-2026-102490Zammad GmbH Zammad2 Oct5 Oct

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

Elsewhere in the edition

Crypto Scammers Hijack Microsoft’s Official X Account

Microsoft’s X account (13M+ followers) was taken over to amplify a Clippy-themed cryptocurrency. The attacker reposted messages, replaced the profile image with Clippy, and used a second account, @clippymsftcto, promoting a $Clippy token with liquidity paired to $MSFT. Posts were removed and a brief apology posted then deleted. Microsoft confirmed unauthorized access and is investigating.

2 reports

Android 17 Advanced Protection restricts Accessibility Services to Verified Tools

Google’s Android 17 introduces Advanced Protection that restricts AccessibilityService access to only verified Accessibility Tools when enabled, closing a major malware and fraud attack pathway. The measure preserves assistive tech while preventing abuse by malicious apps. The update also expands forensics with Intrusion Logging and other protections to counter spyware and fund-transfer fraud.

2 reports

Also reported

End of the Friday, October 2, 2026 edition.

Colophon

SitRep · Vol. 1, No. 14

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
Editors
Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure
Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections
brief@sitrepit.com or the contact page.