October 5, 2026 Emerging Threats Weekly
This week’s briefing covers:
00:00 – Intro
00:59 [SOCIAL ENGINEERING] Attackers Turn ChatGPT Custom GPTs into a Delivery Path for ClickFix and RAT Deployment
Huntress documented a late-September campaign in which attackers used OpenAI’s Custom GPT feature to direct victims into a malware delivery chain. The operators created a community GPT named “Plus 5.6” that was designed to resemble an official model and promoted it through sponsored Google results.
05:02 [VULNERABILITY] Citrix NetScaler Zero-Day Exploited to Disrupt SAML Deployments
Citrix has released emergency security updates for CVE-2026-88779, a high-severity memory overflow vulnerability in NetScaler ADC and NetScaler Gateway. The flaw carries a CVSS v4 score of 8.7 and can cause denial of service when the appliance is configured as a SAML service provider or SAML identity provider.
08:02 [AI] GPT-6 Astra Testing Showed Repeated Out-of-Scope Supply-Chain Attack Behavior in Simulation
Reporting on a new UK AI Security Institute test indicates that OpenAI’s experimental GPT-6 Astra model repeatedly attempted supply-chain attacks against targets outside the defined test scope when standard safeguards were disabled.
11:18 [THREAT ACTOR] ShinyHunters Adapts Oracle PeopleSoft Exploitation With a Simple WAF Bypass
Mandiant and Google Threat Intelligence Group (GTIG) have reported on a second wave of mass exploitation of Oracle PeopleSoft by KTA223 (ShinyHunters) while expanding their targeting beyond the education-sector activity seen during the first wave we reported in June.
16:51 [VULNERABILITY] WordPress Core Flaw CVE-2026-87902 Moves into Active Exploitation
CISA’s addition of CVE-2026-87902 to the Known Exploited Vulnerabilities catalog confirms that attackers are exploiting the WordPress Core flaw in active campaigns. WordPress released security updates on September 22with fixes for affected branches back to WordPress 4.7.
19:17 [VULNERABILITY] Cisco SD-WAN Manager Flaw Is Under Active Exploitation
Cisco Catalyst SD-WAN Manager is being targeted through several vulnerabilities affecting its central management layer. Cisco and Cisco Talos have reported active exploitation of CVE-2026-20182, CVE-2026-20133, CVE-2026-20128 and CVE-2026-20122. The activity includes authentication bypass, information disclosure and arbitrary file overwrite techniques that can expose administrative access and sensitive system data.
Dive deeper:
Kroll’s Monthly Threat Intelligence Spotlight Report: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/cti-spotlight-trends-report
Kroll’s Cyber Threat Intelligence: https://www.kroll.com/en/services/cyber/threat-intelligence-services
Kroll’s 2025 Cyber Threat Landscape Report: Cybercrime in the Crypto Era: https://www.kroll.com/Reports/Cyber/Threat-Intelligence-Reports/Threat-Landscape-Report-Lens-on-Crypto
Playlist of Kroll's Weekly Cyber Threat Intelligence Briefings: https://www.youtube.com/playlist
Kroll Cyber Blog: https://www.kroll.com/en/insights/cyber
Kroll Threat Intelligence Reports: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports
Kroll Cyber and Data Resilience: https://www.kroll.com/en/services/cyber
#krollcyber #threatintelligence #cyberthreats