สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 2 กันยายน 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 7 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability
• CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability
• CVE-2026-49869 Kestra OSS OS Command Injection Vulnerability
• CVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability
• CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability
• CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
• CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Vulnerabilities

• Off The Hook: Discovering And Observing Active Exploitation Of Sangoma Switchvox CVE-2026-9586
  "At Horizon3, we’re constantly looking for technologies and applications to perform security audits on that we believe may be targeted by threat actors. In April of 2026, we took a look at the Sangoma ecosystem after several FreeBPX vulnerabilities, CVE-2025-57819 and CVE-2025-64328, landed on the CISA Known Exploited Vulnerabilities (KEV) catalog. One such application we landed on was Sangoma Switchvox. Switchvox is an enterprise VoIP telephony management solution. It allows organizations to easily configure phone systems to include voicemail, call forwarding, and monitoring and analytics across their enterprise."
  https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/
  https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/
  https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html
  https://www.helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586/
• SonicWall Warns Of Actively Exploited SMA1000 Zero-Day Flaws
  "SonicWall warned customers that threat actors are chaining two new SMA1000 zero-day vulnerabilities in remote code execution attacks. The first is a maximum-severity command injection flaw (CVE-2026-83548) found in the SMA1000 Appliance WorkPlace interface that stems from a server-side request forgery (SSRF) weakness. This actively exploited zero-day chain also targets a command injection vulnerability (CVE-2026-83549) in the SMA1000 Appliance Management Console that attackers with admin privileges can exploit to execute arbitrary OS commands on vulnerable devices."
  https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/
  https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016
  https://thehackernews.com/2026/09/attackers-exploit-two-sonicwall-sma.html
  https://www.darkreading.com/vulnerabilities-threats/sonicwall-sma-1000-zero-days-unauthenticated-rce
  https://www.infosecurity-magazine.com/news/hackers-chain-sonicwall-zeroday/
  https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/
  https://securityaffairs.com/198303/security/sonicwall-patches-two-new-actively-exploited-zero-days-in-sma-1000-vpns.html
  https://www.helpnetsecurity.com/2026/09/02/sonicwall-sma-1000-cve-2026-83548-cve-2026-83549-zero-day-attacks/
• 5 Million WordPress Sites Affected By SQL Injection Vulnerability In All-In-One WP Migration And Backup WordPress Plugin
  "On August 14th, 2026, we received a submission for an Unauthenticated Second-Order SQL Injection vulnerability in All-in-One WP Migration and Backup, a WordPress plugin with more than 5 million active installations. This vulnerability makes it possible for unauthenticated attackers to inject SQL that is later executed when a site administrator performs an archive restore, which can be used to leak the plugin’s secret key and ultimately achieve remote code execution, leading to complete site takeover."
  https://www.wordfence.com/blog/2026/09/5-million-wordpress-sites-affected-by-sql-injection-vulnerability-in-all-in-one-wp-migration-and-backup-wordpress-plugin/
  https://www.bleepingcomputer.com/news/security/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks/
• GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends
  "Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals. The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the vulnerability details on August 31. GeoNetwork originated at the United Nations Food and Agriculture Organization and is maintained under the Open Source Geospatial Foundation (OSGeo). It is a core component of many Spatial Data Infrastructure deployments across Europe and beyond, including the backend of the European INSPIRE geoportal."
  https://thehackernews.com/2026/09/geonetwork-fixes-unauthenticated-rce.html
• Chrome And Firefox Updates Patch Dozens Of Vulnerabilities
  "Google and Mozilla on Tuesday announced patches for dozens of vulnerabilities across Chrome and Firefox, including critical- and high-severity flaws. A fresh Chrome 152 update has been rolled out with fixes for 26 bugs, two of which are critical-severity use-after-free issues in Shared Tab Groups (CVE-2026-84353) and WebGL (CVE-2026-84352). The update also addresses nine high-severity security defects, including use-after-free, incorrect authorization, information leak, improper input validation, uninitialized resource, and buffer overflow weaknesses."
  https://www.securityweek.com/chrome-and-firefox-updates-patch-dozens-of-vulnerabilities/
  https://www.malwarebytes.com/blog/bugs/2026/09/two-critical-chrome-flaws-put-users-at-risk-on-malicious-websites
• CISA Adds Seven Known Exploited Vulnerabilities To Catalog
  "CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability
  CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability
  CVE-2026-49869 Kestra OSS OS Command Injection Vulnerability
  CVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability
  CVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability
  CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
  CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog
• Eight Findings Across Seven Agents. Four Remain Unpatched At Publication.
  "What it is. AI coding agents run git commands in the background to gather context, on some agents before you type a prompt, before the workspace-trust prompt, before you have even authenticated. Improper sanitization in this context-gathering mechanism is a widespread security vulnerability across AI coding agent products, each ending in arbitrary code execution. What an attacker gets. Arbitrary code execution as the developer, outside the sandbox, with no approval prompt and nothing on screen. Their SSH keys, the cloud credentials in their environment, the tokens in their shell config, every repository on disk, and a foothold on the machine. How widespread. Not one vendor’s bug. Claude Code ships over 77 million npm downloads a month (as per npm API). Across the five projects, Hermes carries over 237,000 GitHub stars, Claude Code 143,000+, Goose 54,000+, Qwen Code 27,000+ and Grok Build 26,000, close to half a million together."
  https://www.manifold.security/blog/ai-coding-agents-git-hijack
  https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
• Exploit Published For Fresh Cleo Harmony Vulnerability
  "Organizations are advised to immediately patch a fresh authentication bypass vulnerability affecting the file transfer application Cleo Harmony. Tracked as CVE-2026-84115, the security defect impacts the JWT refresh token logic and allows remote attackers to elevate their privileges via argument bearer manipulation. The flaw was discovered in an unknown function in the file ‘/api/connections’. An attacker could craft a malicious payload that tampers with the arguments in HTTP headers, bypassing access controls and leading to privilege escalation."
  https://www.securityweek.com/exploit-published-for-fresh-cleo-harmony-vulnerability/
  https://vuldb.com/cve/CVE-2026-84115

Malware

• Kim Sooki Again? This Time, It Was Disguised As a Request For Seafood Ingredients
  "A request to review the purchase of seafood ingredients arrived. When the file is opened, a normal hwp document appears, but while the user is reviewing the contents, a malicious script runs in the background and even registers a scheduled task. It then extracts system information to an external location, downloads and executes additional commands, and wipes all traces. Let’s examine the tactics used by a malicious LNK file linked to Kimsuky, which disguises the attack by masquerading as a legitimate business document."
  https://asec.ahnlab.com/en/95217/
• “Evasive” Malware Attack Tactics: Hiding, Bypassing, And Reappearing
  "People who initially seem fine but tend to subtly avoid others as the relationship deepens or when conflicts arise—and who disappear when pressured—are commonly referred to as “avoidant types.” By repeatedly pulling away only to reappear, they drain the other person’s emotions and energy, ultimately undermining the relationship. The attack pattern of the recently identified “MoiClient” backdoor exhibits similar behavior. It lowers users’ guard by disguising itself as an invoice, executes while hidden within legitimate programs, and finds alternative paths whenever it encounters security controls. It bypasses permission controls and exploits vulnerable drivers to neutralize even security products designed to block it, while repeatedly executing itself through the Task Scheduler. Let’s take a closer look at MoiClient’s attack method: it bypasses obstacles when blocked and hides again when attempts are made to detect it."
  https://asec.ahnlab.com/en/95211/
• Gambling Goblin: A Chinese-Speaking Actor Hijacks Brazilian Government Sites To Fuel a Global SEO Fraud Machine
  "Check Point Research has been tracking a sustained campaign, active since mid-2025, that marks a real shift in how and where cyber crime targets trusted infrastructure. The group behind it, which CPR dubbed, “Gambling Goblin”, is a Chinese-speaking cybe rcrime cluster tied to Earth Berberoka, previously documented targeting gambling sites across Asia. Its playbook: compromise trusted, high-reputation web servers and turn them into infrastructure for a global SEO fraud operation."
  https://blog.checkpoint.com/research/gambling-goblin-a-chinese-speaking-actor-hijacks-brazilian-government-sites-to-fuel-a-global-seo-fraud-machine/
  https://research.checkpoint.com/2026/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-weapon/
  https://thehackernews.com/2026/09/malicious-apache-modules-hijack.html
  https://www.infosecurity-magazine.com/news/gambling-goblin-brazilian/
• Pegasus Spyware Infection Of Serbian Pro-Democracy Student Activist
  "In collaboration with the SHARE Foundation, the Citizen Lab analyzed forensic artefacts from the iPhone of a member of Serbia’s student protest movement after they received an Apple Threat Notification warning of targeting with mercenary spyware. Our analysis confirmed that an iMessage zero-click exploit was used to infect the device with NSO Group’s Pegasus spyware. We found high-confidence indicators of infection from a period across December 2025 – January 2026, however this does not preclude the possibility of additional infections."
  https://citizenlab.ca/research/pegasus-spyware-infection-of-serbian-activist/
  https://cyberscoop.com/pegasus-novispy-variant-spyware-found-on-devices-of-serbian-activists/
• Tech Support Scams Look Different Now. Here’s What To Watch For
  "In a tech support scam, criminals pretend to work for a trusted technology or security company. They claim there is a problem with your device, software, subscription, or account, then try to persuade you to pay them, share personal information, or give them remote access to your computer. These scams used to rely mainly on browser locks and fake virus warnings. Now, scammers use many more ways to reach people, including websites and platforms they trust."
  https://www.malwarebytes.com/blog/scams/2026/09/tech-support-scams-look-different-now-heres-what-to-watch-for
• Kali365 And Why Stealing Passwords Is No Longer Enough
  "Attacks abusing authentication processes are on the rise. Since early 2026, Kali365, a phishing-as-a-service (PhaaS) platform targeting Microsoft 365 environments, has abused authentication processes in waves of attacks. A number of cybersecurity vendors and the FBI have reported on Kali365, and Barracuda researchers have seen many Kali365 attacks in recent months. This article details Barracuda’s findings."
  https://blog.barracuda.com/2026/09/02/kali365-phishing-microsoft-365-authentication-abuse
• Counterfeit Installers To System Compromise: Tracking a Deceptive Software Download Campaign
  "Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users. Microsoft has observed victims across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors."
  https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
  https://thehackernews.com/2026/09/fake-software-installers-disable.html
• Uncovering StreamRat: From Meta Ads To Full Device Takeover
  "ThreatFabric researchers have uncovered StreamRat, a new Android banking trojan promoted to Spanish-speaking users through Meta and TikTok advertisements impersonating a free TV-streaming service, with the campaign reaching approximately 570,000 potential victims. Following a two-stage installation, StreamRat abuses Accessibility Services and MediaProjection to provide operators with near-complete control over infected devices, combining VNC and hidden-screen control, UI-tree collection, keylogging, credential-stealing overlays, internet and screen-blocking capabilities."
  https://www.threatfabric.com/blogs/from-meta-ads-to-full-device-takeover-uncovering-streamrat
  https://thehackernews.com/2026/09/meta-ads-push-streamrat-android-trojan.html
• New Pro-Ukraine Hacker Group Targets Russian Companies With Custom Ransomware
  "A ransomware group believed to be linked to pro-Ukrainian hackers is targeting Russian organizations with custom malware and demanding multimillion-dollar payments, according to new research. The group, which calls itself VantaCore, has targeted at least seven known victims, Russian cybersecurity firm F6 said in a report published this week. Researchers first detected its activity in August, although the group's data-leak website appears to have been created in early June."
  https://therecord.media/new-pro-ukraine-hacker-group-custom-ransomware-russia
• An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
  "Unit 42 responded to an incident where a human attacker used frontier AI to breach an enterprise network autonomously as part of a ransomware attack. The agents breached the company's security layers in a methodical manner, each targeting a different layer of defense to achieve a shared goal. The impact was at the scale of a coordinated effort from multiple red teams, which would normally take human operators around two weeks."
  https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
• EtherHiding In The Browser: ClickFix Chain Ends In Amatera
  "Netskope Threat Labs has been tracking a WordPress mass-compromise campaign affecting hundreds of sites. On each one, a rogue must-use plugin registers a Service Worker in the visitor’s browser. That worker strips the site’s Content-Security-Policy header and injects a script that reads its payload from a smart contract on Base. In turn, the smart contract serves a fake reCAPTCHA telling the visitor to paste a command into the Windows Run dialog. The campaign employs Service Worker persistence, EtherHiding on-chain payload delivery, fake reCAPTCHA, and ClickFix, also adding a disguised polyglot file, mshta abuse, a fileless PowerShell stage, an image-hidden loader, and finally the Amatera password stealer. That is a lot of technique for one password stealer."
  https://www.netskope.com/blog/etherhiding-in-the-browser-clickfix-chain-ends-in-amatera
• Trapping a Mustang Panda
  "As of mid-2026, IBM X-Force continues to monitor cyber campaigns conducted by ITG27, a China-aligned state-sponsored espionage group whose victims align with China’s regional strategic interests. In collaboration with Deception.Pro, X-Force captured live ITG27 activity in simulated enterprise environments, including the deployment of a previously undiscovered VNC-capable backdoor named Havencode. The observed activity extends a campaign previously reported by Acronis, where ITG27 targeted India’s energy sector and government organizations. This campaign relied on the use of Claimloader malware, lure documents, and the Toneshell backdoor. The campaign coincides with intensifying China-India competition over regional hydropower and India’s expanding strategic relationships with partners such as Taiwan."
  https://www.ibm.com/think/x-force/trapping-a-mustang-panda

Breaches/Hacks/Leaks

• Dropbox Accounts Breached Through Lenovo Email Verification Flaw
  "Dropbox is warning some users that an unauthorized party accessed their accounts by exploiting a flaw in Lenovo’s email verification process to register fraudulent Lenovo IDs. Although some affected users did not have Lenovo accounts, the cloud-storage provider said it uses Lenovo Identity Provider Services as part of its authentication infrastructure. This allows users to log into Dropbox accounts using verified Lenovo IDs. According to the notification sent to impacted users, the unauthorized access was possible due to "an issue with Lenovo's email verification process," which "allowed an unauthorized party to register a Lenovo ID using your email address.""
  https://www.bleepingcomputer.com/news/security/dropbox-accounts-breached-through-lenovo-email-verification-flaw/
• FBI Probes Service Selling 153M+ Drivers Licenses
  "A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau of Investigation (FBI) today launched an official inquiry into the source of the images."
  https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/
  https://www.malwarebytes.com/blog/news/2026/09/dark-web-site-puts-153-million-drivers-licenses-and-millions-more-ids-up-for-sale
• Hackers Expose Donor Data From Russian Fundraisers For Ukrainians, Political Prisoners
  "Hackers reportedly gained access to payment accounts used by two Russian fundraising projects supporting Ukrainians and political prisoners, exposing donor email addresses and limited payment card information. The unknown threat actor targeted Davayte, which raises money for civilians in Ukraine affected by Russia’s invasion, and You Are Not Alone, a project supporting Russian political prisoners and their families."
  https://therecord.media/hackers-russia-fundraisers-ukraine

General News

• Communicating Under Pressure: Best Practices For Service Providers
  "Developed by CISA, the Federal Bureau of Investigation, and international partners, this guidance describes how organizations can plan and execute clear, timely, accurate, and audience-appropriate communications during IT and operational technology (OT) outages. Whether caused by cyber threat actors, human error, equipment failure, or natural hazards, service outages can create disruption and societal panic even without speculation from end users and the public as added factors. Outages at one organization may cascade across interconnected systems, increasing uncertainty and alarm. The guidance emphasizes clarity, accountability, and transparency as core principles and details key elements of effective crisis messaging to inform affected stakeholders and the public while aligning with legal requirements, operational security, law enforcement, and containment efforts."
  https://www.cisa.gov/resources-tools/resources/communicating-under-pressure-best-practices-service-providers
  https://www.cisa.gov/sites/default/files/2026-09/joint-guidance-communicating-under-pressure-508c.pdf
• Russian National Indicted For Exploiting Online Platform Used For Freelance Employment And Distributing Malware To Thousands Of Victim Users Worldwide For Financial Gain
  "A federal grand jury has indicted Searzhudin Tamirlanovich Aktulaev on charges of Conspiracy, Transmission of a Program, Information, Code, and Command to Cause Damage to a Protected Computer, and Aggravated Identity Theft, among other offenses. Defendant was arrested in Cyprus in May 2025 and has been extradited to the United States. Yesterday, he made his initial appearance in federal court in San Francisco, and he was remanded to federal custody."
  https://www.justice.gov/usao-ndca/pr/russian-national-indicted-exploiting-online-platform-used-freelance-employment-and
  https://www.bleepingcomputer.com/news/security/us-charges-russian-for-infecting-80-000-freelancers-with-malware/
  https://thehackernews.com/2026/09/extradited-russian-hacker-faces-charges.html
  https://therecord.media/russian-national-facing-20-years-malware-campaign
  https://www.infosecurity-magazine.com/news/russian-man-extradited-malware/
• Global Public-Private Operation Disrupts Sality Botnet Active For Two Decades
  "An international operation supported by Europol has disrupted the Sality peer-to-peer (P2P) botnet, a long-running criminal infrastructure used to distribute malicious payloads to thousands of infected computers worldwide. The coordinated action, carried out on 31 August 2026 and led by the US authorities, targeted a botnet believed to have been operating for more than two decades. At its peak, the botnet gave its operator access to up to one million infected machines worldwide. To date, more than 11 million unique IP addresses have been linked to the infrastructure, which could be used to distribute malicious payloads to compromised devices."
  https://www.europol.europa.eu/media-press/newsroom/news/global-public-private-operation-disrupts-sality-botnet-active-for-two-decades
  https://thehackernews.com/2026/09/authorities-turn-salitys-p2p-network.html
  https://www.bleepingcomputer.com/news/security/sality-botnet-infrastructure-dismantled-in-joint-global-takedown/
  https://therecord.media/sality-botnet-cyber-doj
  https://www.bankinfosecurity.com/global-public-private-action-disrupts-russia-linked-sality-botnet-a-32732
  https://cyberscoop.com/sality-botnet-dismantled/
  https://www.securityweek.com/23-year-old-sality-p2p-botnet-disrupted/
  https://www.helpnetsecurity.com/2026/09/02/sality-botnet-disruption-crowdstrike-law-enforcement/
• AI Gives Cybercriminals a Dangerous Time Advantage
  "Brett Johnson has seen cybercrime from both sides. Once dubbed the "original Internet Godfather" by the US Secret Service, Johnson built and ran Shadow Crew, an early organized cybercrime community, before eventually leaving that life behind. Now, he works with law enforcement and businesses to help defend against the kinds of threats he once deployed. In this conversation with Dark Reading's Kristina Beek, Johnson shares what he spoke about at Black Hat USA in Las Vegas alongside Illumio, demonstrating how artificial intelligence (AI) can compress the time it takes to carry out an attack."
  https://www.darkreading.com/threat-intelligence/ai-gives-cybercriminals-dangerous-time-advantage
• AI’s Vulnerability Surge May Be More Manageable Than First Feared
  "A new study suggests that while AI is rapidly accelerating vulnerability discovery, enterprise organizations are better equipped to handle the surge than generally assumed. The key is their ability to quickly validate findings, prioritize risk and get available fixes into production. Software supply chain security firm Echo recently analyzed nearly 40,000 CVE life cycles across 250 open source container projects, drawing on a year of its own platform telemetry, survey responses from more than 80 security leaders, and an independent analysis of Anthropic's Claude Mythos."
  https://www.darkreading.com/application-security/ai-vulnerability-surge-manageable-than-first-feared
• The Industrialization Of Cybercrime In Africa
  "INTERPOL’s newly released African Cyberthreat Assessment Report 2026 highlights a defining shift in the threat landscape: Cybercrime has evolved from isolated incidents into an industrialized, borderless ecosystem. That conclusion closely aligns with FortiGuard Labs’s global observations and forecasts for 2026. Criminal groups now operate as coordinated enterprises rather than just individual threat actors, supported by specialized service providers, shared infrastructure, automated tools, and mature supply chains."
  https://www.fortinet.com/blog/industry-trends/the-industrialization-of-cybercrime-in-africa
  https://www.interpol.int/en/News-and-Events/News/2026/INTERPOL-report-finds-AI-linked-to-more-than-half-of-cybercrime-in-Africa
• A Battery Storage Cyberattack Would Look Exactly Like a Badly Tuned Controller
  "Batteries connected to the grid make money by reacting to frequency, pushing power out when it sags and soaking it up when it rises. A few hundred of them moving together, on command from someone who should not have the command, would look the same on a control room screen right up to the moment the network starts disconnecting customers. Rafael Narezzi, chief executive of the London firm Centrii, puts the number needed at 1,500 units in Texas, 5.4 percent of the ERCOT fleet, and 400 units in Great Britain, about 29 percent of the fleet there."
  https://www.helpnetsecurity.com/2026/09/02/grid-battery-storage-cyberattack/
• National Life Group CISO Expects More Vulnerabilities In Six Months Than In Thirty Years
  "In this Help Net Security interview, Becky Palmer is VP and CISO at National Life Group, answers five questions about defending against AI-driven attacks. The discussion covers why patch cycles built for human speed cannot keep up, and which compensating controls buy time when an immediate fix is not possible. It includes numbers from agentic AI in the security operations center, where four of five cases close without human escalation. The rest looks at questions that separate a working AI product from a wrapper, contract terms for third-party AI use, and three steps smaller banks and carriers can take in 90 days."
  https://www.helpnetsecurity.com/2026/09/02/becky-palmer-national-life-group-ai-driven-cyber-threats/
• Scareware Ads Keep Running On Google’s Transparency Tool, Even After They’re Reported
  "A team of NYU and Radboud University researchers spent a year building a tool to find deceptive software ads inside Google’s public ad archive. It works. It also exposed something more uncomfortable: reporting a bad ad to Google doesn’t mean the ad, or the domain behind it, stops running. The tool is called AdLens, and it comes out of a study that mined Google’s Ads Transparency Center, a public database Google built to satisfy transparency rules like the EU’s Digital Services Act."
  https://www.helpnetsecurity.com/2026/09/02/google-scareware-ads-research/
  https://racro.github.io/papers/adlens.pdf
• Anthropic’s Enterprise Frontier Safeguards Lets Your Claude Logs Stay In Your Cloud
  "Eight members of the Analysis and Resilience Center for Systemic Risk, a group whose roster includes the CISOs of Goldman Sachs, Morgan Stanley, Citi, Bank of America, and Wells Fargo, spent months working with Anthropic on a question their examiners care about more than benchmark scores. Scott DePasquale, the center’s president and chief executive, said those eight defined “what it would take to run the most capable frontier models inside a systemically important bank: who holds the data, who holds the keys, what automated review can and cannot see, and under what conditions a human is ever permitted to look.”"
  https://www.helpnetsecurity.com/2026/09/02/anthropic-enterprise-frontier-safeguards/
• An AI CAPTCHA Solver Talked Itself Out Of The Right Answer
  "You have probably spent a few seconds of your life turning a picture until it lines up. Some sites, instead of asking you to tick a box, show you a circular chunk of a photo that has been spun around, and you drag it until the inside matches the ring around it. Simple enough. Annoying enough. Two researchers at Bern University of Applied Sciences wrote a script that solves one of those in 0.006 seconds. It uses circle-detection math from the 1970s and a signal-matching technique that predates everything currently being called AI. It got all ten test puzzles right, every time, faster than you can blink."
  https://www.helpnetsecurity.com/2026/09/02/ai-captcha-solver-research/
  https://arxiv.org/pdf/2608.28794
• Scammers Are Getting Smarter About Where They Target You
  "Scammers are becoming more strategic about where they target people. Nine in ten toll scams—the fake unpaid-toll messages that threaten fines or license suspension—arrive by email or text, while roughly six in ten romance scams show up first on social media. That’s no coincidence. Rather than blasting the same message everywhere, criminals are tailoring different scams to the platforms where they’re most likely to succeed. This finding comes from Malwarebytes’ own threat research systems and draws on global data between April 15 and July 14, 2026. The research reveals the various ways scammers are adapting their tactics and provides new insights about where they show up, when they strike, and which brands they impersonate."
  https://www.malwarebytes.com/blog/scams/2026/09/scammers-are-getting-smarter-about-where-they-target-you
• Google, Anthropic, And OpenAI Unveil Cyber AI Models, Safeguards, And Access Programs
  "Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the Fairwind Program. "The Fairwind Program gives high-priority defenders (like governments, healthcare providers, and telecommunications services) early access to advanced models that help them build better defenses, before new threats arrive," Google said. "So defenders have an early advantage, to help them protect vital infrastructure – which in turn protects people who rely on those systems.""
  https://thehackernews.com/2026/09/google-anthropic-and-openai-unveil.html
• OpenAI’s Astra Crosses ‘Critical’ Cyber Threshold After Finding Zero-Days
  "OpenAI said its newest model, Astra, has reached the ‘Critical’ cybersecurity capability level under the company’s Preparedness Framework, the first time any of its models has been placed in that category. The designation applies when a model can independently find and exploit zero-day vulnerabilities across many well-defended systems, or carry out a complete cyberattack against a hardened target from only a high-level instruction. OpenAI said the classification requires additional safeguards before the model can be released."
  https://www.securityweek.com/openais-astra-becomes-first-model-to-cross-critical-cybersecurity-threshold/
  https://securityaffairs.com/198317/ai/openai-astra-brings-autonomous-zero-day-exploitation-to-ai.html

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Rockwell Automation RSLinx Classic
  "Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-01
• Rockwell Automation Redundancy Module Configuration Tool
  "Successful exploitation of these vulnerabilities could allow for an attacker to escalate and execute processes with administrator privileges."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-02
• Rockwell Automation Logix Platform
  "The following versions of Rockwell Automation Logix Platform are affected:"
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-03
• Rockwell Automation FactoryTalk Activation Manager
  "The following versions of Rockwell Automation FactoryTalk Activation Manager are affected:"
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-04
• Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix
  "The following versions of Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix are affected:"
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-05
• Rockwell Automation Historian ME
  "Successful exploitation of these vulnerabilities could crash the device being accessed; an out-of-bounds write condition may allow remote code execution."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-06
• Can AI Create PLC Attacks? Yes, But It’s Not That Easy Yet
  "We used AI assistance to successfully port a remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) model to another. The exercise required significant researcher involvement, including guiding the AI through dead ends, supplying disassembly context, and correcting false leads. The final RCE development stage consumed $535.74 in API tokens during an 8-hour, 32-minute session for a single exploit on a single target. An attempt to extend the exploit into a command-and-control implant bricked the PLC, highlighting how unforgiving binary exploitation on embedded targets can be."
  https://www.forescout.com/blog/can-ai-create-plc-attacks-yes-but-it’s-not-that-easy-yet/
  https://www.securityweek.com/experiment-porting-a-plc-exploit-with-ai-takes-hours-and-hundreds-of-dollars/

Vulnerabilities

• Nearly 22,000 Microsoft Exchange Servers Vulnerable To Hijack Attacks
  "Nearly 22,000 Microsoft Exchange servers exposed online remain unpatched against a high-severity authentication bypass vulnerability that allows attackers to hijack all user mailboxes. Tracked as CVE-2026-62911 and reported by DEVCORE Research Team's Orange Tsai, this security flaw affects Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE) software. Threat actors with basic privileges on the targeted server can exploit it in low-complexity attacks that require user interaction."
  https://www.bleepingcomputer.com/news/security/nearly-22-000-microsoft-exchange-servers-vulnerable-to-hijack-attacks/
• Recently Patched PaperCut Zero-Days Used In Data Theft Attacks
  "Two security vulnerabilities in the PaperCut NG and MF print management software, patched last week after being exploited as zero-days, are now being abused in data theft attacks. According to PaperCut Software, the software is used by 100 million users across more than 70,000 organizations, including large companies, state agencies, and educational institutions. Tracked as CVE-2026-81578 and CVE-2026-82078, the two security flaws can be chained to bypass authentication and gain remote code execution on vulnerable PaperCut NG and MF print management servers."
  https://www.bleepingcomputer.com/news/security/recently-patched-papercut-zero-days-used-in-data-theft-attacks/
• Attackers Pounce On Critical Artifactory Flaw Following Disclosure
  "Threat actors are actively exploiting a critical JFrog Artifactory vulnerability just days after its public disclosure, putting a fresh spotlight on the software repository platform after OpenAI's AI agents exploited zero-day flaws in the repository manager during their attack on Hugging Face earlier this year. CVE-2026-82329 is a critical (CVSS: 9.8) authentication bypass vulnerability in default configurations of Artifactory that an unauthenticated attacker can exploit to gain administrative access to the platform, with no user interaction required."
  https://www.darkreading.com/application-security/attackers-pounce-critical-artifactory-flaw-disclosure
  https://thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html
  https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/
• WatchGuard Patches Critical Vulnerabilities
  "WatchGuard has released patches for over two dozen vulnerabilities, including five critical-severity flaws leading to remote code execution (RCE) and account takeover. Three of the critical bugs impact the iked process of Fireware OS, the core Internet Key Exchange (IKE) daemon that handles cryptographic key establishment and manages IPsec VPN negotiations over the IKEv1 and IKEv2 protocols. Exploitable without authentication, the three security defects are a heap buffer overflow (CVE-2026-19313), a stack-based buffer overflow (CVE-2026-19318), and a type confusion (CVE-2026-19315)."
  https://www.securityweek.com/watchguard-patches-critical-vulnerabilities/
• Chaotic Eclipse Releases GenDigital Avast Antivirus ZeroDay PrettyPrague
  "Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting GenDigital Avast Antivirus. The researcher named the exploit PrettyPrague, it triggers a privilege escalation flaw. The researcher claims to have found another zero-day in an antimalware product, this time targeting Avast Antivirus. The PoC exploits a flaw in Avast Sandbox to dump the Windows SAM database and gain a SYSTEM-level shell. It reportedly works even on fully patched Avast Antivirus and Windows 11 25H2. The researcher also suspects the flaw may affect other Gen Digital products, including AVG and Norton."
  https://securityaffairs.com/198243/hacking/chaotic-eclipse-releases-gendigital-avast-antivirus-zeroday-prettyprague.html

Malware

• Daisy-Chaining Trust: Investigating Faronics Deploy Abuse
  "Huntress has identified a surge in phishing campaigns that abuse Faronics Deploy, with more than 457 endpoints encountering Faronics-related lures between July 21 and August 20. Huntress reported this activity to the Faronics support team on August 5. Starting on August 21, we observed the activity drop dramatically as they implemented new measures to disrupt threat actors. Faronics Deploy is a legitimate endpoint management platform for remotely deploying software and executing scripts across managed devices. By chaining legitimate software, attackers are leveraging Faronics to execute malicious PowerShell scripts and subsequently deploy ScreenConnect, effectively blending in with trusted business workflows. This post details the attack chain, provides key forensic artifacts such as the ScriptRunner.log, and explains how the ck identifier can be used to cluster malicious deployments and track infrastructure."
  https://www.huntress.com/blog/faronics-deploy-abuse
  https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/
  Critical Langflow Flaw Exploited To Steal OpenAI And AWS Keys*
  ***** "Threat actors are exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, an open-source framework for building AI applications, to steal credentials, tokens, and keys. The security issue received a critical severity rating and resides in the code validator of Langflow’s custom component editor. Threat intelligence company VulnCheck detected the activity on its honeypots in the U.K. that were targeted in at least 50 exploitation attempts over the weekend, with attack traffic originating primarily from Russia."
  https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/
  https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html
  https://www.darkreading.com/vulnerabilities-threats/critical-langflow-flaw-exploited-attacks-rise
  https://www.bankinfosecurity.com/attacks-targeting-langflow-ai-agent-building-tool-surge-a-32712
  https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/
• Hackers Push Malicious Virtualizor Update In BGP Hijacking Attack
  "Hackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers. Virtualizor is a legacy web control panel from Softaculous that hosting providers use to create, sell, and manage virtual private servers (VPS). An urgent notice from the vendor warns that between 20:57 UTC on August 28 and 06:10 UTC on August 30, an attacker rerouted a block of Hetzner-hosted IP addresses in a BGP (Border Gateway Protocol) hijacking attack."
  https://www.bleepingcomputer.com/news/security/hackers-push-malicious-virtualizor-update-in-bgp-hijacking-attack/
  https://www.virtualizor.com/blog/security-incident-bgp-hijacking/
  https://www.theregister.com/security/2026/09/01/33-hour-bgp-hijack-of-softaculous-traffic-prompts-security-scramble/5293608
• EtherHiding Exposed: What Security Leaders Need To Know
  "Attackers have compromised the websites of at least 31 legitimate businesses, including e-commerce, professional services and retail logistics organizations. Visitors arriving to the compromised sites via search engine encounter a fake “Verify you’re human”. This CAPTCHA prompt instructs them to paste a command into their own computer, a tactic known as “ClickFix”. That single action installs a persistent backdoor with no visible indication of compromise. The backdoor survives reboots, beacons to C2 every minute and retrieves updated instructions from the Polygon blockchain."
  https://www.guidepointsecurity.com/blog/etherhiding_exposed_what_security_leaders_need_to_know/
  https://www.darkreading.com/endpoint-security/clickfix-campaign-comprises-31-orgs-abuses-polygon-blockchain
• Mirage Kitten Targeting Aviation And FinTech Sectors Across The Middle East And Africa With a New Malware Set
  "While monitoring Mirage Kitten activity, we uncovered a previously undocumented malware family that we dubbed NodeRabbit. We identified the first sample on a system in Afghanistan. Further threat hunting revealed two additional, more advanced, variants: one on a system in Egypt and another on a system in Ethiopia. NodeRabbit is a cross-platform remote access trojan (RAT) built with Node.js. It targets Windows, Linux, and macOS. Its operators deliver it through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives."
  https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/
  https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html
  https://therecord.media/iranian-cyber-spies-target-aviation-fintech-new-malware
• Financially Motivated Threat Actor BREEZE COMET Targets Brazil
  "Beginning in 2024 Mandiant investigated a string of compromises affecting Brazilian financial services, retail, and eCommerce organizations. Google Threat Intelligence Group (GTIG) tracks this activity as BREEZE COMET (formerly UNC5669), a financially motivated threat actor specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers. This activity overlaps with operations publicly reported as Plump Spider and SHADOW-AETHER-064. In this blog, we detail BREEZE COMET’s tactics and toolkit, and provide mitigation recommendations and detections to support organizations in defending against this active and developing threat."
  https://cloud.google.com/blog/topics/threat-intelligence/financially-motivated-threat-actor-breeze-comet-targets-brazil/
  https://thehackernews.com/2026/09/breeze-comet-executes-hundreds-of.html
• 13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds
  "Socket’s Threat Research Team found 13 malicious Composer theme packages on Packagist, published across five vendor namespaces, that inject JavaScript into every page of the Vietnamese movie and comic streaming sites that install them. The injected code runs two operations against a site’s visitors: a mobile ad-fraud and gambling-redirect chain, and, on iPhones, a WebKit-to-kernel exploit chain that installs spyware. We reported the iOS chain to Apple and coordinated disclosure. Apple confirmed the kernel escape was already fixed in iOS and macOS 26.1 before our report, and the two WebKit entry points are public and listed in CISA's Known Exploited Vulnerabilities catalog. Our earlier research covered six themes under a single vendor (ophimcms); this expands the confirmed set to 13 packages across five vendors and follows the chain through to the iOS payload and its most recent redeployment."
  https://socket.dev/blog/packagist-themes-ios-spyware
  https://thehackernews.com/2026/09/13-malicious-packagist-packages-target.html
• RevStealer Is Built To Be Silent
  "RevStealer is a Windows information stealer delivered inside a trojanized Electron desktop application that impersonates legitimate software. Morphisec Threat Labs observed it distributed through GitHub repositories and game-cheat-themed sites, with the most notable lure a fake “Claude Opus 5 Free Desktop” project that impersonates Anthropic and advertises free access to a paid AI model. The theft itself is ordinary. Browser databases, session cookies, cryptocurrency wallets, password-manager artifacts and VPN configurations have been the standard infostealer haul for years. What makes RevStealer worth studying is that every stage of it is engineered around the assumption that something is watching."
  https://www.morphisec.com/blog/revstealer-silence-is-its-greatest-weapon/
  https://www.helpnetsecurity.com/2026/09/01/revstealer-malware-claude-opus-5-github/
• FBI Raises Alarm Over Deceptive Phishing Campaign Targeting Prominent People
  "Attackers are targeting prominent, high-profile people, their family members and acquaintances on a commercial messaging application to gain long-term access to their accounts containing sensitive data, the FBI warned in an alert Tuesday. Officials did not describe the objectives or origins of the attackers, which have more recently impersonated government officials, journalists and publicly known personalities. Attackers are tricking victims into granting them access to a legitimate cloud service, such as Microsoft or Google, under the guise of reviewing a draft article or document."
  https://cyberscoop.com/fbi-alert-oauth-consent-phishing-campaign/
  https://www.ic3.gov/PSA/2026/PSA260901
• Ungentlemanly Behavior: Insights Into a Ransomware Operation
  "Counter Threat Unit (CTU) researchers identified a consistent post-exploitation playbook used in The Gentlemen ransomware-as-a-service (RaaS) scheme, operated by a threat group that CTU researchers track as GOLD SHERWOOD. Rapid privilege escalation, adaptive tool usage, and aggressive defense evasion enable ransomware deployment soon after initial access, sometimes within 24 hours of the first identified post-compromise activity. The affiliates leverage legitimate tools and compromised credentials to evade detection and accelerate impact. Organizations should prioritize hardening remote access services, enforcing multi-factor authentication (MFA), monitoring administrative activity, and detecting anomalous use of data exfiltration tools and staging directories."
  https://www.sophos.com/en-us/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation

Breaches/Hacks/Leaks

• Aesto Health Says Data Breach Affects Over 9.5 Million Patients
  "Aesto LLC, operating as Aesto Health, disclosed that a data breach discovered recently affects more than 9.5 million individuals. The private technology company provides software-as-a-service solutions that help healthcare organizations migrate, archive, and access patient data when replacing electronic health record systems or acquiring medical practices. The company first informed the public of the attack on June 24 via a notification on its website, stating that “a limited portion” of its Amazon Web Services infrastructure had been compromised."
  https://www.bleepingcomputer.com/news/security/aesto-health-says-data-breach-affects-over-95-million-patients/
  https://www.securityweek.com/9-5-million-impacted-by-aesto-health-data-breach/
  https://securityaffairs.com/198250/data-breach/attackers-access-aesto-health-aws-infrastructure-exposing-9-5-million-records.html
• Novocure Data Breach Affects More Than 1,400 Cancer Patients
  "Healthtech company Novocure says the data of an undisclosed number of employees and more than 1,400 U.S. cancer patients has been exposed in a mid-August cyberattack. Novocure is a global oncology company with more than 1,300 employees and operations in North America, Europe, the Middle East, and Asia, known for inventing and commercializing Tumor Treating Fields (TTFields), a non-invasive electromagnetic field therapy for cancer tumors. The Company disclosed in a filing with the U.S. Securities and Exchange Commission (SEC) that it discovered the incident after unauthorized access to some of its information systems in mid-August."
  https://www.bleepingcomputer.com/news/security/novocure-data-breach-affects-more-than-1-400-cancer-patients/
• AI Model Evaluator METR Hit By Credential Theft, Probing
  "A security nonprofit that helps evaluate risks in frontier AI models disclosed two cybersecurity incidents this week, including a breach that exposed an API key and a separate vulnerability that could have exposed nonpublic evaluation data. METR (Model Evaluation and Threat Research) disclosed two security incidents on Aug. 31 in which it was targeted by cyberattackers. In March of this year, attackers stole an API key used for inference on public models and consumed what METR described in a blog post as a "substantial" number of credits. In May, the company saw attackers probe publicly accessible infrastructure, including "an unsuccessful attempt to access internal data via an inadvertently exposed endpoint.""
  https://www.darkreading.com/identity-access-management-security/ai-model-evaluator-metr-credential-theft-probing
  https://metr.org/blog/2026-08-31-security-update/
  https://thehackernews.com/2026/09/attackers-steal-metr-api-key-and.html
  https://www.infosecurity-magazine.com/news/attackers-steal-metr-api-key/

General News

• The Guardrails Debate: Security Researcher Changes His Mind
  "Four security experts took the stage, surrounded by massive skeletons, the theme for the capture-the-flag (CTF) competition that would commence later. A panel discussion about Anthropic's Claude model compromising real-world systems was first on the agenda, but quickly turned into a broader debate on artificial intelligence (AI) guardrails. While the speakers disagreed on some fronts they aligned on one stark reality: AI capabilities are advancing at a “terrifying” pace. The battle of the bots escalated recently when frontier artificial intelligence (AI) models from OpenAI and Anthropic broke out of sandboxes during security evaluations and targeted real companies, including OpenAI's high-profile breach of Hugging Face."
  https://www.darkreading.com/cyber-risk/the-guardrails-debate-security-researcher-changes-his-mind
• Stronger Security Drives Ransomware Groups To Recruit From Within
  "Not all breaches begin after threat actors exploit a zero-day vulnerability or launch an increasingly sophisticated phishing campaign — some start with an employee who decides to help attackers walk right through the front door. A rise in malicious insider threats reflects a good news, bad news situation: organizations are bolstering their security protocols, but cybercriminals are exploiting the one thing that firewalls and VPNs can't defend against—people with legitimate access. Incidents stemming from insider threats can result in ransomware deployment, direct financial loss, compliance violations, and full data exfiltration, just to name a few damaging outcomes."
  https://www.darkreading.com/cyber-risk/stronger-security-drives-ransomware-groups-to-recruit-from-within
• What Your Vendor Says About PQC Tells You If They Are Ready
  "In this interview with Help Net Security, Dr. Yaakov Stein, VP CTO of Allot, discusses what post-quantum readiness looks like inside a mobile network. The discussion covers which operator traffic stays sensitive for years, including subscriber identity mappings, billing records and call metadata, and which becomes worthless within hours. It walks through the order of work, starting with a crypto inventory and hybrid key exchange on TLS interfaces, then IPsec links. It also names the vendor answers that should raise suspicion and explains why a missed interface is the likely point of failure."
  https://www.helpnetsecurity.com/2026/09/01/yaakov-stein-allot-telecom-pqc-migration/
• 65% Of Enterprises Have Seen AI Agents Act Out Of Scope
  "AI agents have acted outside their intended scope at 65% of surveyed enterprises, with 29% reporting measurable organizational impact. The finding comes from Agents Without Guardrails, a research report from Enterprise Management Associates (EMA) compiled for Cequence Security and based on responses from 202 enterprise technology and security leaders. Some 46% said their organizations were already scaling agentic AI across multiple departments and production workflows, while nearly 79% were running generative and agentic AI simultaneously."
  https://www.infosecurity-magazine.com/news/65-percent-enterprises-ai-agents/
  https://www.cequence.ai/wp-content/uploads/2026/08/EMA-Research-Report-Agents-Without-Guardrails.pdf
• Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones
  "The most common way into a company last year was to ask. A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix, and it was the most common initial access method Microsoft’s team observed last year, accounting for 47% of the attacks in their notifications. Nothing arrives as an attachment, so there is nothing to scan. No vulnerability is used, so there is nothing to patch."
  https://thehackernews.com/2026/09/threat-actors-dont-want-better-attacks.html

อ้างอิง
Electronic Transactions Development Agency (ETDA)

เมื่อวันที่ 31 สิงหาคม 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 2 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-81578 PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
• CVE-2026-82078 PaperCut NG/MF Unsafe Reflection Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/08/31/cisa-adds-two-known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand