On Call Brief – Week of September 27 – October 3, 2026

2026-09-27 — 2026-10-03 Briefing: 2026-09-27 Published 1 week ago (Oct 4, 2026 3:46 am EDT) 16 min read
Share
Category:
Tags:

This week's top stories

1. Custom ChatGPTs push ClickFix attacks to deploy RAT malware

  • Category: Deep Dive
  • What happened: Custom versions of ChatGPT are being used in ClickFix attacks to redirect users to malicious sites that deploy RAT malware. These attacks exploit sponsored Google results to target unsuspecting individuals.
  • Takeaway: Operators should be aware of the potential for malware delivery through deceptive AI tools, which could compromise systems and data security - vigilance in monitoring and user education is essential.
  • Source: Bleeping Computer
  • Tags:

2. ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)

  • Category: Deep Dive
  • What happened: Attackers are exploiting the ScreenConnect client by sending phishing emails that link to a malicious executable. The executable is a legitimate ScreenConnect client configured to connect back to the attacker's server. This highlights the risk of trusted remote management tools being misused for unauthorized access.
  • Takeaway: Organizations using ScreenConnect or similar remote management tools should review their security measures, especially regarding email filtering and executable downloads, to prevent such phishing attacks.
  • Source: SANS ISC
  • Tags:

CVE & Security

3. Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

  • Category: Security / Patch
  • What happened: A critical security flaw in Fortinet FortiMail, tracked as CVE-2026-104286, has been added to CISA's Known Exploited Vulnerabilities catalog due to reports of active exploitation. This vulnerability allows unauthenticated attackers to write arbitrary files on the system, posing a significant risk to affected installations.
  • Do this Monday: Organizations using FortiMail should prioritize patching this vulnerability to prevent unauthorized access and potential data breaches - immediate action is necessary due to active exploitation.
  • Source: The Hacker News
  • Tags:

4. Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution

  • Category: Security / Patch
  • What happened: A critical security vulnerability in Citrix NetScaler ADC and Gateway, identified as CVE-2026-88772, has been disclosed. This memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol can lead to shellcode execution and is currently being exploited in the wild.
  • Do this Monday: Operators using Citrix NetScaler should prioritize applying the security patch for CVE-2026-88772 to mitigate the risk of exploitation and potential system compromise.
  • Source: The Hacker News
  • Tags:

5. Citrix NetScaler CVE-2026-8452: Pre-Auth Root RCE & Active CISA KEV Exploitation

  • Category: Security / Patch
  • What happened: Citrix NetScaler ADC and Gateway appliances contain CVE-2026-8452, a critical pre-authentication memory-overflow vulnerability that allows unauthenticated remote code execution with root privileges. CISA has added this CVE to the Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. Threat actors are deploying web shells disguised with CSS-like URLs and creating superuser accounts to maintain persistent access and exfiltrate configuration data from compromised appliances. Operators should immediately patch all NetScaler ADC and Gateway instances, audit systems for unauthorized superuser accounts, search web directories for suspicious files matching CSS naming patterns, and review configuration backups for signs of unauthorized access or data theft.
  • Do this Monday: The vulnerability poses a significant risk as it allows attackers to gain immediate access to corporate environments through compromised NetScaler appliances, which handle authentication and remote access. Immediate action is required to prevent exploitation.
  • Sources: dev.to (DevOps tag), The Hacker News
  • Tags:

6. Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities

  • Category: Security / Patch
  • What happened: Citrix has confirmed two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway, CVE-2026-88771 (improper input validation) and CVE-2026-88772, both enabling remote code execution and actively exploited in the wild. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities Catalog and mandated that U.S. federal agencies patch affected systems by Wednesday. Citrix released security updates on September 27 to address these flaws. Operators running NetScaler ADC or Gateway should immediately apply the available patches and verify that all instances are updated, prioritizing internet-facing deployments given the active exploitation.
  • Do this Monday: These vulnerabilities pose a significant risk as they are actively exploited, necessitating immediate patching of affected Citrix NetScaler systems to prevent potential breaches.
  • Sources: Tenable Blog, CISA Cybersecurity Advisories, Bleeping Computer
  • Tags:

7. Apple Patches Actively Exploited Zero-Day in iOS 26 and macOS (CVE-2026-86950)

  • Category: Security / Patch
  • What happened: Apple released emergency security updates to address CVE-2026-86950, a CoreGraphics vulnerability actively exploited in sophisticated targeted attacks on iOS devices, as reported by Meta. The vulnerability affects iOS 26, macOS 26, and macOS 15, while newer iOS and macOS 27 versions are not impacted. Operators should immediately apply the emergency patches to all affected iOS 26, macOS 26, and macOS 15 systems in their environment. Organizations should prioritize patching user-facing devices and mobile endpoints given the active exploitation in targeted attacks. Systems already running iOS or macOS 27 do not require action for this specific vulnerability.
  • Do this Monday: Operators using affected versions of iOS and macOS should prioritize applying these patches to mitigate the risk of exploitation. The vulnerability's active exploitation highlights the need for vigilance in monitoring and updating systems.
  • Sources: SANS ISC, Bleeping Computer
  • Tags:

8. USN-8816-4: Linux kernel (GKE) vulnerabilities

  • Category: Security / Patch
  • What happened: Multiple Linux kernel vulnerabilities have been patched across Ubuntu distributions, affecting GKE, FIPS, and standard kernel packages with issues spanning ARM64, S390, x86 architectures, NFS server daemon, IPv6 networking, Netfilter subsystems, and various network drivers and file systems. These vulnerabilities could allow local attackers to bypass memory protections, escalate privileges, or compromise systems through affected subsystems. Operators running Ubuntu systems should apply the relevant kernel updates immediately through standard package management (apt-get update && apt-get upgrade linux-image-*), paying particular attention to GKE clusters and FIPS-compliant systems which require dedicated kernel packages. A reboot will be required after installing the updated kernel packages to ensure the patched version is active.
  • Do this Monday: This update is critical as it addresses multiple vulnerabilities that could lead to system compromise. Operators should prioritize applying this update to mitigate potential security risks.
  • Sources: Ubuntu Security Notices (USN)
  • Tags:

9. ALAS2023-2026-3103 (important): kernel6.12

  • Category: Security / Patch
  • What happened: This advisory addresses multiple CVEs related to kernel version 6.12, highlighting critical vulnerabilities that could affect system security. The listed CVEs include CVE-2026-64058, CVE-2026-64068, CVE-2026-72288, CVE-2026-72398, CVE-2026-72413, CVE-2026-74347, CVE-2026-74405, CVE-2026-80844, and CVE-2026-81000.
  • Do this Monday: Operators should prioritize applying the security patches for kernel 6.12 to mitigate risks associated with these vulnerabilities, as they could lead to significant security breaches.
  • Source: Amazon Linux 2023 Security Advisories (ALAS2023)
  • Tags:

10. Cloudflare fixes Containers cross-tenant flaw exposing customer data

  • Category: Security / Patch
  • What happened: Cloudflare has addressed a vulnerability in its Containers and Sandboxes that permitted customers with a Workers Paid account to access residual data from other customers' containers on the same physical host. This flaw posed a risk of data exposure between tenants.
  • Do this Monday: This fix is critical as it mitigates the risk of cross-tenant data exposure, which could affect customer trust and compliance. Operators using Cloudflare's services should ensure they are on the latest version to benefit from this patch.
  • Source: Bleeping Computer
  • Tags:

11. CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)

  • Category: Security / Patch
  • What happened: CVE-2026-104002 identifies a fail-open error handling issue in the data masking utility of Powertools for AWS Lambda (Python). This vulnerability could allow unauthorized actors to access sensitive field values that should be masked. The affected versions are between 3.6.0 and 3.34.0.
  • Do this Monday: This vulnerability poses a risk to applications using the affected versions of Powertools for AWS Lambda, potentially exposing sensitive data. Immediate attention is required to mitigate this risk by updating to a secure version.
  • Source: AWS Security Bulletins
  • Tags:

12. ESXi Exploitation in the Wild

  • Category: Security / Patch
  • What happened: The article discusses the exploitation of a vulnerability in ESXi, which allows attackers to escape from a virtual machine and execute code on the host. This vulnerability has been observed in the wild, raising concerns about the security of ESXi deployments. The discussion highlights the implications for organizations using ESXi and the need for immediate patching to mitigate risks.
  • Do this Monday: Organizations using ESXi should prioritize patching to prevent potential exploitation of this vulnerability, which could lead to significant security breaches.
  • Source: Huntress via Lobsters
  • Discussion: https://lobste.rs/s/f6dogm/esxi_exploitation_wild
  • Tags:

13. CVE-2026-104020 - Uncontrolled recursion in the Ion reader in Amazon Ion Python

  • Category: Security / Patch
  • What happened: CVE-2026-104020 identifies a denial of service vulnerability in the Ion reader of Amazon Ion Python versions prior to 0.15.0. A crafted deeply nested Ion value can cause the application to crash or raise an error.
  • Do this Monday: This vulnerability could lead to service disruptions if affected versions are used in production environments. Immediate updates to version 0.15.0 or later are recommended to mitigate the risk.
  • Source: AWS Security Bulletins
  • Tags:

14. Chromium: 2 security fixes

  • Category: Security / Patch
  • What happened: Microsoft's Security Update Guide listed 2 Chromium vulnerabilities this week, which reach Microsoft Edge through its Chromium engine: CVE-2026-91728 (integer overflow); CVE-2026-91745 (use after free).
  • Do this Monday: This CVE could potentially allow attackers to exploit the integer overflow, leading to security risks in applications using Chromium. Operators should assess their use of Chromium and apply necessary patches.
  • Sources: Microsoft MSRC Security Update Guide
  • Tags:

15. 10 vulnerabilities attackers are exploiting right now: what to patch this week (21 to 25 September 2026)

  • Category: Security / Patch
  • What happened: This article lists ten vulnerabilities that are currently being exploited, as added to CISA's Known Exploited Vulnerabilities (KEV) catalogue between September 21 and 25, 2026. Each entry includes the product affected and its corresponding CVE ID, emphasizing the urgency for patching these vulnerabilities. Additionally, it highlights alerts from European authorities regarding critical vulnerabilities in F5 BIG-IP APM and WordPress Core, suggesting that these should be prioritized for remediation. The article also mentions a data breach involving LimeLeads, advising readers to check if their addresses were compromised.
  • Do this Monday: Operators should prioritize patching the listed vulnerabilities to mitigate the risk of exploitation. The overlap of alerts from CISA and European authorities indicates a heightened threat level for certain products, particularly F5 BIG-IP APM and WordPress Core. Awareness of the LimeLeads breach is also crucial for assessing potential risks to user accounts.
  • Source: dev.to (DevOps tag)
  • Tags:

16. ALAS2KERNEL-5.4-2026-131 (important): kernel

  • Category: Security / Patch
  • What happened: This advisory addresses multiple CVEs affecting the kernel in Amazon Linux 2, specifically CVE-2026-64564, CVE-2026-68138, CVE-2026-74582, and CVE-2026-74688. It is important for users to apply the recommended updates to mitigate potential security vulnerabilities.
  • Do this Monday: Failure to update may expose systems to security risks associated with the listed CVEs - critical for maintaining system integrity and security.
  • Source: Amazon Linux 2 Security Advisories (ALAS2)
  • Tags:

17. ALAS2023-2026-3114 (important): dotnet8.0

  • Category: Security / Patch
  • What happened: Amazon Linux 2023 has released a security advisory for dotnet 8.0 addressing vulnerabilities identified as CVE-2026-58649 and CVE-2026-62886. These vulnerabilities may pose security risks and require immediate attention from users of dotnet 8.0 on Amazon Linux 2023.
  • Do this Monday: Operators using dotnet 8.0 on Amazon Linux 2023 should prioritize applying the security updates to mitigate potential risks associated with the identified vulnerabilities.
  • Source: Amazon Linux 2023 Security Advisories (ALAS2023)
  • Tags:

18. ALAS2023-2026-3112 (important): qemu

  • Category: Security / Patch
  • What happened: The advisory details multiple vulnerabilities in QEMU, specifically CVE-2026-17516, CVE-2026-63323, and CVE-2026-66022. These vulnerabilities may affect systems running QEMU and require attention for patching to maintain security.
  • Do this Monday: Operators should prioritize applying security patches for QEMU to mitigate risks associated with these vulnerabilities - failure to do so could lead to potential exploitation.
  • Source: Amazon Linux 2023 Security Advisories (ALAS2023)
  • Tags:

19. RHSA-2026:72264: Critical: unbound security update

  • Category: Security / Patch
  • What happened: A critical security update for unbound is available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service. This update addresses vulnerabilities rated as critical by Red Hat Product Security, with detailed severity ratings provided via CVSS.
  • Do this Monday: Operators using Red Hat Enterprise Linux 8.8 should prioritize applying this critical update to mitigate potential security risks associated with unbound vulnerabilities.
  • Source: Red Hat Security Advisories (RHSA)
  • Tags:

20. Status page: 2 service incidents

  • Category: Security / Patch
  • What happened: GitLab is experiencing two separate service degradations affecting its SaaS platform: security and vulnerability reports are failing to load or ingest for some users, and email delivery is delayed for certain email service providers. The team has identified the root cause for the security reports issue and is implementing mitigation, while the email delivery problem has been escalated to their third-party email provider. Operators using GitLab SaaS should monitor GitLab Status for updates and be aware that security scanning results may not be immediately visible and notification emails may arrive late. No action is required for self-managed GitLab instances as these issues are specific to the GitLab.com infrastructure.
  • Do this Monday: This incident may affect users relying on security reports for vulnerability management, potentially delaying their ability to respond to security issues.
  • Sources: GitLab Status
  • Tags:

Also this week

Deep dives & postmortems

21. Job processing and scheduling is degraded affecting multiple Atlassian products

  • Category: Deep Dive
  • What happened: Atlassian is experiencing degraded job processing and scheduling across multiple cloud products including Jira, Confluence, and Bitbucket Cloud. Users are encountering delayed or missing job executions, which specifically impacts email-to-ticket processing in Jira Service Management and scheduled tasks across all affected platforms. Operators should monitor their scheduled job queues for backlog and delays, check for missing automated processes that may need manual intervention, and watch official Atlassian status pages for incident updates and resolution timelines. If critical automated workflows are failing, consider implementing temporary manual processes or workarounds until the platform issue is resolved.
  • Takeaway: This incident may lead to delays in ticket processing and response times, affecting service level agreements and backlog management for users relying on Atlassian products. Operators should be aware of potential disruptions in scheduled tasks and job executions.
  • Sources: Jira Status, Bitbucket Status, Confluence Status
  • Tags:

22. Copilot Code Review is unable to complete reviews

  • Category: Deep Dive
  • What happened: Copilot Code Review experienced performance issues, preventing successful reviews. The incident has been resolved, and users can now re-request reviews on their pull requests. A detailed root cause analysis will be provided later.
  • Takeaway: This incident affected the ability to complete code reviews using Copilot, which may have delayed development workflows for teams relying on this feature - users should re-request reviews for previously impacted pull requests.
  • Source: GitHub Status
  • Tags:

Human Stories

There's something unsettling about watching legitimate tools become attack vectors, and this week put that tension front and center. ScreenConnect and custom ChatGPTs aren't inherently dangerous - they're productivity multipliers we've come to depend on - but attackers have gotten remarkably good at turning our trust in familiar interfaces against us. The Atlassian job processing issues and Copilot Code Review outage remind us that even platform-level services we treat as infrastructure can wobble, and when they do, we're left scrambling to explain delays we didn't cause. What strikes me is how thin the line has become between operational dependency and operational risk. We build on these platforms, we automate with these tools, and somewhere along the way we have to stay alert enough to recognize when something familiar is behaving just slightly wrong.

Also worth reading

I got targeted: Trying to get your credentials via a git post-checkout hook (Lobsters)

The article discusses an incident where the author was targeted by an attack attempting to steal credentials through a git post-checkout hook. It details the method of the attack and the implications for security practices in software development.

Our users were logged out for two weeks before Redis refused to write anything (dev.to (SRE tag))

A web app experienced user logouts due to a Redis configuration issue. For two weeks, users were logged out intermittently, which was initially attributed to browser cookie clearing. Eventually, the app could not log in any users as Redis reached its memory limit and refused writes. The problem stem

Who Reads Your 2 a.m. Alert? (Security Boulevard)

The article discusses a security incident involving Qantas, where an impersonator gained unauthorized access to a data extraction tool by deceiving a third-party contact center agent. This highlights the importance of alert monitoring and response protocols in preventing such breaches.
Kubernetes News Cloud News DevOps Security News CI/CD News SRE News