cybr.cx Daily Digest — October 04, 2026

Critical Vulnerabilities

⚠️ Actively Exploited — CVE-2026-102489 & CVE-2026-102490 | Zammad | No CVSS Listed

These two Zammad vulnerabilities are being chained in active attacks right now — CISA's remediation deadline was yesterday. CVE-2026-102489 is a session fixation flaw enabling remote code execution as the zammad user; CVE-2026-102490 then escalates that foothold to root via improper privilege management. If you're running Zammad for helpdesk or ticketing, treat this as an emergency patch — the exploit chain is clean, the access gained is total.

⚠️ Actively Exploited — CVE-2026-104286 | Fortinet FortiMail | No CVSS Listed

An unauthenticated attacker can write arbitrary files to the underlying system via crafted HTTP/HTTPS requests exploiting a path traversal combined with null byte injection. CISA's remediation deadline was today. FortiMail sits at the perimeter for many organisations — arbitrary file write on a mail gateway is a direct path to persistent backdoors. Patch or isolate immediately.

⚠️ Actively Exploited — CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | No CVSS Listed

A hex encoding flaw in URI handling allows an unauthenticated remote attacker to access Catalyst SD-WAN Manager with full admin privileges. No credentials required. SD-WAN management planes are high-value targets for both nation-state actors and ransomware groups seeking lateral movement across distributed network infrastructure. CISA's deadline passed October 3rd.

⚠️ Actively Exploited — CVE-2026-86950 | Apple iOS, macOS, iPadOS | No CVSS Listed

An out-of-bounds write in CoreGraphics can lead to arbitrary code execution on Apple devices. This is being actively exploited in the wild — the attack surface includes virtually every Apple device in your environment. Ensure devices are on the latest OS versions. Mobile device management policies should flag unpatched endpoints immediately.

⚠️ Actively Exploited — CVE-2026-88771 & CVE-2026-88772 | Citrix NetScaler ADC & Gateway | No CVSS Listed

Two separately listed but related NetScaler flaws: CVE-2026-88771 allows unauthenticated arbitrary command execution via improper input validation; CVE-2026-88772 enables remote code execution or denial of service through an out-of-bounds memory operation. NetScaler appliances are perennial targets — threat actors have historically moved fast on these. CISA remediation deadlines have already passed. If you haven't patched, assume exposure.

CVE-2026-105115 | OpenAM | CVSS 8.6 — HIGH

OpenAM before 16.1.3 exposes a legacy JAX-RPC SOAP interface at /jaxrpc/* that allows unauthenticated callers to specify arbitrary class names for instantiation. Depending on what's available on the classpath, this could reach remote code execution via deserialization gadget chains — or at minimum crash the server or enumerate internal classes. Identity and access management platforms are crown-jewel targets; upgrade to 16.1.3 without delay.

CVE-2026-82044 | UTMStack | CVSS 7.7 — HIGH

Authenticated attackers in UTMStack before 11.2.16 can abuse the PdfService.downloadPdf() method to make the web-pdf microservice fetch arbitrary internal URLs — a textbook SSRF. Internal backend endpoints, OpenSearch, and other microservices may be reachable. In a SIEM product, where internal trust between services is typically high, SSRF is a serious pivot point. Upgrade to 11.2.16.

CVE-2026-104433 | Mooncake Transfer Engine | CVSS 7.5 — HIGH

An unauthenticated attacker can crash Mooncake's transfer engine — used in SGLang inference serving and similar AI infrastructure — by sending an eight-byte zero-length handshake frame to the publicly listening handshake port. The out-of-bounds read in readString kills the hosting process instantly. AI inference infrastructure is increasingly production-critical; this is a trivial denial-of-service. Upgrade to 0.3.12.

CVE-2026-104478 | Formwork CMS | CVSS 7.1 — HIGH

Any Formwork panel user with backup download or delete permissions can supply a base64-encoded, backslash-separated path traversal payload to escape the backup directory and read or delete arbitrary files on the server. PHP's basename() does not protect against backslash traversal on Linux. Upgrade to 2.3.13 or audit backup permissions tightly in the interim.

Headline News

Hackers Breach Oil Tanker's Propulsion System Approaching U.S. Coast

U.S. investigators have confirmed that attackers accessed the propulsion control system of an oil tanker as it approached the Texas coast — a significant escalation in maritime cyber incidents. The breach demonstrates that operational technology (OT) aboard commercial vessels is increasingly reachable by threat actors, likely via internet-exposed satellite communication links or compromised shore-side management systems. For practitioners, this is a reminder that IT/OT segmentation on maritime assets frequently lags far behind land-based critical infrastructure — propulsion, ballast, and navigation systems often share network segments with crew Wi-Fi and administrative systems. The consequences of manipulation in a busy coastal shipping lane extend well beyond data theft into physical safety and potential environmental catastrophe. Port authorities, vessel operators, and insurers should be treating this as a wake-up call for mandatory OT security assessments.

Law Enforcement Tool Reportedly Bypasses iOS's Restricted Mode

A credible report indicates that law enforcement agencies have obtained or developed tooling capable of circumventing iOS's "Restricted Mode" — the feature that limits USB accessory access after one hour of inactivity and is specifically designed to block forensic extraction hardware like Cellebrite. The technique reportedly works without the device passcode, which would represent a meaningful regression in iPhone security for high-risk users — journalists, activists, lawyers, and anyone whose device may be subject to physical seizure. The exact method has not been publicly disclosed, suggesting a zero-day or newly discovered implementation flaw rather than a policy bypass. Practitioners advising at-risk clients should review current iOS hardening guidance and ensure devices are running the latest firmware, while acknowledging that physical access to an unlocked or recently active device remains the most significant threat vector regardless of software controls.

Kingston Police Confirm 100,000 Documents Exfiltrated in 2025 Breach

Canadian law enforcement has disclosed that a January 2025 cyber incident at the Kingston Police Service resulted in the theft of approximately 100,000 documents containing personal information and court records. The delayed disclosure — now nearly 22 months after the incident — raises serious questions about breach notification timelines for public safety organisations handling sensitive judicial and civilian data. Court records in particular may contain victim information, witness details, informant data, and sealed materials — exposure with direct physical safety implications. The incident follows a pattern of municipal and law enforcement agencies underestimating breach severity at discovery and over-restricting disclosure pending investigations. Practitioners working with public sector clients should be pushing hard on defined maximum disclosure windows in incident response plans.

Schrödinger's Feed

Researchers have demonstrated that quantum fluctuations in nominally empty space — vacuum fluctuations — can meaningfully strengthen superconductivity, raising the transition temperature of an ultrathin material by up to 5.4% by engineering the surrounding vacuum environment. This is a genuinely strange result: the vacuum itself, properly shaped, becomes a tool for controlling quantum material properties rather than mere background noise. While this sits at the materials science end of the quantum spectrum today, higher-temperature superconductivity is one of the foundational prerequisites for scalable fault-tolerant quantum hardware. Practitioners tracking the post-quantum cryptography migration timeline should note that breakthroughs in qubit stability and operating temperature tend to compress the "when does this become a cryptographic threat" timescale in ways that are difficult to forecast.

/dev/random

The developers of a space strategy game called Against All Odds have shipped something quietly remarkable: a fully functional RISC-V emulator embedded inside the game engine that boots and runs actual Linux. This isn't an easter egg — it's used as part of the game's systems simulation, meaning players can interact with what is effectively a general-purpose Linux VM tucked inside a commercial title. The emulator, dubbed pasriscv, is accurate enough to run a real kernel, which puts it in rare company for in-game computing. This is the spiritual descendant of the tradition that gave us Doom running on everything from oscilloscopes to pregnancy tests — except this time someone shipped Linux-on-RISC-V-inside-a-spaceship-game to Steam.