Cybersecurity news this week: 6 stories to know (October 2, 2026)
A WordPress flaw drawing tens of thousands of attackers. Two network products hacked before a fix even existed. Hundreds of thousands of access keys forgotten on GitHub. And, good news, a ransomware gang taken down, its alleged leader just 16 years old. Here’s the cybersecurity news this week, from September 28 to October 2, 2026, sorted by urgency, with what each story means for a small or mid-sized business.
How to read this roundup:ACT NOW patch or mitigate without waitingCHECK THIS check with your team or providerGOOD NEWS a win for defenders
This week’s 6 stories
01ACT NOW
WordPress: a core flaw under mass attack
What happened
On September 22, WordPress fixed a critical flaw (CVE-2026-87902) in versions 4.7.0 through 7.1.1. Without even having an account, an attacker can force a site to load a PHP file from the server. With some themes and server configurations, that can lead to a full site takeover. The U.S. agency CISA added it to its list of exploited vulnerabilities on September 25. According to CrowdSec, the first attempts started the same day the fix shipped, and 30,813 different IP addresses had sent attack requests by September 28.
Who’s affected
Any WordPress site not yet on version 7.1.2, or on the fixed release of its branch (7.0.6, 6.9.9, 6.8.10, and so on).
For your business
WordPress security updates install automatically by default. The danger lies with sites where someone turned them off: a site “pinned” by an agency, or a forgotten staging copy left online. Check the version under Dashboard → Updates, or ask your provider in writing.
02ACT NOW
FortiMail: a zero-day in an email gateway
What happened
On October 1, CISA added a critical Fortinet FortiMail flaw (CVE-2026-104286, rated 9.8 out of 10) to its list, as attackers are already exploiting it, reports The Hacker News. It lets an unauthenticated attacker write files on the appliance. For some versions, a fix isn’t available yet. In the meantime, Fortinet recommends disabling the IBE feature (identity-based email encryption) and blocking access to the management interface from the internet.
Who’s affected
Organizations that filter their email with a FortiMail appliance (versions 7.2 through 8.0.1).
For your business
Not sure what filters your email? Now is the time to ask. And one rule applies to all your equipment: its management interface should never be reachable from the whole internet.
03ACT NOW
Cisco SD-WAN: admin access without a password
What happened
On September 30, Cisco fixed a critical flaw (CVE-2026-76504, 9.8 out of 10) in Catalyst SD-WAN Manager, the console that manages networks linking multiple sites. A crafted request bypasses authentication and grants administrator rights. Cisco confirms active exploitation since September, and there is no workaround: only the update fixes it. According to Help Net Security, this is the fifth time this year a zero-day has hit Cisco’s SD-WAN solution.
Who’s affected
Mainly multi-site organizations and providers that manage networks. The Cisco-managed cloud version is already patched.
For your business
If a provider manages your network, ask for written confirmation that it’s patched. A console that controls the whole network is a prime target: access to it should be restricted and monitored.
04CHECK THIS
Zimbra: one booby-trapped email was enough, no click needed
What happened
On September 30, Microsoft detailed the exploitation of a Zimbra flaw (CVE-2026-73570), an email suite some organizations host themselves. A single crafted email could run commands on the server, with no password and no click from the victim, when an optional monitoring module (SNMP) was turned on. Attackers installed backdoors, stole authentication secrets and tried to exfiltrate mailboxes. A telling detail: the fix (version 10.1.20) had been available since July 20, but the flaw wasn’t made public until August 13, and Microsoft saw scanning in between.
Who’s affected
Organizations that host their own Zimbra server.
For your business
A fix released “without details” can still be urgent: attackers compare versions to figure out what was repaired. Apply security updates quickly on any internet-facing server, even when the advisory is low-key.
05CHECK THIS
GitHub: 543,699 keys and passwords still live, in plain sight
What happened
Truffle Security scanned 224 million public code repositories on GitHub and found more than a million exposed credentials: API keys, database connection strings, cloud service keys. When tested at the end of July 2026, 543,699 still worked. Nearly 200,000 were published after GitHub turned on its protection against this kind of mistake by default. The oldest key still active, an AWS key, dates back to 2009.
Who’s affected
Any business that has a website, app or integration built, even by a freelancer or an agency.
For your business
An exposed key isn’t “fixed” because it was deleted from the code: it stays valid until it’s revoked. Ask your providers how they handle the keys to your accounts (cloud, payments, email sending) and have them replaced at the slightest doubt.
06GOOD NEWS
KillSec taken down: 110 TB of stolen data recovered
What happened
On September 30, an international police operation coordinated by Europol and Eurojust (Operation KillSwitch) seized the leak site of the KillSec ransomware group, five servers and at least 110 terabytes of stolen data. Three suspects were provisionally arrested and eight properties searched in Greece, Romania, Spain and the United Kingdom. According to Eurojust, the suspected main operator is 16 years old. The group is linked to about 1,000 suspected attacks worldwide, nearly 500 of them successful according to Group-IB.
Who’s affected
The group’s victims, and any organization that stores data in the cloud.
For your business
According to Eurojust, KillSec mostly got in through poorly secured access points, particularly those linked to cloud storage. No fancy tools are needed when a shared folder is open to everyone: check who has access to your shares and storage spaces.
What this week’s cybersecurity news teaches us
The gap between a fix and an attack is now measured in hours. For WordPress, the first attack attempts were seen the very day the fix was published. Waiting for “next month’s maintenance” on internet-facing equipment means leaving the door open for weeks.
What’s visible on the internet goes first. Website, email gateway, network console, mail server: every critical flaw this week hit systems reachable from the outside. If you don’t know exactly what your business exposes to the internet, that’s the first inventory to take.
A secret stays valid until it’s revoked. The keys found on GitHub prove it: deleting isn’t revoking. The same goes for former employees’ accounts, vendor access and “temporary” sharing links.
Tonight, we’ll look at another story from this week that also affects websites: AI agents that tried to force their way into a Government of Canada website.
How NeoTech can help
At NeoTech Cloud Solutions, we help Greater Montreal SMBs do exactly this triage: know what’s exposed, apply critical fixes fast and check that nothing slipped in first. Our cybersecurity services cover patch management and hardening your equipment. Our cyber monitoring plans add automated 24/7 monitoring with intervention by our on-call technician.
Book your free cyber check
Do you know what your business exposes to the internet right now? Is your WordPress site up to date? Who manages the access keys to your cloud accounts? In a short meeting, we go over it with you and you leave with a clear list of priorities. No jargon, no commitment.
👉 Book your free cyber check
Prefer to talk to us directly? Call 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- CrowdSec: CVE-2026-87902, 30,000 IPs target WordPress in five days (September 28, 2026)
- CISA: CVE-2026-87902 (WordPress) added to the Known Exploited Vulnerabilities catalog (September 25, 2026)
- The Hacker News: critical FortiMail zero-day exploited in attacks (October 2, 2026)
- Cisco: Catalyst SD-WAN Manager security advisory (CVE-2026-76504)
- Help Net Security: new Cisco SD-WAN zero-day exploited in the wild (October 1, 2026)
- Microsoft Security Blog: tracking CVE-2026-73570 on Zimbra mail servers (September 30, 2026)
- Truffle Security: GitHub repos exposed 543,699 credentials, nobody revoked them
- SecurityWeek: 500,000 active credentials left exposed on GitHub (October 1, 2026)
- Eurojust: teenagers suspected of leading ransomware group arrested
- Group-IB: Operation KillSwitch targeting KillSec
Photo: Sergei Starostin (Pexels).
