A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.Fake Zoom installer hides macOS backdoor CloudSyncDCVE-2026-90970: Critical GitLab AI Gateway Flaw FixedAntino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 ChannelU.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalogAI Agents Attempt SQL Injection While Searching Government DataInvestigators trace an AI agent ‘s path from research task to reconnaissanceU.S. CISA adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalogOperation KillSwitch: Police Dismantle KillSec Ransomware GroupInside Gemini 4 Argon, the model Google is testing on its own infrastructure firstPublic PoC Released for Apple CoreGraphics Zero-Day CVE-2026-86950U.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalogAI Agent Chains Zammad Zero-Days To Take Over DIVD Systems in SecondsWatchGuard fixes critical Fireware OS flaw allowing remote code executionOxygen Forensics, A Russian-run forensics firm spent a decade inside European police departmentsAttackers Abuse ChatGPT Custom GPTs to Deploy a Full-Featured RATU.S. CISA adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities catalogWHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaignJapanese railway operators Keio Corporation and Tokyo Metro disclose security breachesThree Million Affected in Pentagon Personnel Agency Data BreachApple Patches CoreGraphics Zero-Day Linked to Sophisticated Targeted Attacks24-Year-Old Arrested in Dutch Investigation Into ShinyHuntersGPT-6 Astra and the Supply Chain Attack It Wasn’t Asked to LaunchAI Accounts Are Becoming the New Target for InfostealersNearly 400,000 Medicaid Beneficiaries Caught in Medicaid and DC Healthcare Alliance Data ExposureStorm-3168, Linked to JADEPUFFER, Abused Stolen Azure IdentitiesU.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalogRoundcube SQL injection CVE-2026-48842 is now being exploited in the wildCitrix Confirmed Two New NetScaler Flaws Exploited as Zero-DayRydox Admin Faces 20 Years After Selling Stolen Data and Fraud ToolsInternational Press – NewsletterCybercrimeStorm-3168: Agentic-driven cloud attacks using compromised service principals Former U.S. Soldier Sentenced for Hacking and Extortion Scheme That Exposed Sensitive Data of U.S. Government Official Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation Pentagon data breach of military personnel raises national security concerns Japanese Railway Operators Hit with Weekend Cyber Attacks Vietnamese National Charged for Role in Massive “Pig Butchering” Cryptocurrency ScamFBI to ShinyHunters: ‘We know how to find youDelaware Men Sentenced for Cyber Intrusion Scheme Targeting Victims in the Southern District of Iowa Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency TheftTeenager suspected of leading KillSec ransomware group as law enforcement seizes servers and leak site MalwareLunex Unmasked: A New Information Stealer Deployed Through BYOVD Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width UnicodeHackingWarning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active ExploitationRoundcube Pre-Auth SQL Injection Flaw Actively Exploited in the WildDefeating Satellite Spoofing With Galileo’s Encryption GPT-6 Astra performs unsanctioned supply-chain attacks in simulationsApple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’ Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances Branch Target Reuse Vulnerability Discovery and Exploitation Trends in the AI EraCVE-2026-86950: The Great Glyph Grift Rogue Agents InvestigationAI Agents Targeted U.S. and Canadian Government WebsitesThe EDR blind spot: 3 ways browser attacks evade endpoint telemetryIntelligence and Information Warfare Star Blizzard refines phishing and malware delivery with the RedFlick technique DARPA Selects Xint to Use AI in Securing Military Messaging AppsRussian tech surveillance company infiltrated Europe’s law enforcement agencies Warlock Ransomware Attackers Hit Water and Telecom OperatorsTech CEO, Russian National Arrested on Complaint Alleging They Hid Russian Ownership and Development of Software Sold to U.S. Government How Jared Kushner’s firm’s investment in an Israeli company could be a major conflict of interest China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor MI5 warns UK academics their research may have helped Chinese spiesCybersecurityNVIDIA Launches Open Agent Safety Platform to Secure Agents From Testing to DeploymentKiteworks Urges Server Shutdown, Finds Advanced Forms VulnerabilitySecondSight Threat Hunting Report High-Risk ICT Vendors and Critical Infrastructure: European Approaches Trump, AI CEOs sign voluntary safety pact, back data center expansion Microsoft to block Entra ID script injection attacks starting OctoberMore than half of UK businesses lack confidence in basic cyber skillsJudge dismisses spyware case brought by Salvadoran journalists targeted with PegasusPixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies Follow me on Twitter: @securityaffairs and Facebook and MastodonPierluigi Paganini(SecurityAffairs – hacking, newsletter)