Morning Review in IT Security — October 1, 2026

The cybersecurity landscape continues to evolve with sophisticated threat actors leveraging zero-day vulnerabilities, exploiting patched flaws in enterprise software, and deploying increasingly resilient malware. Today's threat intelligence reveals critical vulnerabilities affecting widely-used systems across ticketing, email collaboration, and network management platforms, alongside emerging malware that demonstrates advanced persistence mechanisms.

DIVD Reports Zammad Zero-Days Enabled AI-Driven Network Breach

The Dutch Institute for Vulnerability Disclosure disclosed that its network breach was facilitated by the exploitation of two chained zero-day vulnerabilities within the open-source Zammad ticketing system. The attack represents a significant concern as it demonstrates how threat actors can combine multiple zero-day flaws to achieve network compromise, particularly when AI-driven techniques are employed to identify and exploit such weaknesses. The vulnerabilities tracked as CVE-2026-102489 and CVE-2026-102490 underscore the ongoing risks associated with open-source software that may not receive the same security scrutiny as commercial alternatives. Source: DIVD says Zammad zero-days enabled AI-driven network breach

Zimbra Collaboration Suite Flaw Weaponized for Web Shell Deployment

Threat actors have actively weaponized CVE-2026-73570, a now-patched vulnerability in Zimbra Collaboration Suite, to deploy web shells and harvest authentication credentials from compromised mailbox systems. According to findings from the Microsoft Security Research team, this unauthenticated operating system command injection flaw carries a CVSS score of 8.9 and enables remote code execution when Simple Network Management Protocol is leveraged. Organizations running unpatched versions of Zimbra remain at elevated risk as attackers continue to exploit this flaw for persistent access and credential theft operations. Source: Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

Cisco SD-WAN Manager Authentication Bypass Under Active Exploitation

Cisco has warned that attackers are actively exploiting a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager, the centralized system used by enterprises to manage their SD-WAN deployments. CVE-2026-76504 permits remote attackers without login credentials to access the Manager's API with administrative privileges, representing a severe risk to network infrastructure. While Cisco has released patched versions, the company has confirmed that no workaround exists, making immediate patching essential for affected organizations. Source: Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

Self-Healing WordPress Malware Demonstrates Advanced Persistence Tactics

Security researchers analyzing a WordPress compromise have documented a sophisticated malware family designated SC, named after markers found within injected content, which exhibits remarkable resilience against traditional remediation efforts. The malware persists across at least eight separate locations simultaneously, including files, databases, and shared memory, with each location capable of rebuilding all others in the event of partial removal. This self-healing architecture defeats conventional cleanup methodologies, as the backdoor reestablishes itself within seconds of deletion and incorporates blockchain-controlled command and control mechanisms. Source: SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor

As organizations navigate an increasingly complex threat environment, the convergence of zero-day exploitation, active vulnerability weaponization, and advanced malware persistence mechanisms demands heightened vigilance and rapid patch deployment cycles. Security teams should prioritize vulnerability management while implementing defense-in-depth strategies that account for sophisticated adversaries capable of defeating traditional incident response procedures.