Loki Intelligence — Security Briefs · Published
Daily Security Brief: SharePoint Ransomware, FortiMail and AI Gateway Risk
On-premises collaboration servers remain a reliable entry point, with Warlock still exploiting unpatched SharePoint while FortiMail and Zammad flaws are confirmed exploited and a critical GitLab AI Gateway bug awaits patching. Teams should prioritize SharePoint and mail gateway remediation, guard domain infrastructure against mass ransomware staging, and update self-hosted AI services.
Signal 01 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA's October 2 KEV update added two exploited Zammad vulnerabilities, CVE-2026-102489 (session fixation) and CVE-2026-102490 (improper privilege management). Per the catalog, chaining them can take an attacker from code execution as the zammad user to full root control of the server.
Why it matters: Confirm Zammad versions across environments, patch on an emergency basis, and investigate hosts that were exposed before patching, given the root-level outcome of the chain.
Source: CISA
Signal 02 · The Hacker News
The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations
A sponsored vendor report surveys how identity security, telemetry management, exposure management, email and domain security, connected devices, AI-assisted security operations and cloud security are changing. Its common thread is a shift toward continuous visibility and control as identities, devices and internet-facing infrastructure multiply.
Why it matters: Use it as a checklist rather than a buying guide: confirm you can inventory human and non-human identities, route security telemetry deliberately, and track exposed infrastructure continuously.
Source: The Hacker News
Signal 03 · The Hacker News
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
GitLab's critical AI Gateway flaw, CVE-2026-90970, sits in the prompt template handling of custom Duo Agent Platform flows and can allow command execution on self-hosted gateways. No fix is listed below 19.2.4, no workaround is offered, and the advisory gives no way to check whether a gateway was attacked.
Why it matters: Teams on older gateway lines should plan an upgrade path now and, until patched, restrict Duo Agent Platform access and watch gateway hosts for unexpected processes.
Source: The Hacker News
Signal 04 · BleepingComputer
GitLab warns of critical RCE vulnerability in AI Gateway service
BleepingComputer reports GitLab's warning that self-hosted AI Gateway deployments need version 19.2.4, 19.3.2 or 19.4.1 to close a critical command execution flaw. The report also recalls that a maximum-severity GitLab path traversal bug was added to CISA's KEV catalog only a day after its September fix.
Why it matters: GitLab flaws have moved quickly from disclosure to exploitation, so self-managed operators should patch AI Gateway components within days rather than waiting for regular maintenance cycles.
Source: BleepingComputer
Signal 05 · The Hacker News
Why CISOs Struggle to Answer the Board's Three Hardest Questions, and How to Fix the Report
A sponsored guide argues that boards want exposure, trends and financial impact rather than counts of closed findings. It illustrates how several moderate findings spread across identity, SaaS, cloud and data tools can together form a critical path to sensitive data that no single dashboard reveals.
Why it matters: Map how identities, including AI agents and service accounts, can reach crown-jewel assets, and prioritize fixes that cut those paths over isolated high-severity scores.
Source: The Hacker News
Signal 06 · The Hacker News
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
FortiMail's CVE-2026-104286 affects the 7.2, 7.4, 7.6 and 8.0 branches, and several fixed releases were still listed as upcoming when exploitation was confirmed. Fortinet's interim guidance is to disable IBE support and restrict the management interface to trusted networks until updates are available.
Why it matters: Where a fix is not yet available, apply the workarounds immediately and hunt for the published file and IP indicators, since mitigation does not undo an earlier compromise.
Source: The Hacker News
Signal 07 · The Hacker News
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
Symantec and Carbon Black report that Warlock, a suspected China-linked group also tracked as Storm-2603, continues exploiting on-premises SharePoint flaws against organizations in Portuguese- and Spanish-speaking countries. Intrusions included theft of ASP.NET machine keys, a vulnerable driver to disable security tools, VS Code tunnels, and ransomware pushed through the domain SYSVOL share.
Why it matters: Patch and mitigate on-premises SharePoint, rotate machine keys after any suspected compromise, block known vulnerable drivers, and monitor SYSVOL for unexpected executables.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.