The situation

City of Vicksburg Shuts Down Computers After Ransomware Attack

FortiMail CVE-2026-104286 exploited in the wild; patch within 3 days per BOD 26-04; enable workarounds now.

Composed by SitRep’s AI editors from 4 sources — Breaches.net, SecurityWeek, BleepingComputer, The Hacker News

City of Vicksburg Shuts Down After Ransomware

The City of Vicksburg shut down municipal computer systems and disconnected internet operations following a ransomware incident, impacting a water and gas office that serves more than 10,000 utility accounts. This outage underscores the immediate risk to critical infrastructure even as defenders confront an exploited FortiMail zero-day (CVE-2026-104286) with federal patching requirements and constrained mitigation windows.

Context

Internet-facing appliances and platform components are the focal point: FortiMail email gateways are under active exploitation (CVE-2026-104286) and Dell Container Storage Modules expose unauthenticated admin access. Organizations running on-prem appliances, self-hosted gateways, or legacy SharePoint deployments are exposed and face rapid blast radius through web-facing management interfaces and chained post-exploit tooling.

“Defenders must pair urgent patching with immediate mitigations for management interfaces and focused detection on web request and SharePoint abuse patterns.”

The read

The through-line: critical, internet-facing platforms and appliances are either being actively exploited or causing operational outages, compressing patch windows and forcing reliance on network controls and rapid detection.

Breaches.net · SecurityWeek · BleepingComputer

What most will miss

Assuming Vendor Patches Alone Mitigate Risk

Most teams will assume vendor patches or cloud hosting absolve them of responsibility. That is the wrong read because internet-facing management interfaces and feature flags (for example IBE on FortiMail or SharePoint services) are the immediate attack vectors defenders must secure with network controls and mitigations before or alongside patching.

SecurityWeek · BleepingComputer

The move

5 things to do today

Patch FortiMail to 8.0.2, 7.6.7, or 7.4.9+ immediately or apply workarounds: disable IBE and restrict FortiMail web management access to trusted management networks (CVE-2026-104286).
Upgrade Dell CSM to 1.18.0+ and verify storage management plane network segmentation and RBAC for PowerStore/PowerScale/PowerFlex/PowerMax/Unity XT (CVE-2026-63688, CVE-2026-63692).
Patch self-hosted GitLab AI gateways to 19.2.4 / 19.3.2 / 19.4.1 and audit authenticated gateway commands (CVE-2026-90970).
Hunt for ToolShell web shells, anomalous SharePoint file writes, and rapid lateral movement; collect and preserve SharePoint and IIS logs for investigation (Warlock activity, CVE-2025-1055).
Monitor Microsoft 365 mailbox and OneDrive traffic for unusual automated C2 patterns and implement conditional access / disable legacy auth to reduce Antino C2 efficacy.

On the wire

P0Exploit

FortiMail Zero-day CVE-2026-104286 Actively Exploited

FortiMail versions 7.2.0–8.0.1 are vulnerable to an unauthenticated arbitrary file write (CVSS 9.8) exploited in the wild; CISA added the CVE to KEV and issued a 3-day federal patching requirement. Patch to FortiMail 8.0.2 / 7.6.7 / 7.4.9+ immediately where possible; if not, disable IBE, restrict web management access to trusted networks, and deploy Fortinet IoCs for web-request detection.

SECURITYWEEK · Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action

P1Patch

Dell CSM Flaws Allow Unauthenticated Admin Access — Upgrade Required

Two max-severity CSM flaws (CVE-2026-63688, CVE-2026-63692) and four additional critical issues impact Dell CSM connecting storage arrays to Kubernetes. Upgrade to CSM 1.18.0+ on PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT and validate RBAC and network access controls on storage management interfaces.

BLEEPINGCOMPUTER · Dell Patches Max Severity CSM Flaws, Urges Immediate Patch

P2Vulnerability

GitLab AI Gateway Critical Flaw CVE-2026-90970 Patched for Self-hosted Gateways

A critical 9.9 flaw in GitLab AI Gateway could let a logged-in user with Duo Agent Platform access execute commands on the gateway. Patch self-hosted AI gateways to 19.2.4, 19.3.2, or 19.4.1 and review gateway logs for suspicious authenticated command execution attempts.

THE HACKER NEWS · GitLab Patches Critical 9.9 AI Gateway Flaw in Self-Hosted

P1Ransomware

Warlock Ransomware Exploits SharePoint to Breach Utilities and Telecoms

Warlock actors exploited SharePoint (ToolShell) to deploy web shells, an AV/EDR killer, and a BYOVD workflow leveraging a K7RKScan driver (CVE-2025-1055), leading to breaches across utilities and telecoms. Prioritize hunts for web shells, unauthorized SharePoint file changes, credential misuse, and disable legacy SharePoint services where possible.

BLEEPINGCOMPUTER · Warlock Ransomware Exploits SharePoint Against Utilities and Telecom

P2Espionage

Antino Backdoor Uses Outlook/OneDrive for C2 in Regional Espionage Campaign

Cisco Talos links the Antino Rust backdoor (UAT-11587) to a China-nexus campaign abusing Outlook and OneDrive for C2 across 16 entities in eight Asian countries. Monitor Microsoft 365 activity for anomalous mailbox/OneDrive access patterns and block suspicious automation or legacy protocol abuse.

THE HACKER NEWS · Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage

Indicators named in this edition

Kind	Value	Note
CVE	CVE-2026-104286	FortiMail arbitrary file write; KEV entry and federal 3-day patching requirement
CVE	CVE-2026-63688	Dell CSM max-severity flaw allowing unauthenticated admin access
CVE	CVE-2026-63692	Dell CSM max-severity flaw allowing unauthenticated admin access
CVE	CVE-2026-90970	GitLab AI Gateway critical RCE for logged-in Duo Agent Platform users
CVE	CVE-2025-1055	K7RKScan driver used in Warlock BYOVD chain

Elsewhere in the edition

Crypto Scammers Hijack Microsoft’s Official X Account

Microsoft’s X account (13M+ followers) was taken over to amplify a Clippy-themed cryptocurrency. The attacker reposted messages, replaced the profile image with Clippy, and used a second account, @clippymsftcto, promoting a $Clippy token with liquidity paired to $MSFT. Posts were removed and a brief apology posted then deleted. Microsoft confirmed unauthorized access and is investigating.

2 reports

SECURITYWEEKCrypto Scammers Hijack Microsoft’s Official X Account
BLEEPINGCOMPUTERMicrosoft X account hacked in crypto pump-and-dump scheme

Android 17 Advanced Protection restricts Accessibility Services to Verified Tools

Google’s Android 17 introduces Advanced Protection that restricts AccessibilityService access to only verified Accessibility Tools when enabled, closing a major malware and fraud attack pathway. The measure preserves assistive tech while preventing abuse by malicious apps. The update also expands forensics with Intrusion Logging and other protections to counter spyware and fund-transfer fraud.

2 reports

THE HACKER NEWSAndroid 17 Advanced Protection restricts Accessibility Services to Verified Tools
HELP NET SECURITYAndroid 17 Enhances Advanced Protection Against Spyware

Police Take Down KillSec Ransomware Gang Run by Teenager

Europol-led Operation KillSwitch dismantled KillSec, seizing 110 TB of data, five central servers, and group infrastructure after arrests across Europe. Since 2024 the ransomware carried out about 1,000 attacks targeting healthcare, finance, government, and SMBs. The ringleader is 16, with a main developer who recently turned 18; investigation identified core members and multiple victims, with Gr…

2 reports

NEWSAPI CYBER INSIGHTSPolice Take Down KillSec Ransomware Gang Run by Teenager
NEWSAPI CYBER INSIGHTSPolice Target KillSec Ransomware Group With Arrests and Seizures

Also reported

BLEEPINGCOMPUTERFrontline Education Breach Impacts School District Employee Data
BLEEPINGCOMPUTERU.S. Sanctions Tren de Aragua Members in ATM Jackpotting Crackdown
SECURITYWEEKiCloud Spoofing Bugs, Adblocker Data Harvest, and AI Phishing
SECURITYWEEKmacOS Fake Zoom Installer Carries CloudSyncD Backdoor in the Wild
THE HACKER NEWSOpenAI Fires Three Safety Researchers Over Mishandling Data
THE HACKER NEWSCISOs' Board-Reporting Gaps and a Practical Framework
SECURITYWEEKIranian Mabna Institute Hacker Extradited to the United States
TRAIL OF BITS BLOGSequenceHash: Multihashing for the Rest of Us
SECURITYWEEKAI Agents Targeted SQL Injection on US, Canada Government Sites
NEWSAPI CYBER INSIGHTSMicrosoft: AI Cuts Post-Compromise Attack Time to Minutes

End of the Friday, October 2, 2026 edition.