--- title: "Cisco SD-WAN Vulnerability, Citrix Zero-Days, SharePoint Ransomware Risk – Cybersecurity News [October 05, 2026] | DuoCircle" description: "Explore this week’s top cybersecurity news, including zero-day exploits, AI-driven attacks, ransomware threats, phishing campaigns, and major data breaches." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/cybersecurity-news-update-week-41-of-2026/" --- Quick Answer This week’s cybersecurity news covers zero-day exploits, AI-driven attacks, ransomware, phishing campaigns, and major data breaches. Organizations should patch vulnerable systems, secure exposed services, and strengthen email security with SPF, DKIM, and DMARC. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fcybersecurity-news-update-week-41-of-2026%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Cisco%20SD-WAN%20Vulnerability%2C%20Citrix%20Zero-Days%2C%20SharePoint%20Ransomware%20Risk%20%E2%80%93%20Cybersecurity%20News%20%5BOctober%2005%2C%202026%5D&url=undefined%2Fblog%2Fcybersecurity-news-update-week-41-of-2026%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fcybersecurity-news-update-week-41-of-2026%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fcybersecurity-news-update-week-41-of-2026%2F&title=Cisco%20SD-WAN%20Vulnerability%2C%20Citrix%20Zero-Days%2C%20SharePoint%20Ransomware%20Risk%20%E2%80%93%20Cybersecurity%20News%20%5BOctober%2005%2C%202026%5D "Share on Reddit") [ ](mailto:?subject=Cisco%20SD-WAN%20Vulnerability%2C%20Citrix%20Zero-Days%2C%20SharePoint%20Ransomware%20Risk%20%E2%80%93%20Cybersecurity%20News%20%5BOctober%2005%2C%202026%5D&body=Check out this article: undefined%2Fblog%2Fcybersecurity-news-update-week-41-of-2026%2F "Share via Email") ![cybersecurity news update](https://media.mailhop.org/duocircle/spf-permerror-6700-1791792735316.jpg) Here’s a roundup of the most important [cybersecurity](https://www.duocircle.com/blog/state-cybersecurity-2026-data-insights-risks-trends-actions-next-steps/) stories from the past week, covering actively exploited zero-days, a **new Apple patch**, a critical AI tooling flaw, and several breaches that affected patients and customers. [Email security](https://www.duocircle.com/) measures like [SPF](https://www.duocircle.com/email/spf-management/), DKIM, and DMARC also help reduce spoofing and [phishing risks](https://www.duocircle.com/blog/password-threats-how-stolen-credentials-put-business-email-at-risk/) by **verifying sender identity**. ## Cisco SD-WAN Manager zero-day gives attackers admin access! _Cisco has warned about CVE-2026-76504, a critical flaw rated 9.8 in its Catalyst SD-WAN Manager_. An unauthenticated attacker can send crafted requests and gain administrator access. Cisco has confirmed active exploitation and says no fix is available yet, so network teams should restrict access to the **management interface now**. Source: [Check Point Threat Intelligence Report, 5 October 2026 checkpoint](https://research.checkpoint.com/2026/5th-october-threat-intelligence-report/) ## Citrix patches two NetScaler zero-days that were exploited before fixes existed! Citrix confirmed that **CVE-2026-88771 and CVE-2026-88772** were being exploited against [NetScaler ADC and Gateway appliances](https://www.bleepingcomputer.com/news/security/citrix-warns-admins-to-patch-new-netscaler-rce-flaw-immediately/). A third related flaw, CVE-2026-88779, then appeared only days after the first two were patched, which makes the appliances a priority for immediate updates. Source: [NetworkTigers Cybersecurity Weekly Roundup, 5 October 2026 networktigers](https://news.networktigers.com/cybersecurity-news/roundup-october-5-2026/) ![Spf Record Check 1276](https://media.mailhop.org/duocircle/spf-record-check-1276-1791793236157.jpg) ## SharePoint flaw moves into active exploitation and ransomware risk rises! _Attackers are exploiting CVE-2026-65660 in Microsoft SharePoint, and the flaw has a CISA KEV deadline that has already passed_. Researchers have seen attempts to plant web shells, and the overlap with the **initial-access methods** of the Warlock ransomware group makes on-premises SharePoint servers a key ransomware target. Source: [TechJack Weekly Security Intelligence Briefing, Week of 5 October 2026 techjacksolutions](https://techjacksolutions.com/security/briefing/weekly-security-intelligence-briefing-week-of-2026-10-05/) ## Critical GitLab AI Gateway flaw allows command execution! GitLab patched CVE-2026-90970, a critical **AI Gateway vulnerability** rated 9.9\. Authenticated Duo Agent Platform users can escape the prompt-template sandbox and run arbitrary commands on the host. Any team running a [self-managed GitLab AI Gateway](https://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html) should apply the patch quickly. Source: [Check Point Threat Intelligence Report, 5 October 2026 checkpoint](https://research.checkpoint.com/2026/5th-october-threat-intelligence-report/) ## Atlassian warns of a flaw that exposes Data Centre files! Atlassian has warned about CVE-2026-21589, rated 9.3, which lets unauthenticated attackers reach specific files in the root directory of **Data Centre applications**. Administrators of self-hosted Atlassian products should check whether their instances are on a vulnerable version. Source: [Telefonica Tech Cybersecurity Weekly Briefing, 3-9 October 2026 telefonicatech](https://telefonicatech.com/en/blog/cybersecurity-briefing-3-9-october-2026) ![Spf Validator 7876](https://media.mailhop.org/duocircle/spf-validator-7876-1791794264258.jpg) ## Hacker group Azazel steals GitLab credentials and deletes databases! An operator called [Azazel used a local MCP service](https://shattered.io/gentlemen-ransomware-azazel-gitlab-cicd-secrets-2026/) to run SSH commands and check for ransom notes across victim networks. The campaign hit logistics, insurance, pharmaceutical, AI, medical device and government-linked organisations. In one case more than 120,000 records were stolen and the PostgreSQL data directory was deleted, showing the attacks went beyond ordinary encryption. Source: [Telefonica Tech Cybersecurity Weekly Briefing, 3-9 October 2026 telefonicatech](https://telefonicatech.com/en/blog/cybersecurity-briefing-3-9-october-2026) ## PoeLLM malware has compromised over 3,400 servers! [Black Lotus Labs](https://cyberscoop.com/poellm-malware-botnet-poem-lumen-black-lotus-labs/), the research arm of **Lumen Technologies**, documented PoeLLM, malware that has compromised more than 3,400 servers since April by exploiting open-source AI services such as LiteLLM, Ollama, Gotenberg and Gitea. Any organisation running self-hosted AI tools should audit those services for exposure. Source: [Telefonica Tech Cybersecurity Weekly Briefing, 3-9 October 2026 telefonicatech](https://telefonicatech.com/en/blog/cybersecurity-briefing-3-9-october-2026) ![Dmarc Report Service 1278](https://media.mailhop.org/duocircle/dmarc-report-service-1278-1791794223461.jpg) ## Russian group Star Blizzard expands phishing with a new malware technique! Star Blizzard has shifted toward larger [phishing campaigns](https://www.scworld.com/brief/russian-hacking-group-star-blizzard-expands-phishing-operations-with-new-malware-technique), using compromised websites to deliver email and a new RedFlick technique to [install the CosmicPulse malware](https://www.esecurityplanet.com/threats/news-redflick-windows-cosmicpulse-backdoor/). Microsoft has seen at least 13 campaigns against governments, NGOs, think tanks, researchers and financial organisations. Source: [NetworkTigers Cybersecurity Weekly Roundup, 5 October 2026 networktigers](https://news.networktigers.com/cybersecurity-news/roundup-october-5-2026/) ## Microsoft says attackers are now using AI faster than defenders! _Microsoft’s Digital Defense Report 2026 concludes that attackers are benefiting from AI faster than defenders do_. The report estimates that the median time from discovering a vulnerability to having a working exploit is now **well under 24 hours**. Source: [Cyber Threat Landscape Weekly Roundup #08, 5 October 2026 Substack](https://chareek4eedad.substack.com/p/cyber-threat-landscape-weekly-roundup-83d) ## South African air traffic control operator finds ransomware-linked malware! The company that runs [South Africa’s air traffic control found malware](https://mybroadband.co.za/news/security/670359-china-linked-hackers-attacked-south-africas-air-traffic-control-system.html) linked to ransomware inside an operational network. The incident shows how critical infrastructure is still exposed when operational technology is connected to corporate networks. Source: [Cyber Threat Landscape Weekly Roundup #08, 5 October 2026 Substack](https://chareek4eedad.substack.com/p/cyber-threat-landscape-weekly-roundup-83d) ## Arizona state court system breached through a phishing email! Arizona’s state court system suffered a phishing attack after an employee clicked a malicious link. Attackers copied backup files containing **protective-order records** and more than 150,000 Foster Care Review Board reports. Source: [Check Point Threat Intelligence Report, 5 October 2026 checkpoint](https://research.checkpoint.com/2026/5th-october-threat-intelligence-report/) ## Rejetto HFS flaw, found by AI, is now being exploited! CVE-2026-61500 lets attackers recover the session-cookie signing key, which can give them administrative access and [remote code execution](https://www.cloudflare.com/learning/security/what-is-remote-code-execution/). The flaw was discovered with AI assistance and is already being exploited, so anyone still running Rejetto HFS should remove or update it. Source: [SecurityWeek News securityweek](https://www.securityweek.com/news/) ![Sender Policy Framework 1273](https://media.mailhop.org/duocircle/sender-policy-framework-1273-1791794130044.jpg) ## 250,000 patients affected by breaches at two healthcare firms! Hackers stole patient information from Clover Health Investments and AngMar Management Services in July. The breaches affected healthcare customers in **New Jersey and Texas** and add to the growing toll on the health sector. Source: [SecurityWeek News securityweek](https://www.securityweek.com/news/) ## Zammad zero-day chain was exploited by an autonomous AI agent! _CVE-2026-102489 and CVE-2026-102490 in Zammad 6.3.0 to 6.5.4 form a zero-day chain that was exploited to breach DIVD, and CISA has listed them as actively exploited_. The attack is reported as one of the first documented cases of an autonomous AI agent carrying out a real intrusion. Source: [TechJack Weekly Security Intelligence Briefing, Week of 5 October 2026 techjacksolutions](https://techjacksolutions.com/security/briefing/weekly-security-intelligence-briefing-week-of-2026-10-05/) ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fcybersecurity-news-update-week-41-of-2026%2F) [ ](https://twitter.com/intent/tweet?text=Cisco%20SD-WAN%20Vulnerability%2C%20Citrix%20Zero-Days%2C%20SharePoint%20Ransomware%20Risk%20%E2%80%93%20Cybersecurity%20News%20%5BOctober%2005%2C%202026%5D&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fcybersecurity-news-update-week-41-of-2026%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fcybersecurity-news-update-week-41-of-2026%2F) Copy Related Articles - [ ![Cybersecurity News](https://media.mailhop.org/duocircle/spf-permerror-5610-1779093389633.jpg) Cisco SD-WAN Flaw, Critical NGINX Exploit, Foxconn Ransomware Attack – Cybersecurity News \[May 11, 2026\] Blog ](/blog/cybersecurity-news-update-week-20-of-2026/) - [ ![Cybersecurity news](https://media.mailhop.org/duocircle/spf-permerror-5667-1779700511937.jpg) GitHub Code Leak, 7-Eleven Breached, NYC Patient Exposure – Cybersecurity News \[May 18, 2026\] Blog ](/blog/cybersecurity-news-update-week-21-of-2026/) - [ ![Cybersecurity news](https://media.mailhop.org/duocircle/spf-permerror-5686-1780301891080.jpg) FBI Warns Firms, Carnival Breach, GlobalProtect Flaw – Cyber News Blog ](/blog/cybersecurity-news-update-week-22-of-2026/) - [ ![cybersecurity news](https://media.mailhop.org/duocircle/spf-record-4590-1780921768387.jpg) DentaQuest Leak, Cisco Patch Pending, Instagram Bug – Cyber News Blog ](/blog/cybersecurity-news-update-week-23-of-2026/) ## Related Articles [ news Cisco SD-WAN Flaw, Critical NGINX Exploit, Foxconn Ransomware Attack – Cybersecurity News \[May 11, 2026\] May 18, 2026 ](/blog/cybersecurity-news-update-week-20-of-2026/)[ news GitHub Code Leak, 7-Eleven Breached, NYC Patient Exposure – Cybersecurity News \[May 18, 2026\] May 25, 2026 ](/blog/cybersecurity-news-update-week-21-of-2026/)[ news FBI Warns Firms, Carnival Breach, GlobalProtect Flaw – Cyber News Jun 1, 2026 ](/blog/cybersecurity-news-update-week-22-of-2026/)[ news DentaQuest Leak, Cisco Patch Pending, Instagram Bug – Cyber News Jun 8, 2026 ](/blog/cybersecurity-news-update-week-23-of-2026/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Cisco SD-WAN Vulnerability, Citrix Zero-Days, SharePoint Ransomware Risk – Cybersecurity News [October 05, 2026]","description":"Explore this week’s top cybersecurity news, including zero-day exploits, AI-driven attacks, ransomware threats, phishing campaigns, and major data breaches.","url":"https://www.duocircle.com/blog/cybersecurity-news-update-week-41-of-2026/","datePublished":"2026-10-12T00:00:00.000Z","dateModified":"2026-10-12T00:00:00.000Z","dateCreated":"2026-10-12T00:00:00.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/cybersecurity-news-update-week-41-of-2026/"},"articleSection":"news","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/spf-permerror-6700-1791792735316.jpg","caption":"cybersecurity news update"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"news"},{"@type":"ListItem","position":3,"name":"Cisco SD-WAN Vulnerability, Citrix Zero-Days, SharePoint Ransomware Risk – Cybersecurity News [October 05, 2026]","item":"https://www.duocircle.com/blog/cybersecurity-news-update-week-41-of-2026/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"news","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Cisco SD-WAN Vulnerability, Citrix Zero-Days, SharePoint Ransomware Risk – Cybersecurity News [October 05, 2026]","item":"https://www.duocircle.com/blog/cybersecurity-news-update-week-41-of-2026/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Cisco SD-WAN Vulnerability, Citrix Zero-Days, SharePoint Ransomware Risk – Cybersecurity News [October 05, 2026]","description":"Explore this week’s top cybersecurity news, including zero-day exploits, AI-driven attacks, ransomware threats, phishing campaigns, and major data breaches.","url":"https://www.duocircle.com/blog/cybersecurity-news-update-week-41-of-2026/","datePublished":"2026-10-12T00:00:00.000Z","dateModified":"2026-10-12T00:00:00.000Z","dateCreated":"2026-10-12T00:00:00.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/cybersecurity-news-update-week-41-of-2026/"},"articleSection":"news","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/spf-permerror-6700-1791792735316.jpg","caption":"cybersecurity news update"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```