Comparing 30 September 2026 with the previous day 23 September 2026.
The report documents a new, previously undisclosed installation and execution technique (RedFlick) used by a Russian state actor, which complicates detection and defense against this campaign.
The report shows that Star Blizzard is scaling its phishing infrastructure with a new RedFlick infection chain and, after hijacking email accounts, now drops a dedicated backdoor (CosmicPulse) , moving beyond pure credential phishing toward persistent compromise of cloud identities.
No evidence of active exploitation; the vulnerability has a low CVSS score and requires user interaction.
The attack abuses Entra ID's legitimate device code authentication flow, so no password and no MFA prompt need to be compromised , restricting that flow is the central countermeasure.
The report shows that device code phishing operates as a scalable phishing-as-a-service capability against Microsoft 365, and the takedown of individual domains is only a snapshot in an ongoing arms race.
Beyond pure patch information, the report shows that CVE-2026-68820 is already actively exploited and allows local attackers to gain SYSTEM privileges, while macOS and several incidents outside the industry are also affected.
The ZDI advisory describes an unauthenticated information disclosure in Microsoft Entra ID's OAuth Device Code Grant, rated CVSS 5.8 and without an assigned CVE.
The vulnerability requires valid administrator credentials, which limits the exploitation risk to compromised or malicious admin accounts.
The updated BSI advisory provides neither CVE IDs nor attack vectors or exploitation status, so individual kernel vulnerabilities cannot be prioritised.
BSI updates its warning about multiple vulnerabilities in Chrome and Edge without providing specific CVE details or exploit status.
The BSI report on multiple TeamViewer vulnerabilities does not contain CVE IDs or information on active exploitation, making prioritization difficult.
No changes in this category.
A Chinese state actor is actively exploiting a Chrome and Windows zero-day chain through fake websites , the BlueMoon exploit kit is already in use, which goes beyond mere patch information.
Beyond the mere patch information, the report highlights a window between the upstream fix and LTS delivery in which a public container-escape exploit is available for unpatched Ubuntu systems.
The report shows the concrete DACH implementation of the NIS2 Directive in Austria with new registration obligations and a central cybersecurity authority.
The vulnerability allows code execution simply by opening a crafted JPEG file or visiting a manipulated web page , a classic entry point for phishing campaigns against office users.
Beyond the plain patch information, the report provides a concrete, reproducible exploitation path via a crafted BDC model XML file that grants an authenticated user execution rights on the SharePoint server.
The vulnerability has no CVE entry and requires user interaction, which limits exploitability but allows information disclosure.
The real lever is not the credential theft itself but the early-established MFA persistence via an actor-registered factor, which keeps the compromise alive even after credential resets.
The attack uses legitimate Teams external communication and remote monitoring and management tools instead of classic malware delivery, thereby bypassing email gateways and conventional attachment filtering.
The report shows that device code phishing abuses a legitimate feature to bypass MFA and gain access to Microsoft 365 accounts without a password.
The malware is distributed via fake job offers and exploits a previously unknown in-memory LPE vulnerability in the Windows AFD.sys driver, pointing to a state-sponsored actor.
The report highlights that the new Defender zero-day ShieldBreak bypasses an already patched Defender flaw, calling into question the effectiveness of the July patch.
For the first time, an obfuscation technique known from AI prompt-injection research (invisible Unicode tag characters U+E0000,U+E007F) is being used in a real phishing campaign to bypass classic email filters.
Exploitation requires local access, so the vulnerabilities are primarily relevant to attackers who have already gained a foothold as an escalation and persistence vector on Linux systems.
The advisory contains no CVE IDs or CVSS scores, which complicates patch prioritization.
The BSI advisory summarizes multiple local kernel vulnerabilities without CVE references, providing no concrete patch or exploit information.