สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Industrial Sector

• Toptech TMS7 And TopHAT
  "Successful exploitation of these vulnerabilities could allow an attacker to access critical data or execute arbitrary code."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02
• VIVOTEK Camera Firmware
  "Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentially with root privileges, leading to full compromise of the camera system."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-03
• Anjvision YSSD-RTMP-H5
  "Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05
• MikroTik RouterOS
  "Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution or cause a denial of service."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06
• Viidure Dashcam Android Application
  "Successful exploitation of these vulnerabilities could allow attackers to access, modify, or delete sensitive user data and critical system files, potentially compromising the operation of the entire platform."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07
• Lantronix G520 Series Cellular Gateway
  "Successful exploitation of these vulnerabilities could allow an attacker to replace software and execute arbitrary code with root privileges."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-01
• Baicells Nova 430H
  "Successful exploitation of this vulnerability could allow an attacker to inject malformed messages which may lead to a denial-of-service condition."
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-04

New Tooling

• OperTraitors: How Kubernetes Operators Betray Your Security Posture
  "Kubernetes operators are coded to drastically reduce operational toil by acting as automated site reliability engineers. However, their reliance on highly privileged service accounts introduces a severe, often overlooked security weak spot. To quantify and combat threats aiming to take advantage of this weak spot, we have released OperTraitor, an open-source, large language model (LLM)-powered analysis engine. OperTraitor ingests raw role-based access control (RBAC) configurations directly from locally installed operators and the OperatorHub catalog. Upon doing so, it calculates the difference between an operator's documented functionality and its actual granted privileges."
  https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/
  https://github.com/paloaltonetworks/opertraitor

Vulnerabilities

• CISA Adds One Known Exploited Vulnerability To Catalog
  "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
  CVE-2026-86950 Apple Multiple Products Out-of-Bounds Write Vulnerability"
  https://www.cisa.gov/news-events/alerts/2026/09/29/cisa-adds-one-known-exploited-vulnerability-catalog
• New Spectre v2 Attack Variant Leaks Linux Root Password Hash In Minutes
  "A new Spectre v2 attack variant called Branch Target Reuse (BTR) can recover root password hashes from Intel computers running Linux in just a few minutes. A BTR attack exploits stale information in a processor's branch predictor after a just-in-time (JIT) engine reuses memory for new code. By manipulating this leftover information, an attacker can trick the processor into temporarily executing the wrong instructions and potentially expose sensitive data."
  https://www.bleepingcomputer.com/news/security/new-spectre-v2-attack-variant-leaks-linux-root-password-hash-in-minutes/
  https://www.vusec.net/projects/btr
  https://thehackernews.com/2026/09/new-spectre-v2-btr-attack-leaks-linux.html
  https://www.securityweek.com/new-spectre-v2-variant-exposes-intel-amd-arm-cpus-to-data-leaks/
• Kiteworks Patches Critical Flaw, Brings Customer Systems Online
  "American tech company Kiteworks has lifted a precautionary advisory asking customers to shut down systems after patching a critical vulnerability. Formerly known as Accellion, it operates a Private Content Network (PCN) that integrates enterprise email, file sharing, Managed File Transfer (MFT), APIs, and web forms into a single platform. Kiteworks provides services to thousands of global corporations and government agencies, and its Private Data Network has over 100 million end-users."
  https://www.bleepingcomputer.com/news/security/kiteworks-lifts-shutdown-warning-after-patching-critical-flaw/
  https://www.kiteworks.com/company/press-releases/kiteworks-restores-systems-credible-threat/
  https://thehackernews.com/2026/09/kiteworks-fixes-critical-flaw-found.html
  https://cyberscoop.com/kiteworks-lifts-shutdown-advisory-after-credible-threat-intelligence-from-federal-authorities/
  https://www.infosecurity-magazine.com/news/kiteworks-customers-restart/
• Look, Don't Load: Model Inspection In Unsloth Studio Leads To Critical Arbitrary Code Execution
  "What is Unsloth. Unsloth is one of the most popular open-source libraries for fine-tuning and quantizing LLMs, and it makes work that used to require deep systems knowledge accessible to a very large community. Studio is its browser-based front end, currently in beta. Enterprise relevance. Unsloth is part of established AI development workflows: Databricks includes the library in its AI v5 environment. Its role also extends to model distribution. Hugging Face ranks Unsloth as the third-largest source of model derivatives on the Hub, behind Qwen and Google, and a Forbes analysis highlights the need for enterprises to track the third-party artifacts they consume. These facts establish Unsloth’s relevance to enterprise AI teams, though they do not measure adoption of the affected Studio interface."
  https://www.pillar.security/blog/look-dont-load-model-inspection-in-unsloth-studio-leads-to-critical-arbitrary-code-execution
  https://www.darkreading.com/application-security/unsloth-studio-flaw-model-inspection-code-execution
• Package Name To Role Credentials In Code Interpreter: Two RCE CVEs In The AgentCore Python SDK
  "One package name was all it took: the BeyondTrust Phantom Labs team turned a routine pip install into remote code execution inside an Amazon Bedrock AgentCore Code Interpreter sandbox twice, and, where the customer had configured the interpreter with an execution role, into that role's AWS credentials. This blog breaks down both CVEs in the AgentCore Python SDK and the proof-of-concept exploits behind them."
  https://www.beyondtrust.com/blog/entry/amazon-bedrock-agentcore-python-sdk-rce-cves
  https://www.infosecurity-magazine.com/news/aws-agentcore-sdk-flaws-ai/
• Cycode Uncovers Account Takeover In MCP Python SDK
  "A malicious MCP server tricked the SDK into sending login credentials to the attacker instead of the real login provider. The Model Context Protocol (MCP) is an open standard introduced by Anthropic and donated to the Linux Foundation’s Agentic AI Foundation (AAF), which maintains it."
  https://cycode.com/blog/mcp-python-sdk-oauth-account-takeover/
  https://thehackernews.com/2026/09/official-mcp-python-sdk-flaw-can-let.html
• Self-Replicating Prompt Injections Exist
  "We show the existence of a new variety of prompt injection, which can self-propagate akin to a computer worm. No impact was observed outside of the simulated tool calls in training and evaluation; we are sharing this due to the novel nature of the prompt injection, not because of any incident."
  https://alignment.openai.com/misalignment-reports/self-replicating-prompt-injections-exist/
  https://www.theregister.com/security/2026/09/29/add-one-more-ai-worry-to-the-nightmare-scenario-self-replicating-prompt-injections/5299922

Malware

• Swarming Against Citrix 0-Day Exploitation
  "GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. GreyNoise also expands the GOG through Project Swarm, which enables the broader security community to join the effort. The activity discussed in this blog was derived from a Swarm participant sensor."
  https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation
  https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances
  https://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/
  https://cyberscoop.com/citrix-netscaler-zero-day-attacks-three-weeks-undetected/
  https://www.theregister.com/security/2026/09/29/custom-malware-used-in-citrix-0-day-attacks-targeting-govt-banks-professional-services/5299867
  https://www.helpnetsecurity.com/2026/09/29/netscaler-zero-day-exploitation-escalates-into-mass-attacks-cve-2026-88771/
• Beware Of Phishing Emails Disguised As Quote Requests
  "Recently, the AhnLab SEcurity intelligence Center (ASEC) confirmed that phishing emails disguised as requests for project quotes are being circulated. The email body is disguised as a request to submit a quote for discussing the project budget and prompts recipients to download an attached compressed file for verification."
  https://asec.ahnlab.com/en/95599/
• Beware Of Phishing Emails That Disguise Themselves As Project Material Purchase Requests
  "Recently, the AhnLab SEcurity intelligence Center (ASEC) identified a case of phishing emails that disguise themselves as project material purchase request forms. These emails impersonate employees of a specific company in Korea and trick recipients into opening a malicious XLS file attached to the email, which is disguised as a project material purchase request form."
  https://asec.ahnlab.com/en/95598/
• Attackers Abuse ChatGPT Custom GPTs To Deliver RAT Via ClickFix
  "Attackers are abusing ChatGPT Custom GPTs to impersonate legitimate product offerings, then directing victims to a malicious "backup" site through a trusted ChatGPT-hosted interface. Huntress researchers found two Custom GPTs linked to the same campaign that were being used in this manner. The campaign uses a ClickFix lure to trick victims into running PowerShell, which downloads a malicious MSI and begins a multi-stage, obfuscated infection chain. The payload establishes resilient access through dual persistence and DLL sideloading, using a Canon-signed executable (and, in a later wave, a Stardock-signed one) to load malicious code. Huntress investigated at least 40 related incidents, including two confirmed Custom GPT-driven infections."
  https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat
  https://www.bleepingcomputer.com/news/security/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware/
  https://www.securityweek.com/hackers-use-chatgpt-custom-gpts-in-clickfix-attacks/
  https://www.helpnetsecurity.com/2026/09/29/malicious-chatgpt-custom-gpt-malware-via-clickfix/
• Star Blizzard Refines Phishing And Malware Delivery With The RedFlick Technique
  "Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that Microsoft tracks as “RedFlick”. These changes represent a notable shift in the actor’s operational tradecraft and support ongoing cyberespionage activity targeting Ukrainian individuals and institutions as well as international non-government organizations (NGOs), Western think tanks, governments, and other organizations associated with international policy—particularly those with a nexus in supporting Ukraine."
  https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/
  https://cyberscoop.com/microsoft-star-blizzard-redflick-phishing-campaigns/
• From BlackCat To Panda Workshop: Inside The Evolving C2 Panel Behind RATHat
  "RATHat is an Android banking trojan recently documented in public reporting, distinguished by an architecture in which the malicious application is only the entry point. Once granted the Accessibility Service, the application enables wireless debugging on its own, pairs with the device's ADB daemon to obtain a shell, and uses it to stage a native Go service and an FRP client that opens a reverse tunnel to the operator. The service runs outside the application's process and permission model, keeps its own channel to the C2, and survives the removal of the application until the next reboot. A shell that the malware grants itself, rather than a permission the user grants the application, is a model other families may adopt, and security controls should extend to this scope."
  https://www.cleafy.com/cleafy-labs/from-blackcat-to-panda-workshop-inside-the-evolving-c2-panel-behind-rathat
  https://www.infosecurity-magazine.com/news/rathat-c2-panel-malware-as-a/
• Fake iPhone Duo Preorder Scam Triggers DarkSword Attack
  "Apple announced its first foldable iPhone on September 9, and scammers were ready to ‘deliver’ one before anyone could buy it. Most of what we found around the launch of the iPhone Duo and iPhone 18 Pro was familiar fraud. But one fake preorder page was different."
  https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack
• From EDU Account Takeover To Job Scam Abuse: West African Fraud Actors Target Universities
  "Proofpoint is tracking a cluster of threat activity specifically targeting U.S. universities. The fraud ecosystem observed in campaigns aligns with known advance fee fraud (AFF) tactics. The campaigns begin with credential harvesting attempts that lead to job scam monetization leveraging AFF. University students, staff, and alumni are a perennial target for many different types of cybercrime, including job scams, fake scholarships, and account takeover (ATO) activities. Threat actors find higher education email accounts valuable for a variety of reasons including: younger students may have less experience with email correspondence and are new to engaging with potential work or money-making opportunities; alumni may still have active email accounts, but may not use them frequently, providing an opportunity for threat actors to hijack their contact lists; and staff and faculty are constantly receiving communications from students, parents, community members, etc. from a variety of personal and university emails."
  https://www.proofpoint.com/us/blog/threat-insight/edu-account-takeover-job-scam-abuse-west-african-fraud-actors-target
• PhantomSub: Malicious Npm Campaign Secretly Adds Users To WhatsApp Spam Channels
  "The OX Research team identified 101 npm packages as part of a malicious WhatsApp group subscriber campaign. The malicious packages abuse the “Baileys” WhatsApp open source project to add the victims to groups without their consent. 16 of those packages were removed from npm as of September 28, 2026. Earlier reports of Baileys WhatsApp campaign were made by SafeDep, OSV and Xygeni back in August and September 2026. Baileys is an open source project containing an unofficial implementation of the WhatsApp API used by developers to automate actions through their WhatsApp accounts – such as customer support bots, chat managers or data scraping."
  https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/
  https://thehackernews.com/2026/09/101-malicious-npm-packages-add.html
• Operation Master: Deconstructing a Multi-Tiered Intrusion And Monetization Pipeline
  "SOCRadar Threat Research Unit (STRU) has uncovered an end-to-end cybercrime operation dubbed Operation Master, in which a threat actor compromised enterprise networks, stole customer and billing databases, offered portions of the data for sale on underground forums, and later repurposed those exact assets to power an automated, multi-tenant invoice fraud platform. Operating across multiple countries, the threat actor compromised critical network infrastructure, including VPN gateways via a GlobalProtect authentication bypass (CVE-2026-0257), while concurrently executing advanced web application exploits, deploying the AdaptixC2 framework, and leveraging an AI-assisted development workflow."
  https://socradar.io/blog/operation-master-intrusion-monetization-pipeline/

Breaches/Hacks/Leaks

• It Was a Matter Of When, Not If...
  "Security people always say it’s not a matter of if, but when you get hacked. It took us (almost) seven years but we can now say that we’re the hackers that got hacked. We noticed suspicious activity, investigated, and came to the inevitable conclusion that damn, we got hacked. So what do hackers do when they get hacked? Handle it the way we think it should be handled. That is open, transparent and honest, even if it sucks. So far, we’ve been in full incident response mode, blocked access to our infrastructure and started a forensics investigation with the assistance of a third party incident response team."
  https://www.divd.nl/newsroom/articles/when-no-if/
  https://www.bleepingcomputer.com/news/security/automated-ai-agent-used-to-breach-cybersecurity-nonprofit-divd/
• French Tax Data Theft Using Stolen Staff Passwords Went Undetected For Seven Weeks
  "An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July. Neither the tax administration nor France's national cybersecurity agency saw the data leave. The attack was not sophisticated, the agency, ANSSI, says in a report (in French) published on Tuesday: it worked because of weak login protection, poorly separated networks and gaps in monitoring. The tax administration, known as the DGFIP, runs France's tax website, impots.gouv.fr. The data came from E-Contact, the tool taxpayers use to message the tax administration."
  https://thehackernews.com/2026/09/french-tax-data-theft-using-stolen.html
• Russian Pizza Chain With 1,500 Locations Confirms Cyberattack Following Hacker Claims
  "Hackers breached the systems of popular Russian fast-food chain Dodo Pizza and gained access to some customers’ personal information, the company said Monday. According to Dodo Pizza, the potentially compromised information included customers’ names, addresses, email addresses, phone numbers, dates of birth and order details. The company said it does not store customers’ payment information and that payment data was therefore not compromised. “The attackers’ access has been blocked, and an internal investigation is ongoing,” Dodo Pizza said, adding that it had notified Russian communications regulator Roskomnadzor about the incident."
  https://therecord.media/russian-pizza-chain-dodo-confirms-data-breach
• Arizona Supreme Court Says Hackers Stole Residents’ Personal Data
  "The Arizona Supreme Court announced Friday that the state’s court system was attacked by hackers who stole the personal information of “many Arizonans.” Arizona Supreme Court Chief Justice Ann Scott Timmer said in a statement that the state court system was targeted by criminal hackers “or their bots.” “Court leaders believe the criminal hackers copied personally identifiable information about many Arizonans,” Timmer said. “The Supreme Court’s Administrative Office of the Courts is in the process of alerting as many people as possible whose information it believes the criminal hackers copied.”"
  https://therecord.media/arizona-supreme-court-says-hackers-stole-data
• Pentagon Personnel Agency Data Breach Impacts 3 Million People
  "The US Defense Manpower Data Center (DMDC), which maintains personnel records for the Pentagon, has started notifying people that their personal information was exposed. According to the DMDC’s notice, unauthorized users had access to one of its file-sharing servers for roughly nine months. A copy of the notification letter, dated September 18 and shared online by a recipient, says the problem was discovered in mid-July."
  https://www.securityweek.com/pentagon-personnel-agency-data-breach-impacts-3-million-people/
  https://securityaffairs.com/200017/uncategorized/three-million-affected-in-pentagon-personnel-agency-data-breach.html

General News

• Former US Air Force Members Sent To Prison Over BEC Attacks
  "Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. According to court documents, 25-year-old Chijioke Timothy Odimegwu and 26-year-old Harafat Mogaji carried out these attacks while stationed at Dover Air Force Base in Delaware."
  https://www.bleepingcomputer.com/news/security/former-us-air-force-members-sent-to-prison-over-bec-attacks/
  https://therecord.media/us-air-force-members-given-6-year-sentence-cyber
• Vietnamese Man Charged In $16 Million 'pig Butchering' Crypto Scam
  "A Vietnamese national was charged with money laundering for his role in a massive "pig butchering" scam, which defrauded a victim out of $16 million worth of cryptocurrency. 37-year-old Trung Nguyen Van entered the United States through the San Ysidro, California / Mexico pedestrian border entry point on September 22 and was arrested before boarding a flight to Taiwan out of Los Angeles International Airport on September 24. One of Van's victims transferred about $16 million in cryptocurrency between June and August 2024 in transfers directly traceable to Van's cryptocurrency wallet, believing they were investing in a crypto investment platform called "Triangle.""
  https://www.bleepingcomputer.com/news/security/vietnamese-man-charged-in-16-million-pig-butchering-crypto-scam/
• Pro-Russia Hacktivists Increase OT Intrusion Claims Across EU
  "Claims of cyberattacks against operational technology and industrial environments increased significantly in 2025 - particularly those involving pro-Russia hacktivist groups, the European Union Agency for Cybersecurity warned. ENISA released its annual Threat Landscape report last week, finding that ideology-driven malicious cyberattacks accounted for 57.3% of all incidents the agency recorded in 2025, followed by financially motivated activity at about 30%. In total, there were 4,709 hacktivist claims against European Union member states last year, 89.5% of which involved distributed denial-of-service attacks. The rest involved unauthorized access."
  https://www.bankinfosecurity.com/pro-russia-hacktivists-increase-ot-intrusion-claims-across-eu-a-32966
  https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA Threat Landscape 2026_Final.pdf
• OpenAI’s GPT-6 Astra Ran Supply Chain Attacks Despite Being Told Not To
  "OpenAI’s GPT-6 Astra carried out supply chain attacks on software outside the scope of a security test, according to the UK AI Security Institute (AISI). AISI tested the model before its public release. The tests ran inside a simulation, so no live systems were touched. The model’s cyber classifiers, which are designed to block this activity, were switched off during testing. “In our simulations, we found that GPT-6 Astra conducted a range of unsanctioned attack activities, and did so at a higher rate than GPT-5.6 Sol and GPT-5.5. Attack activities included GPT-6 Astra creating fake identities which it used to deceive developers, posting comments from fake accounts arguing against the results of accurate security reviews, and delivering malicious payloads to open-source codebases,” the UK government research organization wrote."
  https://www.helpnetsecurity.com/2026/09/29/openai-gpt-6-astra-supply-chain-attacks-test-simulations/
  https://www.aisi.gov.uk/blog/gpt-6-astra-performs-unsanctioned-supply-chain-attacks-in-simulations
  https://securityaffairs.com/199947/ai/gpt-6-astra-and-the-supply-chain-attack-it-wasnt-asked-to-launch.html
• OpenAI Agents Go Rogue: When AI Agents Bypass Guardrails
  "Recently and rather quietly, there have been reports that describe an alarming case where thousands of AI agents used a dormant wiki as a coordination mechanism. On the surface, it’s a fascinating technical story. But for technology leaders, it serves as something more important: a case study or a cautionary tale of how autonomous systems behave when given marching orders, tools, and enough freedom to pursue and produce outcomes."
  https://blog.barracuda.com/2026/09/29/openai-agents-go-rogue-ai-agent-governance
• Four Cyber Threats Harboring Big Plans For The Future
  "Not unlike the fictional Skynet sending increasingly sophisticated ‘Terminators’ as older versions of the monster failed to achieve their earthly missions, cyberattacks are growing more persistent and automated, further testing an organization’s security maturity. To stay in tune with future risks, it has become imperative to treat resilience as an operational objective in constant flux."
  Priority: 3 - Important
  Relevance: General
  https://www.securityweek.com/four-cyber-threats-harboring-big-plans-for-the-future/

อ้างอิง
Electronic Transactions Development Agency (ETDA)

เมื่อวันที่ 24-25 กันยายน 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 5 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability
• CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability
• CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability
• CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
• CVE-2026-87902 WordPress Core Remote File Inclusion Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/09/24/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://www.cisa.gov/news-events/alerts/2026/09/25/cisa-adds-one-known-exploited-vulnerability-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 4 รายการ เมื่อวันที่ 24 กันยายน 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-267-01 Botslab G980H Dashcams
• ICSA-26-267-02 Eufy Omni C20, Omni X10 Pro
• ICSA-26-258-02 Wärtsilä FOS-Onboard (Update A)
• ICSA-26-209-02 Siemens Mendix Runtime (Update A)

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

เมื่อวันที่ 22 กันยายน 2569 Cybersecurity and Infrastructure Security Agency (CISA) ได้เพิ่มช่องโหว่ใหม่ 4 รายการลงในแคตตาล็อก Known Exploited Vulnerabilities (KEV) จากหลักฐานที่พบว่ามีการโจมตีใช้งานจริงแล้ว มีรายละเอียดดังนี้

• CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability
• CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerability
• CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
• CVE-2026-94127 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

ทาง CISA จะปรับปรุงและเพิ่มช่องโหว่ใหม่เข้าสู่แคตตาล็อก KEV อย่างต่อเนื่อง เพื่อให้ครอบคลุมความเสี่ยงที่ตรวจพบจริงในปัจจุบันและอนาคต

อ้างอิง
https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Cybersecurity and Infrastructure Security Agency (CISA) ได้เผยแพร่คำแนะนำเกี่ยวกับระบบควบคุมอุตสาหกรรม (ICS) จำนวน 8 รายการ เมื่อวันที่ 22 กันยายน 2569 เพื่อให้ข้อมูลที่ทันเวลาเกี่ยวกับประเด็นด้านความมั่นคงปลอดภัย ช่องโหว่ และการโจมตีที่เกี่ยวข้องกับระบบ ICS โดยมีรายละเอียดดังนี้

• ICSA-26-265-01 lwIP TCP/IP Stack MQTT Client Application
• ICSA-26-265-02 lwIP (Lightweight IP)
• ICSA-26-265-03 Siemens Siveillance Control
• ICSA-26-265-04 Siemens SIPLUS and SIMATIC Products
• ICSA-26-265-05 Siemens Desigo CC family
• ICSA-26-265-06 Siemens Industrial Edge Management
• ICSA-26-265-07 Siemens SIMOVE Fleetmanager and SIPLANT
• ICSA-26-265-08 Siemens WTV676 and WTV776
• ICSA-26-265-09 OpenPLC Runtime v3

CISA แนะนำให้ผู้ใช้งานและผู้ดูแลระบบ ตรวจสอบคำแนะนำ ICS ที่เผยแพร่ล่าสุด เพื่อศึกษารายละเอียดทางเทคนิคและแนวทางการลดความเสี่ยง (mitigations)

อ้างอิง
https://www.cisa.gov/news-events/ics-advisories
สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

Financial Sector

• Security Issues In The Korean & Global Financial Sector In August 2026
  "In Attack Stage 1, phishing was the highest at 2.1, Up from 1.8 The previous month. In Attack Stage 2, dropper/downloader was the highest at 1.1, Down from 3.2 The previous month. In Stage 3 of the attack, Infostealers were the most prevalent at 0.3, Down from 0.4 The previous month. WebShells, Backdoors, HackTools, Ransomware, and CoinMiners remained at low levels."
  https://asec.ahnlab.com/en/95589/

Industrial Sector

• One Packet Can Crash OT Servers In Industrial Sectors
  "A newly disclosed flaw in an open source database used in industrial and Internet of Things (IoT) environments could let unauthenticated attackers crash vulnerable servers with a single specially crafted network packet. The zero-day vulnerability, tracked as CVE-2026-42542 affects TDengine, a time-series database that organizations in sectors like manufacturing, energy, automotive, and IoT use to store and analyze large volumes of data collected over time. Examples of such data include readings from sensors and industrial equipment, as well as application- and infrastructure-related performance metrics."
  https://www.darkreading.com/ics-ot-security/one-packet-crash-servers-tdengine
• Update
  CVE-2026-42542 affected TDengine v3.4.0.0 through v3.4.1.5 and was fixed in v3.4.1.6, released
  Official advisory: https://docs.tdengine.com/security-guide/security-advisories/
  Release notes: https://docs.tdengine.com/release-history/notes/3.4.1.6/

New Tooling

• Authorizer: Open-Source Authentication And Authorization For Your Apps
  "Authorizer is an open-source server for sign-in and access control in web and mobile apps. Teams run it on their own infrastructure and keep user accounts in a database they choose. Its maintainers have built a permissions engine and an interface for AI agents into the same Go program that logs users in, so a chatbot can ask whether a user may see a document before it fetches that document. This affects any team that connects an AI assistant to company files. A vector search, which is the lookup that finds text similar to a question, returns close matches without checking who asked. Authorizer gives the search a list of documents the user is allowed to see, and everything else is dropped before it is scored."
  https://www.helpnetsecurity.com/2026/09/28/authorizer-open-source-authentication-server/
  https://github.com/authorizerdev/authorizer

Vulnerabilities

• How I Could've Accessed 17 Trillion Microsoft Records
  "An estimated 17.3 trillion stored rows across a wide range of Microsoft datasets were reachable through a single internal analytics service, all because it never checked the signature on a login token. That flaw let me claim an administrator’s identity and submit unauthorized SQL queries without any real credentials. I used only table descriptions, metadata, and bounded sample rows to understand the potential scope."
  https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
  https://www.helpnetsecurity.com/2026/09/28/microsoft-titan-jwt-signature-flaw/
• “Drunk” AI Is Terrible At Keeping Secrets
  "AI models taught to write like drunk people became easier to jailbreak and more likely to leak secrets shared in confidence. That is the finding of UNSW Sydney researchers Anudeex Shetty, Aditya Joshi and Salil Kanhere, published in their paper “In Vino Veritas and Vulnerabilities.” “The key research question from the natural language processing (NLP) side for me was, how do we get LLMs drunk?” said Aditya Joshi, a senior lecturer at the UNSW School of Computer Science and Engineering. “And the cyber security question was, how do we measure their vulnerabilities once they are drunk?”"
  https://www.helpnetsecurity.com/2026/09/28/drunk-ai-models-jailbreak-research/
• Apple Patches CoreGraphics Flaw Possibly Exploited In Targeted Attacks
  "Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks. The vulnerability, tracked as CVE-2026-86950, refers to an out-of-bounds write impacting the CoreGraphics component that could lead to arbitrary code execution when processing a maliciously crafted file. The iPhone maker said the issue was addressed with improved bounds checking. It credited Meta Product Security with discovering and reporting the issue."
  https://thehackernews.com/2026/09/apple-patches-coregraphics-flaw.html

Malware

• Vulnerability Attack Case: Installation Of a Web Shell And Execution Of a Scanner By Exploiting a Telerik UI Vulnerability
  "The AhnLab SEcurity intelligence Center (ASEC) has identified two vulnerability attack cases that exploited a remote code execution vulnerability (CVE-2019-18935) targeting unpatched Telerik UI for ASP.NET AJAX servers. In the first incident, after exploiting the vulnerability, the attacker executed a reverse shell, attempted to perform privilege escalation, and installed a web shell; in the second incident, the attacker ran a scanner tool to search for additional Attack Targets."
  https://asec.ahnlab.com/en/95561/
• Storm-3168: Agentic-Driven Cloud Attacks Using Compromised Service Principals
  "Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first documented agentic ransomware operation. Our investigation found an extensive Azure-focused resource destruction activity using compromised service principals and cloud credential collection that could be used to facilitate future exfiltration."
  https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/
  https://thehackernews.com/2026/09/jadepuffer-linked-attackers-used.html
  https://www.bleepingcomputer.com/news/security/jadepuffer-agentic-ai-attacks-target-azure-destroy-cloud-resources/
  https://www.darkreading.com/cloud-security/jadepuffer-ai-actor-azure-tenant-destructive-cloud-attack
  https://securityaffairs.com/199905/cyber-crime/storm-3168-linked-to-jadepuffer-abused-stolen-azure-identities.html
• Chrome Store Hosts 'Poper Blocker' Spyware Downloaded By Millions
  "Millions of people have downloaded infostealers disguised as legitimate ad-blocking browser extensions, in part because Google has provided them with seals of approval on the Chrome Web Store. That's the word from Bay Area Labs, which uncovered one such app, "Poper Blocker," lurking in the Chrome Web Store. Poper Blocker has every trapping of a legitimate, mainstream app: It sports a big, green "Featured" badge, and its developer has earned a trustworthy "Established Publisher" status with Google. It enjoys a 4.8 out of 5 star rating from more than 81,000 reviewers. It claims more than 2 million active users. In short, no user could spot anything untoward about this program were they to come across it while shopping for an ad blocker."
  https://www.darkreading.com/application-security/chrome-store-poper-blocker-spyware-downloaded-millions
• NeedyMantis: Unpacking a Post-Compromise Malware Family Used In Targeted Operations
  "Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Based on observed activity, NeedyMantis is typically deployed after a threat actor has already established access to a target environment, indicating that the malware is used to maintain long-term access and support follow-on operations."
  https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/
  https://thehackernews.com/2026/09/hackers-use-needymantis-to-maintain.html
• RatHat Android Malware Console Uses Gemini To Identify Higher-Value Victims
  "RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer runs a separate copy. The console stores what the malware collects from each phone, including text messages and passwords entered into fake login screens overlaid on banking apps. Its latest version asks Google's Gemini AI model to estimate each victim's bank balance from those messages and sorts the phones into high-value and mid-value groups."
  https://thehackernews.com/2026/09/rathat-android-malware-console-uses.html
• The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, And AI Environments
  "Identity has long been the primary attack surface of the cloud. Infostealer malware, distributed through an industrialized cybercrime economy, is a leading initial access vector for compromising enterprise cloud, code, and AI environments. By targeting unsecured endpoints of developers through social engineering and supply chain attacks, threat actors steal credentials, API keys, and active session tokens, thereby bypassing the stronger defenses protecting most cloud environments from more direct attacks. Stolen credentials are widely recognized as one of the most common initial infection vectors - Microsoft, Recorded Future, and Verizon’s DBIR all point to infostealers as a cause of major concern. These attacks begin with a simple malware infection on a personal device, and end with attackers gaining privileged access to your AWS, Azure, or GCP estate, and more recently to the code platforms used by your organization, such as GitHub or GitLab."
  https://www.wiz.io/blog/infostealer-incursion-cloud-ai-credentials
• A Fake Security Locker, Delivered By Google Ads
  "Netskope Threat Labs has been tracking a cloud-hosted tech-support-scam (TSS) kit that hijacks a victim’s browser with a fake security alert and pressures them into calling a bogus support line, where the goal is to either extract payment for fake “support,” gain remote access, or collect personal and financial details. Victims arrive by clicking a Google ad and land on a loading spinner webpage then into what looks like an ordinary online store, with nothing that reads as malicious."
  https://www.netskope.com/blog/a-fake-security-locker-delivered-by-google-ads

Breaches/Hacks/Leaks

• Japan's Keio Confirms Ransomware Attack Disrupted Business Systems
  "Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting some of its business systems. Following a system failure in the early hours of Saturday, the company confirmed the attack and shut down its network to prevent additional damage. The company said it is investigating the extent of the impact and whether the attackers accessed any customer or business partner information."
  https://www.bleepingcomputer.com/news/security/japans-keio-confirms-ransomware-attack-disrupted-business-systems/
• Times Car Confirms Data Breach Affecting 6.6 Million User Accounts
  "Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. The company announced the incident on September 25, saying that a third party had accessed its systems at the beginning of the month. Times Car took action to block the unauthorized access on September 26. At the time, the company said it was investigating whether the attackers accessed members' personal information, but confirmed the data theft in an update earlier today."
  https://www.bleepingcomputer.com/news/security/times-car-confirms-data-breach-affecting-66-million-user-accounts/
• Everything Everywhere: Systemic Data Exposure In Supabase Apps
  "Since 2025, the database service Supabase has been known to leak data through a variety of configuration issues. Despite improvements to Supabase product security, those issues continue to exist; multiplied by Supabase’s growth as a favorite tool for Claude Code, there are now thousands of Supabase instances exposing personal information and other data. In the largest study of its kind, UpGuard Research shows how Supabase misconfigurations expose personal data for people all over the world."
  https://www.upguard.com/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps
  https://www.bleepingcomputer.com/news/security/misconfigured-supabase-apps-expose-data-in-over-16-000-databases/
• FBI Job Portals Remain Offline After ShinyHunters Claims Breach Via PeopleSoft Zero-Day
  "The FBI’s online portals for job applicants (at apply.fbijobs.gov) and special agent applicants (at fbijobs.gov/special-agents) are still unavailable, following what appears to be successful compromises by the ShinyHunters cyber extortion group. Last week, the United States’ domestic intelligence and security service confirmed it was investigating ShinyHunters’ claim of having compromised personal information of FBI employees. ShinyHunters told The Register they leveraged a currently unspecified and unconfirmed Oracle PeopleSoft zero-day vulnerability to breach the portals."
  https://www.helpnetsecurity.com/2026/09/28/fbi-job-portals-offline-shinyhunters-breach/
  https://cyberscoop.com/fbi-data-breach-shinyhunters-agent-safety-risk/
  https://www.malwarebytes.com/blog/data-breaches/2026/09/fbi-agents-blood-tests-and-doctors-notes-surface-after-breach
• Bitget Says Attacker Exploited Third-Party Security Product Flaw To Steal $388M
  "The attacker who stole about $388 million from the cryptocurrency exchange Bitget gained access through a vulnerability in a third-party security product the exchange used, Bitget said on Monday. The attacker exploited the flaw to obtain high-level internal credentials and then, on September 24, used them to send fraudulent withdrawal commands to Bitget's wallet system. Exchanges keep most customer funds in offline cold wallets and use hot and warm wallets to process withdrawals. Transfers from those wallets must still be approved before they are signed. The stolen funds came from part of Bitget's hot and warm wallets, and its cold wallets were not affected."
  https://thehackernews.com/2026/09/bitget-says-attacker-exploited-third.html
  https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/
  https://www.infosecurity-magazine.com/news/bitget-restarts-withdrawals-387-5m/
• Cyberattack On Polish Medical Software Provider Exposes Patient Data
  "Hackers stole personal data from a Polish healthcare software provider in the latest cyberattack to hit the country’s medical sector in recent months. Qbusoft, which develops the Medyc medical records and practice management platform, was breached after an attacker exploited an SQL injection vulnerability in August, according to a notification issued last week by one of the healthcare providers affected by the incident. SQL injection is a security flaw that allows hackers to trick a website into giving them access to information stored in its database."
  https://therecord.media/poland-cyberattack-medical-medyc
• DC Health Agency Exposes 400,000 Beneficiary Records
  "The District of Columbia Department of Health Care Finance (DHCF) is notifying nearly 400,000 people that their personal information was potentially compromised in a data breach. According to the agency, the incident impacts Medicaid and the DC Healthcare Alliance beneficiaries who enrolled between 2023 and 2026. The data breach was not the result of hacking. Instead, DHCF discovered in July that two reports on its website contained hidden personal information accessible to unauthorized individuals."
  https://www.securityweek.com/dc-health-agency-exposes-400000-beneficiary-records/
  https://securityaffairs.com/199926/data-breach/nearly-400000-medicaid-beneficiaries-caught-in-medicaid-and-dc-healthcare-alliance-data-exposure.html

General News

• August 2026 Threat Trend Report On Ransomware
  "This report summarizes statistics on new ransomware samples, affected systems, and statistics on targeted businesses collected during the month of August 2026, as well as major Korean & Global ransomware issues. Statistics on targeted businesses were compiled based on the time when publicly available information from ransomware groups’ DLS (Dedicated Leak Sites, i.E., Ransomware PR sites or PR pages) was collected via the ATIP (AhnLab TIP, Threat Intelligence Platform) infrastructure."
  https://asec.ahnlab.com/en/95567/
• Dutch Police Arrest ‘Reformed’ Hacker In Shiny Hunters Investigation
  "Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect’s arrest, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the FBI and extorting the Russian ransomware group Cl0p."
  https://krebsonsecurity.com/2026/09/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation/
  https://databreaches.net/2026/09/28/still-on-probation-from-previous-arrest-for-hacking-and-extortion-dutch-national-is-arrested-again/
  https://www.bleepingcomputer.com/news/security/dutch-police-confirm-arrest-in-shinyhunters-hacking-investigation/
• AI Agents Are Privileged Users; Who Is Auditing Their Access?
  "Enterprises spend heavily protecting the human perimeter. Security teams deploy phishing-resistant multifactor authentication (MFA), enforce rigid conditional access policies, and scrutinize every login from an unexpected IP address. Yet while we closely monitor the human employee, engineering teams are quietly granting broad production access to autonomous AI agents, which often operate as non-human identities (NHIs) backed by service accounts, API tokens, or delegated cloud permissions."
  https://www.darkreading.com/vulnerabilities-threats/ai-agents-are-privileged-users-who-is-auditing-their-access
• If You Do One Security Check This Quarter, Make It Agent Memory
  "In this interview with Help Net Security, Chris Latimer, CEO of Vectorize, talks about the security risks hiding in AI agent memory. He found coding agents storing API keys, credentials, and sensitive documents in plain text on developer machines and in cloud services. Latimer explains how attackers could plant poisoned memories through plugins, skills, and MCP integrations, often aimed at new coders who trust too easily. He covers why access control for agent memory lags behind other areas, what to track after an incident, and the one audit he thinks every CISO should run this quarter."
  https://www.helpnetsecurity.com/2026/09/28/chris-latimer-vectorize-agent-memory-security/
• AI Tests The Limits Of Enterprise Security Governance
  "AI agents are forcing enterprises to rethink security governance, human accountability and oversight as deployments scale. AWS’s Reimagine 2026 argues that organizations need to build governance into their systems and keep humans accountable for outcomes. The findings come from confidential interviews of 45 to 60 minutes with 154 executives at 128 organizations in 23 industries, conducted over nine months. A number of the organizations interviewed still apply review processes designed for six-month IT programs to work that takes days. If a two-week experiment waits a month for approval, some teams stop asking for permission. Policy in that situation is “pushing it underground,” the authors write."
  https://www.helpnetsecurity.com/2026/09/28/ai-agent-security-governance-aws-report/
• Quantum Random Numbers Can Pass The Tests And Still Leak Clues To Attackers
  "The European Telecommunications Standards Institute’s (ETSI) technical report, ETSI TR 104 171, offers guidance on building and evaluating quantum random number generators (QRNGs). It focuses on weaknesses in the devices and their supporting systems that could make the numbers they produce less secure. A QRNG measures a quantum process and turns the raw results into usable random numbers. Cryptographic systems rely on unpredictable numbers to generate keys and perform other security functions. If an attacker can predict those numbers, the protection those systems provide may be weakened."
  https://www.helpnetsecurity.com/2026/09/28/quantum-random-number-generator-qrng-guidance/
• Deepfakes Are Becoming a Costly Reality For Businesses, Report Warns
  "Three quarters of cybersecurity leaders say their organization has faced a suspected deepfake incident during the last year and a quarter of those hit by one say it cost the business over $1m in total, a new report has warned. The 2026 Pindrop Deepfake Readiness Index, published on 28 September, warned there is a significant gap between the threat of deepfake attacks and enterprise readiness to defend against them. Deepfakes are AI generated audio and videos of people. The technology has become increasingly sophisticated, making it difficult for anyone watching or listening to the deepfake to tell that it isn’t footage of a real person."
  https://www.infosecurity-magazine.com/news/deepfakes-costly-reality-for/
• MCP Is Creating Major Governance Gaps, Researchers Warn
  "Model Context Protocol (MCP) servers are creating a silent enterprise governance gap which threatens to undermine cybersecurity efforts as AI deployments proliferate, according to new research from Ox Security. MCP connects AI applications to external tools and data in a standardized manner, so that developers don’t have to write custom code each time they want to connect AI to an API or database."
  https://www.infosecurity-magazine.com/news/mcp-creating-major-governance-gaps/
• AI Accounts Are Becoming The New Target For Infostealers
  "SOCRadar analyzed stealer log data from the last 90 days and found 482 companies with exposed AI accounts and credentials. Of those, 295 appeared in active logs during that period, suggesting the exposure is recent rather than the result of historical cleanup. Together, these companies account for 5,434 stealer log records linked to 1,500 distinct corporate email addresses. The number that really stands out is the ChatGPT figure. A captured ChatGPT or OpenAI session appeared at 358 of the 482 companies, accounting for roughly 90% of all records in the study. Other platforms, including Zapier, Notion, Hugging Face, Replit, Lovable and ElevenLabs, were far behind."
  https://securityaffairs.com/199933/ai/ai-accounts-are-becoming-the-new-target-for-infostealers.html
  https://socradar.io/resources/report/ai-identity-exposure-report-2026.html

อ้างอิง
Electronic Transactions Development Agency (ETDA)

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand

สามารถติดตามข่าวสารได้ที่ webboard หรือ Facebook NCSA Thailand