SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 117
2026-10-04T14:51:38Z•19bc89a52bee84e31aa9564cfab989c48f666116229f9e3971aefefa0a643724
CVE-2026-102489CVE-2026-90970AI-GatewayAI-agentsCISA-KEVChina-linked-APTCloudSyncDGitLabMicrosoft-365-C2SQL-injectionSharePointShinyHuntersUAT-11587WarlockZammadbackdoorcritical-infrastructurefake-installermacOS-malwareransomwarereconnaissancezero-day-exploitation
What happened
Security Affairs coverage reports active exploitation of SharePoint flaws by Warlock ransomware against critical infrastructure, a critical GitLab AI Gateway vulnerability (CVE-2026-90970), CISA-listed exploited Zammad vulnerabilities including CVE-2026-102489, a macOS backdoor distributed through a fake Zoom installer, China-linked UAT-11587 espionage using Microsoft 365 for command and control, ShinyHunters investigations, and emerging risks from autonomous AI agents performing reconnaissance and SQL injection attempts.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 19bc89a52bee84e31aa9564cfab989c48f666116229f9e3971aefefa0a643724
- Enrichment time
- 2026-10-04T14:51:38Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.