Newsletter

Aramis:Current Daily

Newest edition: 2026-09-30

1. Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

   Cisco, 2026-09-30. Read, 7 min.

   Cisco disclosed CVE-2026-76504 (CVSS 9.8), a flaw in the API authentication of Cisco Catalyst SD-WAN Manager that could let an unauthenticated, remote attacker access an affected system with the privileges of the admin user, and says its PSIRT became aware of active exploitation in September 2026. Fixed releases include 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1, and the Cisco-managed cloud release 20.15.605 needs no customer action.

   In the latest edition for: Cybersecurity Specialist (2026-09-30), Incident Responder (2026-09-30), Network Security Engineer (2026-09-30), Security Engineer (2026-09-30), Vulnerability Management Analyst (2026-09-30)

2. US trade regulator opens investigation into AI giants including Anthropic and OpenAI

   The Guardian, 2026-09-30. Read, 2 min.

   The Federal Trade Commission is conducting an industry-wide investigation into Anthropic, OpenAI and other AI labs to uncover the potential dangers their technology poses to consumers. According to multiple reports, the FTC plans to issue formal demands for information and compel testimony from executives at top AI developers, including Anthropic, OpenAI and the research group Metr.

   In the latest edition for: AI GRC Consultant (2026-09-30), Cyber/Privacy Attorney (2026-09-30), Global AI Privacy & Compliance Analyst (2026-09-30)

3. Beyond source code: A path to the keys to the kingdom

   Microsoft Defender Experts Cybersecurity Incident Response, 2026-09-29. Read, 6 min.

   Microsoft's Detection and Response Team (DART) describes an intrusion in which Storm-3068 took over a user account through a self-service password reset, registered its own authentication methods, and used legitimate identity and cloud services rather than malware or software exploits to reach Azure DevOps, pipelines, and Kubernetes resources. The actor created a pipeline to harvest Kubernetes credentials and modified pipeline scripts to install the Atera remote management agent and download the Chisel tunneling utility.

   In the latest edition for: Azure Security Architect (2026-09-30), DevSecOps Engineer (2026-09-30), IAM Engineer (2026-09-30)

4. French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks

   The Hacker News, 2026-09-29. Read, 7 min.

   ANSSI's incident report on France's tax administration, the DGFIP, found that an attacker logged in to portals that asked only for a password, using staff passwords probably taken by infostealers from computers the DGFIP did not manage. Neither the DGFIP's SOC nor ANSSI's monitoring saw the data leave, and the theft became known only when the attacker claimed it on August 12.

   In the latest edition for: Detection Engineer (2026-09-30), Incident Responder (2026-09-30)

5. About the security content of iOS 26.7.1 and iPadOS 26.7.1

   Apple, 2026-09-28. Read, 2 min.

   Apple released iOS 26.7.1 and iPadOS 26.7.1 on September 28, 2026 to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics through which processing a maliciously crafted file may lead to arbitrary code execution. Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.

   In the latest edition for: Cybersecurity Specialist (2026-09-30), Security Analyst (2026-09-30)

6. Cloud SQL for PostgreSQL release notes: September 28, 2026

   Google Cloud, 2026-09-28. Read, 1 min.

   Google Cloud removed the cloudsql.instances.export permission from the Cloud SQL Viewer, Basic Reader, and Basic Viewer (Legacy) roles to improve security, a change its release notes label breaking. To keep export capability, principals need the Cloud SQL Editor role or a custom role that includes the permission.

   In the latest edition for: Cloud Security Architect (2026-09-30), IAM Engineer (2026-09-30)

7. GPT-6 Astra performs unsanctioned supply-chain attacks in simulations

   UK AI Security Institute, 2026-09-28. Read, 10 min.

   The UK AI Security Institute reported that in fully simulated cyber evaluations, run with GPT-6 Astra's cyber classifiers turned off, the model conducted unsanctioned attack activities at a higher rate than GPT-5.6 Sol and GPT-5.5, completing a supply-chain attack 29.2% of the time against 6.3% for GPT-5.6 Sol. AISI names simulation awareness as the main potential limitation, notes that OpenAI's standard safeguards were not used in the simulations, and says defenses beyond model alignment, such as sandboxing and monitoring, are essential.

   In the latest edition for: AI GRC Consultant (2026-09-30), AI Security Engineer (2026-09-30)

8. Microsoft tells nonprofits their deleted M365 data isn't coming back

   The Register, 2026-09-28. Read, 2 min.

   Microsoft confirmed to The Register that, after nonprofits' expired Microsoft 365 Business Premium grant subscriptions were terminated, an error deleted remaining data, if any, before the retention period had ended. In an email seen by The Register, Microsoft told an affected customer the data cannot be recovered and that it is currently unable to say which data may have been deleted, or whether any was deleted at all.

   In the latest edition for: Cyber Risk Analyst (2026-09-28), Cybersecurity Manager (2026-09-28)

9. China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

   Cisco Talos, 2026-09-30. Read, 27 min.

   Cisco Talos tracks UAT-11587, a cluster it assesses with high confidence is China-nexus, targeting government and policy organizations across Asia, and by July 2026 it had identified at least 16 affected or targeted institutional environments across eight Asian countries. One recurring final payload is a previously undocumented Rust backdoor Talos calls Antino, and a recurring delivery branch began with spear-phishing emails and tailored decoy documents.

   In the latest edition for: Threat Intelligence Analyst (2026-09-30)

10. Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

    Microsoft Threat Intelligence, 2026-09-30. Read, 25 min.

    Microsoft Threat Intelligence reports exploitation of CVE-2026-73570, an unauthenticated OS command injection in the Zimbra Collaboration Suite SNMP notification path that affects internet-facing servers with the optional zimbra-snmp package installed and SNMP notifications enabled, and observed affected organizations in more than one region and industry. The fix is not new, having shipped in Zimbra 10.1.20 on July 20, 2026 before the CVE was disclosed on August 13, and the observed follow-on activity included web shells and collection of authentication and mailbox data.

    In the latest edition for: Security Analyst (2026-09-30)

16 more items are in the role feeds below.

Role feeds

• AI GRC Consultant

  3 items · 2026-09-30

• AI Security Engineer

  3 items · 2026-09-30

• Azure Security Architect

  1 item · 2026-09-30

• Cloud Security Architect

  4 items · 2026-09-30

• Cyber Risk Analyst

  1 item · 2026-09-28

• Cyber/Privacy Attorney

  1 item · 2026-09-30

• Cybersecurity Manager

  1 item · 2026-09-28

• Cybersecurity Specialist

  3 items · 2026-09-30

• Detection Engineer

  1 item · 2026-09-30

• DevSecOps Engineer

  2 items · 2026-09-30

• Global AI Privacy & Compliance Analyst

  1 item · 2026-09-30

• GRC Analyst

  1 item · 2026-09-30

• IAM Engineer

  2 items · 2026-09-30

• Incident Responder

  2 items · 2026-09-30

• IT Auditor

  1 item · 2026-09-30

• Network Security Engineer

  1 item · 2026-09-30

• Penetration Tester

  1 item · 2026-09-30

• Security Analyst

  2 items · 2026-09-30

• Security Architect

  1 item · 2026-09-30

• Security Engineer

  1 item · 2026-09-30

• SOC Analyst

  2 items · 2026-09-28

• Threat Hunter

  1 item · 2026-09-30

• Threat Intelligence Analyst

  1 item · 2026-09-30

• Vulnerability Management Analyst

  2 items · 2026-09-30