EU Cyber Resilience Act Live, Ransomware Peaks, Critical Flaws Exploited

A new variant of social engineering attacks targeting Microsoft cloud users has emerged, leveraging calls and SMS messages to personal phones. Attackers impersonate IT support, urging victims to 'update' their passkey, MFA, or SSO settings on convincing phishing sites. This leads to credential harvesting, account takeover, and data exfiltration, similar to previous campaigns. The campaign, observed since May 2026, broadens the scope beyond executives to general Microsoft cloud service users, highlighting evolving lures and communication channels for credential theft.

Further details on the actively exploited GitLab path traversal vulnerability (CVE-2026-85706) have emerged. The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) has also issued an alert confirming widespread exploitation. New cyber observables and hunting hints are provided, including specific log sources like `gitlab-workhorse/current` and `production_json.log`, and target files such as `/etc/gitlab/gitlab.rb`. A detailed SIEM detection rule (YAML) is included to identify exploitation attempts, alongside guidance on EDR monitoring for suspicious process activity. Mitigation strategies are further elaborated with D3FEND mappings, emphasizing immediate patching, network access restriction, and configuration hardening.

The EU Agency for Cybersecurity (ENISA) has officially launched its Single Reporting Platform, fulfilling the mandate of the Cyber Resilience Act (CRA). As of September 11, 2026, manufacturers of products with digital elements must use this portal to report actively exploited vulnerabilities and severe security incidents within 24 hours. This operationalizes the CRA's reporting obligations, providing a centralized system for compliance. Additionally, open-source software stewards will be subject to these rules starting in late 2027.

Further analysis of Microsoft's September Patch Tuesday reveals over 20 unauthenticated Remote Code Execution (RCE) vulnerabilities, expanding beyond the previously noted DNS Server RCE. New critical RCEs include CVE-2026-69579 (MSMQ), CVE-2026-69845 & CVE-2026-72979 (DHCP), CVE-2026-73009 (SSTP), and notably, CVE-2026-69676 (Kerberos), posing a direct threat to Active Directory. The update also provides enhanced hunting hints (e.g., MoUsoCoreWorker.exe monitoring, specific event IDs for DNS/DHCP/MSMQ/Kerberos) and new workarounds like disabling non-essential services or restricting network access.

The CISA KEV catalog update for JFrog Artifactory now lists CVE-2026-42018 (CVSS 7.5) as an Improper Authentication vulnerability leading to sensitive data leakage, replacing the previously noted CVE-2026-82329. The update also provides enhanced detection and response guidance, including D3FEND mappings for log analysis and network monitoring, to help organizations identify and mitigate exploitation attempts across all listed vulnerabilities.