The weird part of 2026 is not that attackers automate. It’s that they automate the parts we used to think required taste, like targeting defenders, CI pipelines, and monitoring gear.

Today's Top 5

1. 2 SolarWinds pre-auth RCEs: SolarWinds patched CVE-2026-28324 and CVE-2026-28325 in Observability Self-Hosted, both described as remotely exploitable without authentication. If you run this on-prem, assume scanners already noticed. Source
2. Hackers got hacked: The Dutch disclosure group DIVD CSIRT says it detected suspicious activity, isolated infra, brought in third-party IR, and is treating it as worst-case until forensics finish. Their read: it looks agentic AI powered. Source
3. Terraform Registry turns hostile: Researchers say attackers used malicious Terraform providers plus Go modules to push malware via the centralized HashiCorp ecosystem. The scary bit is where providers run: inside CI jobs holding cloud keys. Source
4. MacSync hides in iCloud: A new MacSync variant uses public iCloud calendar events to deliver payload updates, with ClickFix-style social engineering showing up again. This is malware living inside your “trusted” SaaS layer. Source
5. Insurance agency: 9-month scope gap: A California AG breach notice shows NSE Insurance Agencies detected access in Nov 2025, but says it only determined the impacted files in Aug 2026. That timeline is the warning, not the logo. Source

Why today matters: Three different “trust anchors” took hits at once: monitoring platforms (SolarWinds), defender orgs (DIVD), and build/deploy plumbing (Terraform providers). Attackers are aiming for places that already have your visibility, your credentials, or your authority. If you run self-hosted observability, allow community IaC providers, or treat CSIRT tooling as “safe by definition,” you are the soft target now.

Ok. Let’s get specific.

Data Breaches

1. NSE Insurance Agencies breach notice (CA AG sample): NSE says it detected unauthorized network access on or about Nov 28, 2025, and later determined that files may have been accessed between Nov 6 to Nov 29, 2025. The notice describes a long investigation window, and offers credit monitoring. Source: California DOJ (PDF)
2. Health Access Network patient notice tied to Aesto (AWS) incident: A PR notice says unauthorized activity occurred within a portion of Aesto’s AWS infrastructure in Dec 2025, and that Health Access Network began notifying affected residents in Sep 2026. This is the “your vendor’s cloud is your breach” pattern, again. Source: PR Newswire
3. AngMar Management Service incident (healthcare services): A PR notice says AngMar discovered suspicious activity in Jul 2026 and later completed review of affected data in Sep 2026, with notifications reported around that time. Even when the initial event is small, the downstream remediation time is not. Source: PR Newswire
4. eTeam extortion claim: 15,000 employee records: Attorneys cite dark-web monitoring that the EndZone group claimed exfiltration of roughly 15,000 employee records. Treat this as an unverified extortion claim until eTeam or regulators confirm. Source: ClassAction.org
5. Westside GI listed on Pear leak site (unverified): Leak-site monitoring reports Pear listed Westside GI and claimed data theft. This is not confirmation of compromise, but it is a decent reason to ask your comms team if they have a draft statement ready. Source: GalaxyWarden

Security Research

1. SolarWinds Observability Self-Hosted patched for unauthenticated RCE: Two vulns, including a critical one, were patched in 2026.2.3. SecurityWeek reports both are remotely exploitable without authentication under the described conditions. Source: SecurityWeek
2. National CERT warning on SolarWinds RCEs: SK-CERT issued a critical warning for the same SolarWinds Observability Self-Hosted issues and recommends immediate upgrades plus post-patch credential/key rotation practices. Source: SK-CERT
3. DIVD CSIRT disclosure: incident response in public: DIVD says it blocked access, isolated infrastructure, and is running forensics with third-party IR, while describing the intrusion as something they have not seen before and possibly agentic AI driven. Source: DIVD CSIRT
4. Terraform Registry supply chain: malicious providers and Go modules: Reporting highlights a campaign using HashiCorp’s centralized Terraform Registry as a malware distribution path, plus two Go modules. If your CI runs terraform init with broad cloud permissions, re-read that sentence. Source: The Hacker News
5. MacSync: new version, new delivery, added backdoor: Kaspersky’s Securelist write-up details an evolving macOS infostealer that added a backdoor module and updated its infection chain. This is not a “Macs are safe” moment. Source: Kaspersky Securelist
6. MacSync payload delivery via public iCloud calendars: BleepingComputer reports the new variant uses public iCloud calendar events to fetch fresh payloads, plus ClickFix lures disguised as common tools. Source: BleepingComputer

Top CVEs

1. CVE-2026-28324: SolarWinds Observability Self-Hosted flaw described as an integrity-check issue that can lead to RCE in certain configurations. Patch to 2026.2.3 and hunt for internet exposure you forgot existed. Source
2. CVE-2026-28325: SolarWinds Observability Self-Hosted deserialization of untrusted data, also leading to RCE under described conditions. Treat it as a “patch then validate config drift” problem. Source
3. CVE-2026-85102: Check Point improper certificate validation vulnerability listed by CISA as exploited in the wild with a 9/25/2026 federal remediation deadline. If you have exposed gateways, assume attacker interest is not theoretical. Source
4. CVE-2026-93616: Check Point path traversal vulnerability listed by CISA as exploited in the wild. If you run Check Point management infrastructure, this is a “patch fast and check logs backward” day. Source
5. CVE-2026-93952: Arista VeloCloud Orchestrator input validation flaw added to CISA KEV as actively exploited. This sits in the exact blast radius you do not want attackers owning: orchestration and control planes. Source

Podcasts & Talks

1. SANS Stormcast (Sep 24, 2026): Macfinger ClickFix, malicious Terraform, MikroTik and F5 details: Useful as a daily executive brief that still gets into the weeds on real exploitation mechanics, especially the Terraform supply chain angle. Listen: SANS ISC
2. Risky Bulletin: Srsly Risky Biz (Sep 24, 2026), AI lawsuits and AI-enabled ops: A good boardroom-level lens on where policy is landing, plus a field note on how operators are using AI workflows at scale. Listen: Risky Business Media
3. SANS Stormcast (Sep 25, 2026): phishing URL tricks, MacSync update, SolarWinds patch: If you need a quick daily pulse, this episode lines up with today’s theme: user lures, macOS stealers, and fresh monitoring-stack patching. Listen: SANS ISC Today

Final Words

Today’s underlying pattern is “control-plane gravity.” Attackers are not chasing endpoints first. They are chasing the systems that already have the keys, the telemetry, or the privilege boundary, like observability servers, CI runners, and CSIRT tooling. The uncomfortable implication most coverage misses is that your best security investments also become your highest-value breach accelerators when they are self-hosted, over-permissioned, or quietly exposed.

This week, do three things:

• Patch SolarWinds Observability Self-Hosted to 2026.2.3 and run a post-patch review for exposure and credential reuse tied to CVE-2026-28324 and CVE-2026-28325.
• Audit your Terraform pipelines for community providers and lock down provider sourcing, then hunt build logs for unexpected provider namespaces consistent with the HashiCorp Registry malware campaign.
• On macOS fleets, add detections for ClickFix-style user lures and block or monitor suspicious iCloud calendar based delivery patterns tied to the latest MacSync behavior.

Your turn: If your SolarWinds Observability server got popped tonight, who can prove it, fast, without logging into the same box the attacker owns? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone running self-hosted observability like it’s “just monitoring”? Forward them this issue before an unauthenticated RCE turns their telemetry into your incident timeline. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!