Week in Review: Oct 1-4, 2026

Four days. Two exploited zero-days in mail infrastructure. A 3-million-record Pentagon breach. One ransomware operation taken down and another, state-linked, expanding its targeting.

Mail infrastructure: two KEV additions in one week

Fortinet FortiMail zero-day CVE-2026-104286 was added to CISA’s Known Exploited Vulnerabilities catalog on October 2. Exploitation confirmed. Affected FortiMail versions: per Fortinet’s PSIRT advisory.

Zimbra CVE-2026-73570: exploited in targeted attacks before the patch was available, according to Microsoft Threat Intelligence reporting. Zimbra published the patch after exploitation was already underway. The sequencing matters: there was no patch window.

Two actively exploited mail platform flaws, 24 hours apart, both in enterprise deployments. Mail servers remain high-value targets for initial access.

Pentagon DMDC breach: 3 million records

The Defense Manpower Data Center disclosed a breach October 2 affecting approximately 3 million U.S. military and government personnel files. DMDC maintains service records, benefits eligibility, and personnel rosters. Attribution and initial access vector: not confirmed in public statements as of October 4.

Ransomware: one operation down, one expanding

Operation KillSwitch, announced October 2, took down the KillSec ransomware-as-a-service operation. Arrests confirmed. Infrastructure seized. KillSec had been active since mid-2025, primarily targeting financial services and healthcare.

Warlock, a Chinese state-linked APT group, deployed ransomware against Iberian enterprises on October 2, an unusual pairing of financial disruption with a nation-state group typically focused on espionage. On October 3, Warlock was also linked to attacks on water and telecom operators via SharePoint vulnerabilities, broadening the target set to critical infrastructure. Attribution in both cases: multiple threat intelligence vendors; no government attribution statement as of publication.

Vicksburg, Mississippi city systems went offline October 4 due to a ransomware attack. Municipal services affected; no ransomware group publicly claimed responsibility at time of publication.

Patches and exploitation

Cisco SD-WAN Manager CVE-2026-76504: unauthenticated authentication bypass, confirmed exploited in the wild as of October 1. Patch available. SD-WAN Manager instances exposed to the internet carry active exploitation risk.

Apple CoreGraphics CVE with PoC released October 1: CISA KEV deadline was October 2 for federal agencies. Proof of concept publicly available as of the advisory date.

GitLab AI Gateway critical RCE (October 3): unauthenticated remote code execution in GitLab’s AI-assisted development platform. Cloud-hosted GitLab: patched by GitLab. Self-hosted installations required a manual update.

Dell Container Storage Modules: critical flaws allow attackers with network access to gain root on Kubernetes nodes. Affects CSM deployments running Kubernetes.

Fortra BoKS PAM: critical patches released October 3 for the privileged access management platform. No confirmed exploitation at publication.

Also this week

AI agents sent 200,000 attack requests to U.S. and Canadian government websites in a documented campaign disclosed October 2. The attack traffic used automated agentic tools; the government sites are not named. No confirmed breach from this campaign.

Bitget confirmed October 1 that last year’s $387.5 million cryptocurrency theft was enabled by a zero-day in a third-party component, not a direct credential failure. The third-party vendor is not named in the public statement.

MI5 disclosed October 4 that Chinese Ministry of State Security operations used 100-plus UK academics as intelligence sources over a multi-year period. The advisory names no individuals; it describes the recruitment methodology and sectors targeted.

Git hash chain malleability (October 1): security researchers published analysis of a structural supply chain risk in how git tracks commit integrity. No active exploitation documented; the research flags a trust assumption embedded in standard CI/CD pipelines.

Context

Warlock is the story worth watching beyond this week. A Chinese APT group deploying ransomware against critical infrastructure is a different threat profile from financially-motivated criminal operators: the operational goal, the persistence, and the acceptable collateral damage differ. Two separate targeting vectors confirmed in 48 hours. Whether the ransomware deployment is a revenue mechanism, a cover action, or something else is not confirmed.