Issue #218 - September 28, 2026
Automated AI agent used to breach cybersecurity nonprofit DIVD
Source: BleepingComputer
Dutch nonprofit DIVD said an attacker exploited a technical vulnerability and then used an autonomous AI agent for post-exploitation. Investigators observed rapid, self-directed actions, password spraying, and verbose comments that exposed the agent’s reasoning. The incident was reported to police, the Dutch privacy authority, and the national cybersecurity center.
South Africa Seeks Help After Cyberattack Targets Air Traffic Control
Source: Dark Reading
South Africa’s Air Traffic and Navigation Services found ransomware-associated malware in an operational technology network supporting aviation weather services. Internal teams contained the activity, but the organization requested outside forensic assistance to determine the attack’s cause, scope, possible data exfiltration, and whether risks remain across affected airport environments.
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
Source: The Hacker News
Cisco confirmed active exploitation of CVE-2026-76504, a critical authentication bypass in Catalyst SD-WAN Manager. A crafted HTTP request can exploit improper URI-encoding handling and access the management API as an administrator without credentials. Cisco released fixed versions, warned that no workaround exists, and recommended restricting management interfaces to trusted hosts.
One Packet Can Crash OT Servers in Industrial Sectors
Source: Dark Reading
A high-severity integer-underflow vulnerability in the TDengine time-series database allows an unauthenticated attacker with network access to crash vulnerable servers using one malformed packet. The flaw could disrupt telemetry and operational visibility in industrial, energy, automotive, and IoT environments. Administrators should install the patched release and restrict access to port 6030.
Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation
Source: SecurityWeek
Dutch police arrested a 24-year-old Amsterdam man suspected of involvement with the ShinyHunters extortion group. The suspect, believed to be previously convicted hacker Pepijn van der Stap, was reportedly on supervised release. The investigation follows recent ShinyHunters activity involving data theft, social engineering, and an intrusion into an FBI employment website.