Briefing — 1 October 2026

🎙️ Subscribe to the podcast feed

Security News

Attackers exploiting critical Zimbra flaw to steal emails (Ars Technica) — A critical vulnerability in Zimbra Collaboration Suite is being actively exploited to exfiltrate email backups and authentication credentials; Microsoft issued the warning and organisations running Zimbra should treat patching as immediate.

Russian state hackers use new RedFlick technique to push malware (BleepingComputer) — Star Blizzard (Russian APT) has adopted a new malware installation tactic dubbed RedFlick to deploy its CosmicPulse backdoor against government, defence, and think-tank targets.

Hackers stole millions of US military personnel records during months-long breach (Slashdot / SecurityWeek) — The Pentagon’s Defence Manpower Data Center breach exposed personal information for approximately 2.8 million living current and former US military personnel and staff.

ScreenConnect Client abused by attackers in phishing campaigns (SANS Internet Storm Center) — Threat actors are deploying the ScreenConnect remote monitoring and management client as a phishing payload, exploiting the tool’s whitelisted status to persist on enterprise networks.

Malicious Custom GPTs turn ChatGPT into RAT delivery lure (Dark Reading) — Threat actors are using customised ChatGPT instances in ClickFix-style social engineering campaigns to deliver Remote Access Trojans via legitimate OpenAI and Google domains.

OpenAI accuses Chinese Moonshot AI of “distillation attack” on its models (The Register) — OpenAI claims individuals associated with China’s Moonshot AI systematically queried its models to extract and replicate their capabilities — a distillation attack that began in July.

FTC investigating OpenAI and Anthropic over risks to consumers (SecurityWeek) — The US Federal Trade Commission has confirmed active investigations into both major AI labs over potential consumer harm from their AI systems.

Google unveils Gemini 4 Argon — first released to cyber defenders (Ars Technica) — Google’s new frontier model claims benchmark leadership across 13 of 18 categories; initial deployment is restricted to trusted cyber defenders, signalling the convergence of frontier AI with security operations.

US sanctions 10 over ATM jackpotting malware tied to Tren de Aragua (The Record) — Treasury’s OFAC sanctioned Venezuelan nationals and associated shell companies for deploying ATM jackpotting malware and laundering proceeds linked to the Tren de Aragua criminal gang.

UK & Critical National Infrastructure

The NCSC issued no new advisories in the past 48 hours. The Citrix NetScaler advisory (CVE-2026-88771 and CVE-2026-88772, CVSS 9.5) from Sunday remains fully in force — CISA’s mandatory remediation deadline for US federal agencies passed yesterday, and UK organisations that have not yet patched are operating with active risk.

Three UK businesses appear in this 48-hour ransomware window: maxwell-group.com (BrainCipher), Williamson Dacar Associates — an architecture and engineering firm — (The Gentlemen), and Defencebit, a cybersecurity consultancy with NATO-connected work (The Gentlemen). The compromise of a security consultancy carries secondary risk for their client base — engagement records, penetration test findings, and vulnerability assessments are all high-value intelligence for threat actors.

The active Zimbra exploitation is directly relevant to UK defenders. Zimbra is deployed across UK universities, local authorities, and mid-market enterprises — organisations that may be slower to patch than large enterprise. The Lamashtu group’s surge against German logistics and manufacturing targets mirrors patterns that have previously expanded into the broader European market; UK industrial and logistics organisations should monitor closely.

Ransomware Victims (48h)

82 victims • 22 groups

HaveIBeenPwned — New Breaches