Wednesday, September 30, 2026 · 3 MIN READ
Exposed Images, Stolen Sessions, and Network Gear Under Attack
IT BRIEFING FOR BUSINESSES
Today's briefing highlights active NetScaler attacks, Microsoft 365 session theft, and internal company images exposed by AI coding agents. For Ohio business owners, the practical priorities are checking affected equipment, tightening account oversight, and reviewing what automated tools publish.
Put Routers and Cellular Gateways on the Review List
CISA flagged flaws in MikroTik RouterOS versions before 7.24 that could let attackers run code remotely or interrupt service. Separate advisories cover possible service disruption in Baicells Nova 430H eNodeB model pBS3101SH through BaiBLQ_3.0.12, and software replacement with administrator-level code execution in Lantronix G520 gateways running 2.6.0.4R6_stable.
For businesses using this equipment, the concerns are disrupted connectivity and loss of control over network devices. Ask your IT provider to match your equipment and software versions against these advisories and confirm the vendor's remediation guidance.
Camera and Dashcam Software Needs Attention, Too
CISA reported command-execution risks in multiple VIVOTEK camera models, potentially allowing complete camera takeover. Anjvision YSSD-RTMP-H5 firmware 3.3.2.4_build_2024-12-26 has several flaws affecting information, accounts, and device control. Viidure's Android dashcam app through version 3.3.1.260403 has issues that could expose, alter, or erase sensitive data and system files.
If your business uses these products, the risks reach beyond lost video: device control and stored information may also be affected. Have whoever manages your cameras and vehicle technology check the exact models and versions against the CISA notices.
Toptech Users: Check Version 7.6.3
A CISA advisory lists multiple vulnerabilities in Toptech TMS7 and TopHAT version 7.6.3. Exploitation could expose critical data or allow attackers to run code, and the advisory includes a severity score of 10.
Businesses running these systems should treat this as a priority review rather than a routine software housekeeping task. Ask your system maintainer to confirm whether version 7.6.3 is installed and obtain the vendor's recommended remediation steps.
SOURCES:CISA Advisories
AI Screenshot Sharing Exposed Internal Business Images
Security company Glow found more than 13,000 internal images from developers at over 300 organizations in public GitHub repositories. AI coding agents had published screenshots for code reviews, exposing material including customer billing records and unreleased features, often through developers' personal accounts.
This is a reminder that a screenshot can disclose business information just as a document can. Ask your development team or software contractor to review public repositories for agent-generated images before allowing further automated screenshot publishing.
SOURCES:The Hacker News
Stolen Sessions and Passwords Open Doors
ANY.RUN researchers described a U.S.-focused CSuite phishing campaign that steals Microsoft 365 sessions and deploys remote-access tools. Separately, an attacker used stolen French tax-agency staff passwords to take data on hundreds of thousands of taxpayers and businesses; the theft went unnoticed for seven weeks.
Both reports show why account access deserves attention beyond the initial login: stolen access can support wider compromise or prolonged data theft. Ask your IT provider to review monitoring for unusual account activity and unexpected remote-access software.
SOURCES:The Hacker News The Hacker News
NetScaler Is Under Attack; OpenSSL Also Has a DTLS Fix
Attackers are exploiting a recently patched Citrix NetScaler ADC and Gateway flaw against organizations in North America and Europe. Researchers also detailed CVE-2026-88772, a critical DTLS memory-overflow vulnerability under active exploitation. In a separate issue, OpenSSL released fixes for a high-severity DTLS flaw that can expose memory contents or crash an application.
These reports matter to businesses relying on affected gateways or software, but they describe separate vulnerabilities—not one shared bug. Have your IT provider prioritize the NetScaler patch check and identify applications that need the OpenSSL fixes.
New Spectre Research Challenges Existing Defenses
Researchers disclosed Branch Target Reuse, a new Spectre-v2 variant that can leak Linux memory despite existing defenses. The research concerns just-in-time engines in browsers, language runtimes, and operating-system kernels across multiple CPU vendors.
The business concern is potential exposure of information held in memory; the supplied report describes research rather than an observed attack campaign. Ask your IT provider to track relevant vendor guidance for the processors and software your business uses.
SOURCES:The Hacker News
ShinyHunters Investigation Brings an Arrest, Not a Stop
Dutch authorities arrested a 23-year-old convicted cybercriminal suspected of helping ShinyHunters carry out data theft and extortion. In the following days, other members escalated their activity, including stealing sensitive FBI data and extorting the ransomware group Cl0p.
The report illustrates that an arrest does not necessarily end a group's operations. Use it as a prompt to confirm who in your business would coordinate the response to a data-theft or extortion demand.
SOURCES:Krebs on Security