ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
2026-10-01T19:23:40Z•6ffab81b02af7906bd6fb5e605bdeb03cfac986ac03eec4b8d07f62b2bd11275
CVE-2026-86950AppleClickFixMacfingerSANS ISCScreenConnect abuseWiresharkWordPressWordfenceactively exploited vulnerabilityiOSmacOSmalwareremote access softwarethreat intelligenceweb scanning
What happened
SANS Internet Storm Center feed entries covering attacker abuse of ScreenConnect, WordPress Wordfence scanning, Apple emergency patches for an actively exploited CVE-2026-86950, Wireshark vulnerability fixes, and malware associated with the Macfinger ClickFix campaign. The most urgent item is the Apple vulnerability, which is reported as actively exploited.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 6ffab81b02af7906bd6fb5e605bdeb03cfac986ac03eec4b8d07f62b2bd11275
- Enrichment time
- 2026-10-01T19:23:40Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.