Monday, September 28, 2026 · Daily editionBack issueBack issues · Search

SitRep

An independent cybersecurity briefing — what matters, with its sources.

You are reading a back issue. Go to the latest edition →

The situation

Keio Ransomware Disrupts Hospitality and Payments

Keio shut down its network after a ransomware incident; 59,000 Tokyo Metro emails breached weekend link under investigation.

Composed by SitRep’s AI editors from 3 sources — BleepingComputer, Unit 42, SANS Internet Storm Center

Keio Ransomware Disrupts Hospitality and Payments

Keio Corporation confirmed a ransomware incident on Sept 26 that forced a network shutdown and disrupted hospitality services and payment processing. Investigators are evaluating data exposure scope, while Tokyo Metro reported 59,000 breached email addresses over the same weekend.

Context

Operational outages and data exposure reflect attackers leveraging exposed services, misconfigurations, and third‑party weaknesses. Organizations with internet-facing assets or cloud identities should assume rapid containment and credential rotation will be required to limit lateral movement and data loss.

“The through-line is urgent patching, isolation, and credential hygiene as immediate priorities.”
The move

5 things to do today

  1. Patch Citrix ADC and Gateway for CVE-2026-88771 and CVE-2026-88772 immediately; isolate internet‑facing NetScaler appliances until updates are applied.
  2. Apply emergency Apple updates for CVE-2026-86950 to iOS 26, macOS26, and macOS15 devices and prioritize detection on older OS telemetry.
  3. Discover and remediate public Supabase endpoints: audit ACLs, revoke exposed tokens, rotate passwords, and search logs for unauthorized reads.
  4. Rotate credentials and keys for Azure service principals, reapply resource locks, and validate backups and restore processes after suspected compromise.
  5. Isolate impacted networks, preserve evidence, and restore from validated backups for Keio‑class ransomware incidents while engaging legal and law enforcement.

On the wire

P0Ransomware

Keio Ransomware Disrupted Hospitality Systems and Payments

Keio shut down its corporate network after a ransomware incident that disrupted hospitality operations and likely payment processing; investigators are cooperating with police. Isolate affected networks, preserve logs and images for forensic triage, and prioritize restoring validated backups while coordinating with legal and law enforcement.

BLEEPINGCOMPUTER · Keio ransomware attack disrupts hospitality systems and payments

P0Exploit

NetScaler zero‑days CVE-2026-88771 and CVE-2026-88772 Under Active Exploitation

Unit 42 reports two NetScaler zero‑days (CVE-2026-88771 RCE via unauthenticated input validation; CVE-2026-88772 memory overflow causing RCE/DoS) with CVSS 9.5 and ~50,277 exposed instances observed. Immediately patch Citrix ADC/Gateway to vendor‑released versions, isolate internet‑facing appliances until updated, and scan for signs of exploitation.

UNIT 42 · Threat Brief: NetScaler Zero-Day Exploits CVE-2026-88771 and CVE-2026-88772

P1Patch

Apple Issues Emergency Fixes for CVE-2026-86950 on Older iOS/macOS

Apple released emergency patches for iOS 26, macOS26, and macOS15 to address CVE-2026-86950, which is being actively exploited on older devices. Deploy the emergency updates where applicable, prioritize fleet devices on affected versions, and monitor EDR/telemetry for exploitation indicators on older OS versions.

SANS INTERNET STORM CENTER · Apple Emergency Patch for iOS 26, macOS26, macOS15 addresses CVE-2026-86950

P1Data Exposure

Misconfigured Supabase Instances Expose PII and Authentication Tokens

UpGuard researchers found over 16,000 publicly accessible Supabase databases exposing PII, plaintext passwords, and auth tokens across multiple countries. Inventory Supabase endpoints, audit public database ACLs, revoke and rotate exposed tokens and passwords, and search logs for unauthorized queries or data exfiltration.

BLEEPINGCOMPUTER · Over 16,000 Supabase databases expose PII and authentication tokens

P1Cloud Threat

JadePuffer Used AI Agents and Compromised Service Principals to Destroy Azure Resources

JadePuffer leveraged compromised service principals to enumerate Azure tenants, steal keys, and delete or corrupt resources (100+ storage accounts affected). Hunt for anomalous service principal activity, rotate exposed credentials and keys, reapply resource locks, and verify backup integrity and restore procedures.

BLEEPINGCOMPUTER · JadePuffer Agentic Attacks Target Azure, Destroy Cloud Resources

Indicators named in this edition

KindValueNote
CVECVE-2026-88771NetScaler unauthenticated RCE
CVECVE-2026-88772NetScaler memory overflow causing RCE/DoS
CVECVE-2026-86950Apple CoreGraphics exploit fixed in emergency updates

Elsewhere in the edition

Dutch Police Arrest Suspect Linked to ShinyHunters Hacking Group

Dutch police confirm the arrest of a 24-year-old Amsterdam man, likely connected to the ShinyHunters hacking group. The suspect, identified as Pepijn van der Stap (aka Umbreon), faced a January 2023 arrest and four-year prison sentence. He is set to appear at Rotterdam District Court on September 29; investigators probe possible ties to ShinyHunters and prior breaches.

5 reports

Former US Soldier Sentenced for Hacking AT&T and Verizon

Cameron John Wagenius, 22, a former Army soldier, was sentenced to 70 months in prison and $294,978 restitution for hacking AT&T and Verizon, stealing call detail records, and extortion. He operated 2023–2024 while on active duty, disclosed records in Nov 2024, and conspired to extort at least $1 million with accomplices using stolen credentials and the SSH Brute tool.

4 reports

NeedyMantis Used to Sustain Long-Term Access in Breached Networks

NeedyMantis malware maintains long-term access after breaches across telecoms, universities, medical nonprofits, intergovernmental bodies, and contractors since Oct 2025. It arrives as a three-part bundle (legit program, malicious DLL via DLL sideloading, encrypted archive) and communicates with a C2 over HTTPS, then WebSocket for module loading. Links to Storm-3069/UNC6863 activity and indicator…

2 reports

Stolen AI Logins Across 80,000+ Organizations Spotlight LLMjacking

More than 80,000 corporate domains have AI logins found in infostealer logs. The SOCRadar study narrows to 482 major firms, with 68% being billion-dollar organizations. ChatGPT/OpenAI sessions dominate the stolen-credentials dataset; other tools like Zapier, Hugging Face, and Replit appear. Recommendations include enforcing SSO, rotating API keys, and monitoring session tokens to detect LLMjackin…

2 reports

Nvidia Unveils AI Agent Safety Platform With Hardware-Based Watchdog

Nvidia launches the Open Agent Safety Platform, pairing OpenShell 0.1.0 with Sentry on BlueField-4 DPUs to sandbox and enforce policies for AI agents. Sentry provides in-silicon enforcement via DOCA, quarantining agents that exceed software boundaries. The platform runs on Vera Rubin PODs and supports 100+ organizations and partners including Anthropic, Salesforce, and SAP.

2 reports

Kiteworks Urges Server Shutdown Over Advanced Forms Flaw

Kiteworks advised a nine-hour precautionary shutdown of on-premises and customer-hosted instances after credible threat intelligence about a vulnerability in its Advanced Forms product. Fewer than 1% of customers (under 50 organizations) are affected; other Kiteworks products remain unaffected. No evidence of exploitation; guidance to update to release 9.5.1 and work with Mandiant. Systems were b…

2 reports

Also reported

End of the Monday, September 28, 2026 edition.