24 min read
Cyber Florida
:
Updated on October 20, 2026
Florida's critical infrastructure currently faces attackers who enter through a few repeated openings: internet-facing network and remote access equipment, accounts at vendors and software providers, and unpatched business software. This issue documents active exploitation of Ivanti, Citrix, Fortinet, and Ahsay products; a Chinese government-linked campaign that routed attacks through compromised commercial infrastructure; and Warlock ransomware attacks on on-premises Microsoft SharePoint servers, with victims that included a water utility and a telecommunications provider. Over the next 6 to 18 months, these patterns will likely continue, with two additions. Attackers will likely use artificial intelligence (AI) to scan and break into systems faster, as suspected in the Zammad helpdesk and South Korean bank intrusions, and a single vendor compromise will continue to expose many customers at once, as in the Frontline Education, Fakturownia, and IDC Frontier incidents. Physical operations are also reachable: attacks reached refrigeration controllers in France and construction equipment on the Fehmarn Belt tunnel project, and investigators found evidence that hackers temporarily accessed a tanker’s propulsion system. Florida utilities, ports, school districts, hospitals, and local governments should treat inventory of internet-facing equipment, rapid patching, multi-factor authentication, vendor access review, and tested offline backups with manual fallback procedures as standing priorities.
Confidence Level: MODERATE-HIGH
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks Cybersecurity researchers warned that the China-based Warlock ransomware group, tracked as Longlegs and Storm-2603, continues to exploit vulnerabilities in on-premises Microsoft SharePoint servers for initial access. Recent victims included a water utility, telecommunications provider, regional government body, and university. The group has used ToolShell and may exploit CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, CVE-2026-50522, and CVE-2026-55040, followed by web shell deployment and ransomware. Florida operators running on-premises SharePoint should patch or mitigate exposed servers and investigate for compromise.
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data On October 8, 2026, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and allied partners published Joint Advisory AA26-281A attributing the reported activity to Chinese government-linked cyber threat actors that used infrastructure associated with the commercial firm Integrity Technology Group. The cyber threat actors chained zero-day exploits and legacy perimeter vulnerabilities across internet-exposed edge network devices, routing malicious traffic through compromised commercial infrastructure to conduct persistent cyber espionage and credential theft across global critical infrastructure. The CISA subsequently added five exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Florida critical infrastructure network defenders and state agencies must prioritize inventorying edge routing hardware, apply vendor firmware remediations, and monitor perimeter logs for unauthorized administrative connections.
Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader In early October 2026, an international law enforcement operation disrupted KillSec, a ransomware and extortion group active since around 2024, by taking over its leak site and five core servers and blocking access to at least 110 terabytes of stolen data. Authorities made three provisional arrests and identified several suspected operators. Investigators know of roughly 500 successful attacks. KillSec commonly gained access through software vulnerabilities and weakly protected entry points, especially cloud storage. Florida organizations should patch exposed services, harden cloud access, and enforce multi-factor authentication.
FBI Disrupts Chinese Hacking Tools Used to Breach Critical Infrastructure On October 8, 2026, the Federal Bureau of Investigation (FBI) announced the seizure of seven domains supporting MicroScan and FishHub, tools U.S. authorities linked to Chinese government-backed operations overlapping with Flax Typhoon. MicroScan scanned for vulnerabilities, while FishHub supported spear-phishing, malware delivery, remote access, file searches, and data exfiltration. The joint advisory identifies CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, CVE-2023-22894, CVE-2014-6278, CVE-2019-11510, and CVE-2021-22205, plus indicators of compromise. Florida defenders should review those indicators, patch vulnerable systems, disable unnecessary exposed services, and enforce multifactor authentication.
All Sectors Recommendations:
No sector-specific findings, advisories, or operationally relevant reporting were identified during this reporting period.
Asos confirms breach of customer data after hackers send rogue app notification On October 8, 2026, ASOS confirmed that hackers accessed a third-party platform hosting customer communications data and stole names and contact information. Reporting cited by TechCrunch says the data included home addresses, phone numbers, email addresses, and profile notes such as website search queries. The attackers also used the ASOS app to send an unauthorized customer notification. They reportedly obtained Snowflake login credentials by impersonating a trusted contact, but it remains unclear how they accessed the push-notification system. Florida retailers should enforce multi-factor authentication and least privilege."
Commercial Facilities Sector Recommendations:
No sector-specific findings, advisories, or operationally relevant reporting were identified during this reporting period.
Cyberattack on major Polish invoicing platform exposes customer data On October 1, 2026, The Record reported that Polish online invoicing platform Fakturownia suffered a data breach after an unidentified attacker exploited a vulnerability and accessed company servers. Potentially exposed data includes user and company account information, password hashes, bank account information, authentication and integration tokens, and invoices issued before 2023. Fakturownia blocked the attacker, rotated passwords and application keys, and brought new servers online. Poland’s national KSeF e-invoicing system was not breached. Florida organizations using third-party invoicing platforms should rotate exposed credentials and tokens.
Cyberattack halts construction of Denmark-Germany Fehmarn Belt tunnel On October 13, 2026, an operational cyberattack struck Femern Link Contractors, the international infrastructure consortium constructing the 18-kilometer Fehmarn Belt immersed tunnel connecting Denmark and Germany. The attack disabled worker identification cards and immobilized vessels, cranes, and platforms used to place the tunnel’s 89 concrete elements, bringing construction to a standstill. Florida industrial manufacturing operators, heavy infrastructure developers, and maritime civil engineering contractors must enforce multi-factor authentication across site access systems, segment heavy machinery networks, and maintain manual operational overrides for computer-guided fabrication equipment.
Critical Manufacturing Sector Recommendations:
No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.
No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.
No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.
Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts Southern Company is notifying roughly 400,000 customers that an unauthorized third party accessed limited account information through its online customer portal. About 300,000 affected accounts belong to Georgia Power and roughly 100,000 to Alabama Power; Mississippi Power was also affected, but no separate figure was released. Exposed data could include names, mailing addresses, phone numbers, email addresses, the last four digits of Social Security numbers, and other basic account details. Florida utilities using public customer portals should strengthen authentication and monitor for anomalous access.
CenterPoint Energy data breach affects over 1M Texans, new attorney general report shows CenterPoint Energy disclosed that an unauthorized third party accessed customer information through one of its external-facing systems. A Texas attorney general report says 1,062,060 Texas customers were affected and that exposed data included names, addresses, Social Security number information, and driver's license numbers. CenterPoint said electric and gas delivery remained operational and uninterrupted and that its investigation is ongoing. The Houston Chronicle noted that CenterPoint had not confirmed whether the attorney general report referred to the same incident. Florida utilities should review external-facing systems and authentication controls.
Energy Sector Recommendations:
South Korean Banks Hit by Suspected AI-Assisted Cyberattacks as 68,000 People Face Data Exposure In early October 2026, South Korean financial authorities convened emergency sector briefings following a coordinated wave of suspected artificial intelligence-assisted network intrusions targeting multiple major banking institutions, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. Cyber threat actors deployed automated tooling to scan external loan-support interfaces, compromising records belonging to over 68,000 customers containing names, phone numbers, annual income figures, and calculated borrowing thresholds. Core transactional databases remained unbreached. Florida financial institutions, commercial lending firms, and credit unions face transferable exposure to automated scanning vectors and must enforce strict rate limiting on customer portals, audit external application programming interfaces, and prepare customer service teams for synthetic voice-phishing follow-ups.
$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant Ledger confirmed that signer devices sold through Southeast Asia reseller CryptoBilis contained an unauthorized hardware implant linked to cryptocurrency theft. The implant was manually soldered inside devices, read recovery-phrase data displayed on the screen, and transmitted it over LTE through an embedded eSIM; it did not alter the operating system, transactions, or signatures. An on-chain investigator estimated losses could exceed $86 million, but Ledger had not confirmed the total or number of affected users. Florida digital-asset custodians should verify device provenance and stop using affected devices.
Financial Services Sector Recommendations:
Dangerous flaws in refrigeration equipment were disclosed months before retail attacks Hundreds of French supermarkets were affected by attacks that manipulated internet-exposed refrigeration systems, raising temperatures, causing fires, and spoiling food. Researchers had previously disclosed flaws in Danfoss AK-SM 800A controllers, including CVE-2025-41451 and CVE-2025-41452; Danfoss released updated firmware in 2025. French authorities also reported impacts to Copeland xweb and Dixell xweb controllers, and roughly 300 Intermarché and Netto stores were affected through a refrigeration service provider. Florida operators should remove exposed controllers from the internet and place remote access behind a secure virtual private network.
Food and Agriculture Sector Recommendations:
Mississippi mayor says ransomware incident led city to shut down systems The city of Vicksburg, Mississippi, shut down computer systems after a ransomware attack and said the disruption affected utility payments but not emergency services. City officials said the shutdown was temporary and that recovery efforts involved the Federal Bureau of Investigation, Department of Homeland Security, state officials, and private cybersecurity experts. The city was still investigating whether personal or confidential information had been accessed or acquired and did not disclose technical details, ransom demands, or attacker identity. Florida municipalities should maintain resilient backups, strong administrative authentication, and continuity procedures.
Osaka Metropolitan University cancels classes after suspected ransomware attack Osaka Metropolitan University Cancels Classes Following Suspected Ransomware Attack. Osaka Metropolitan University canceled classes and shut down much of its information technology infrastructure after a suspected ransomware attack. The outage affected its internal network, email, academic administration, educational support, financial accounting, payroll, human resources, library services, websites, and about 500 servers. Information associated with at least 130,000 current and former students, faculty, and others may have been exposed, but the university had not confirmed data theft. Florida higher education institutions should segment critical systems, maintain offline immutable backups, and restrict privileged remote administration.
Personal information for over 1 million people stolen in a cyberattack on Arizona’s court system On On October 6, 2026, the Arizona Supreme Court disclosed that a September 24 cyberattack stole information belonging to 1.3 million people with unpaid court fees, fines, and restitution obligations dating back up to 30 years. The attack apparently began when an employee clicked a malicious email link. Attackers also copied nearly 30,000 protection orders and 150,000 foster care board reports. Court personnel stopped the attack on a backup server within two hours. Officials reported no record alterations, court delays, or evidence of subsequent misuse. Florida judicial administrators should strengthen phishing defenses and restrict backup server access.
Frontline Education Breach Impacts K-12 School District Staff On October 5, 2026, security notifications disclosed a third-party data breach impacting Frontline Education, a major administrative and human resources software provider serving kindergarten through twelfth grade educational institutions nationwide. Cyber threat actors gained unauthorized access to an internal application environment, compromising employee personal records including employee full names, residential street addresses, email addresses, and Social Security numbers across multiple public-school districts. The total volume of compromised records remains under active forensic review. Florida public school districts, county education boards, and municipal education administrators utilizing Frontline Education software platforms must audit third-party application permissions, monitor staff accounts for targeted tax and identity fraud campaigns, and enforce multi-factor authentication across all administrative portals.
Exclusive-Accenture contractor removed from FBI following damaging data breach, sources say On October 5, 2026, the Federal Bureau of Investigation confirmed the removal of an Accenture contractor following an intrusion that compromised sensitive bureau employee and applicant records. The reported intrusion involved an Oracle PeopleSoft human resources deployment managed by a third-party contractor. The draft attributes exploitation and data theft to ShinyHunters, but the specific intrusion mechanism and actor attribution require confirmation against the original reporting. The bureau contained the vulnerable instance and reported that international authorities arrested suspected group operatives in Jordan. Florida state government agencies, law enforcement departments, and municipal offices must enforce strict patch verification audits on third-party contractors, isolate human resources databases, and mandate immediate mitigation of known exploited vulnerabilities.
Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift Security researchers at ESET identified continuing development of MatchBoil, a malicious downloader used by UAC-0099, an espionage group ESET assesses with moderate confidence as linked to Russian interests and potentially associated with Sandworm. The group targets Ukrainian transportation, manufacturing, and energy organizations through spear-phishing emails linking to archives containing malicious VBScript. MatchBoil downloads the MatchWok C# backdoor and employs increasingly sophisticated obfuscation, sandbox checks, and persistence mechanisms, including scheduled tasks. Florida government agencies and critical infrastructure operators should monitor suspicious VBScript execution, scheduled tasks, and unauthorized payload downloads associated with phishing activity.
Grassfield High School students receive threatening emails after 'cybersecurity incident' On October 12, 2026, officials at Grassfield High School in Chesapeake, Virginia, reported a cybersecurity incident that compromised several individual student email accounts and led students to receive threatening and inappropriate emails. One parent reported gun threats, pornographic images, and screenshots of home addresses and bus routes. Officials disabled the compromised accounts, do not believe a credible threat exists, and added law enforcement presence as a precaution. Chesapeake police are investigating; no arrests have occurred. Florida school districts should enforce strict email account controls, deploy inbound email filtering, and maintain tested crisis communication protocols.
Springfield Public Schools begins reimaging thousands of laptops after cyberattack A cyberattack on the weekend of September 5, 2026, hit Springfield Public Schools in Hampden County, Massachusetts, and attackers stole data. On September 15, investigators learned the responsible cybercriminal organization had released the stolen information, which includes names, dates of birth, and addresses of current and former staff and students; investigators are determining whether Social Security numbers are included. The mayor said the city refused the attackers’ financial demands. The district is reimaging thousands of laptops, with no full restoration date. Florida school districts should maintain offline device images, enforce least-privilege directory controls, and deploy endpoint detection and response agents.
Government Services and Facilities Sector Recommendations:
250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms In early October 2026, regulatory disclosures to the United States Department of Health and Human Services confirmed data breaches impacting approximately 250,000 individuals across two healthcare entities. Clover Health Investments in Jersey City, New Jersey, reported that attackers used social engineering to compromise three non-managerial employee accounts in early July 2026, exposing personal and protected health information belonging to 138,677 individuals. AngMar Management Services in Mansfield, Texas, discovered suspicious activity in mid-July and confirmed the theft of personal and protected health information belonging to 126,196 individuals. The Interlock ransomware group claimed responsibility in August and claimed to have stolen more than 700 gigabytes of data. Florida healthcare systems and managed care networks must implement phishing-resistant multi-factor authentication, audit user permissions, and enforce continuous monitoring over cloud messaging environments.
University of Illinois Chicago affected by ransomware attack on medical school On October 5, 2026, the University of Illinois Chicago confirmed that a ransomware attack disrupted computer servers across its College of Medicine in Cook County, Illinois. The Booba ransomware group claimed the attack and alleged that it stole 344 gigabytes (GB) of data. The university confirmed some information was stolen but was still investigating whether personal, research, or academic information was compromised. University technical teams isolated affected servers and restored core college operations, while patient care at UI Health clinical facilities remained uninterrupted. Florida academic medical centers, university health networks, and clinical research facilities must implement robust network segmentation between academic information technology (IT) infrastructure and clinical hospital environments, maintain immutable offline backups, and monitor networks for unauthorized bulk data exfiltration.
Heart Monitor Firm Notifying at Least 370,000 Patients of Hack On October 13, 2026, reporting confirmed that iRhythm Technologies was notifying at least 370,000 patients about a cyberattack discovered in June 2026. Attackers stole sensitive patient information and medical device-related data, then demanded payment to prevent disclosure. Regulatory filings identified nearly 300,000 affected Texans and 70,000 South Carolinians, while the nationwide total remained uncertain. The company stated that the incident did not affect clinical systems, medical devices, patient care, or operations. Florida healthcare organizations using connected cardiac monitoring services should assess third-party data exposure and coordinate breach response with affected vendors.
Healthcare and Public Health Sector Recommendations:
Japan Declares First Cyberspace Emergency as AI Turns Ransomware Into Carpet Bombing On October 9, 2026, Japanese cybersecurity officials convened an emergency session following a surge in cyber incidents, including a ransomware attack on cloud provider IDC Frontier that affected 495 customer organizations. Officials warned that artificial intelligence could enable smaller attacker groups to conduct large-scale saturation attacks. September produced 86 reported cyber incidents, and recent breaches potentially exposed personal information belonging to millions of Japanese citizens. Authorities had not publicly attributed the attacks. Florida cloud operators and critical infrastructure organizations should assess cloud concentration risks, independent backups, tenant isolation, and privileged access controls.
IDC Frontier Ransomware Hits IDCF Cloud, 495 Orgs [2026] On October 7, 2026, a third-party ransomware attack compromised SoftBank subsidiary IDC Frontier, forcing the immediate network isolation and shutdown of systems inside its East Japan Region 1 data center in Shirakawa, Fukushima Prefecture, Japan. IDC Frontier reported that 495 companies and local governments held contracts associated with the affected East Japan Region 1 facility. The ransomware attack disrupted cloud availability, but the company had not established that all 495 organizations experienced service outages or that customer data had been permanently lost. Florida managed service providers, cloud data center operators, and enterprise technology administrators face shared architectural exposure from downstream cloud infrastructure compromises and must enforce cross-region replication, isolate virtualization management subnets, and maintain offline, immutable customer data repositories.
Zammad Zero-Days Exploited in AI-Powered DIVD Hack On September 21, 2026, attackers breached the Dutch Institute for Vulnerability Disclosure using two Zammad helpdesk zero-days, CVE-2026-102489 and CVE-2026-102490, both rated 9.4. The vulnerabilities enabled unauthenticated remote code execution, session hijacking, and local privilege escalation to root. Investigators described the rapid intrusion as apparently AI-assisted. Attackers pivoted to other services and exfiltrated data, but network segmentation limited further access. Zammad versions 6.3.0 through 6.5.4 are exploitable; versions 7.0.0 through 7.1.3 contain the defects but lack necessary exploitation conditions. Florida operators should upgrade to version 7 or take vulnerable systems offline and run the published compromise-detection script.
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes On October 2, 2026, reporting confirmed active exploitation of CVE-2026-104286, a critical FortiMail vulnerability rated 9.8 that allows unauthenticated attackers to write arbitrary files through crafted HTTP or HTTPS requests. Affected versions include FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9. Fixes for several branches were still pending. Fortinet recommended disabling identity-based encryption support and restricting internet access to management interfaces. The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog. Florida administrators should apply available patches or workarounds and investigate published indicators of compromise.
Citrix patches NetScaler SAML zero-day exploited in attacks On October 4, 2026, Citrix issued emergency security updates addressing CVE-2026-88779, a critical zero-day vulnerability in NetScaler Application Delivery Controller and NetScaler Gateway appliances configured as Security Assertion Markup Language identity providers or service providers. Exploitation in the wild allows cyber threat actors to trigger appliance crashes, causing denial of service, with researchers evaluating potential code execution paths. Citrix rated CVE-2026-88779 at 8.7 on the Common Vulnerability Scoring System (CVSS). The Cybersecurity and Infrastructure Security Agency added it to the Known Exploited Vulnerabilities (KEV) catalog and required federal civilian agencies to remediate the flaw by October 7, 2026. Organizations that recently installed earlier NetScaler security updates must update again if their configurations meet the vulnerability conditions.Fixed releases include NetScaler ADC and NetScaler Gateway versions 14.1-73.41 and 13.1-64.28. FIPS deployments require 14.1-73.41 FIPS, while affected 13.1 FIPS and NDcPP deployments require 13.1-37.282. Florida critical infrastructure network defenders, communications providers, and enterprise administrators operating NetScaler edge hardware must apply vendor security updates immediately and monitor perimeter device logs for unexpected service restarts.
CISA Adds Two Known Exploited Vulnerabilities to Catalog On October 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active in-the-wild exploitation against Ivanti Connect Secure virtual private network gateways. The critical authentication bypass vulnerability forms part of a three-flaw exploit chain allowing cyber threat actors to execute arbitrary code, harvest Active Directory credentials, and extract Windows BitLocker recovery keys from compromised endpoints. Ivanti released security updates and mitigation guidance. Florida enterprise network administrators, managed service providers, and critical infrastructure defenders operating Ivanti virtual private network gateways must apply vendor patches immediately, review gateway integrity logs, and rotate directory secrets.
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers On October 2, 2026, GitLab disclosed CVE-2026-90970, a critical security defect rated 9.9 on the Common Vulnerability Scoring System (CVSS) scale impacting self-hosted artificial intelligence (AI) Gateway instances running versions 18.1.6 through 19.4.0. The vulnerability allows an authenticated user with GitLab Duo Agent Platform access to escape the prompt-template sandbox through a specially crafted custom-flow configuration, potentially executing arbitrary commands on the self-hosted AI Gateway. The article does not establish that attackers gain full container privileges or compromise the servers hosting AI models. GitLab addressed the defect in AI Gateway versions 19.2.4, 19.3.2, and 19.4.1. The vulnerability affects self-hosted AI Gateways beginning with version 18.1.6, including releases before 19.2.4, 19.3.2, or 19.4.1 in their respective branches. GitLab-hosted gateways have already been patched and require no customer action. The article reports no confirmed exploitation or available workaround for organizations unable to upgrade. Florida defense suppliers, software development firms, and critical infrastructure IT departments operating self-hosted GitLab environments must upgrade AI Gateway Docker containers and Helm charts immediately and restrict external network access to gateway endpoints.
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes Microsoft released an out-of-band security update for CVE-2026-96940, a high-severity elevation of privilege vulnerability rated 8.8, affecting on-premises Exchange Server Subscription Edition RTM, Exchange Server 2016 CU23, and Exchange Server 2019 CU14 and CU15. An authenticated attacker can exploit weak authorization to read other users' email messages and attachments within the same organization, without obtaining cross-tenant access. Microsoft reported no evidence of active exploitation and already addressed Exchange Online through a service-side fix. Florida operators running affected on-premises versions should install the applicable security updates promptly.
Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor FortiGuard Labs disclosed active exploitation campaigns deploying ClingSTUN, a stealthy Linux backdoor targeting internet-exposed Internet of Things and networking equipment from vendors including D-Link, EnGenius, and Linksys. Threat actors chain approximately two dozen known remote code execution flaws to achieve initial access, establish persistence across device reboots, and communicate with command servers via legitimate Session Traversal Utilities for network address translation (NAT) infrastructure to bypass corporate firewalls. Infected devices function as covert proxy relay nodes. FortiGuard also identified seven hardcoded exploits used for propagation and malware variants supporting multiple processor architectures. Administrators should inspect exposed devices for hidden executables, modified startup scripts, suspicious User Datagram Protocol (UDP) traffic to Session Traversal Utilities for NAT (STUN) servers, and repeated STUN keepalive messages. Legitimate STUN traffic alone does not establish compromise. Unsupported devices should be isolated or replaced because rebooting infected systems does not eliminate ClingSTUN persistence. Florida enterprise network defenders and municipal utility operators must inventory perimeter network gear, apply vendor firmware updates, and restrict public access to management interfaces.
New Dell System Update flaw lets hackers gain root privileges On October 5, 2026, Dell issued an urgent security advisory for CVE-2026-86360, a critical path traversal vulnerability affecting Dell System Update command-line interface deployment tools prior to version 2.3.0.0. The flaw enables cyber threat actors to execute arbitrary code with root privileges on target PowerEdge servers and underlying operating systems. Dell also remediated related privilege escalation vulnerabilities, including CVE-2026-86361 and CVE-2026-86362. Dell also corrected two high-severity remote code execution vulnerabilities, CVE-2026-63697 and CVE-2026-71168. The company reported no confirmed active exploitation of these newly disclosed flaws and recommends upgrading Dell System Update (DSU) to version 2.3.0.0 or later. Florida data center operators, enterprise systems administrators, and critical infrastructure IT managers utilizing Dell PowerEdge server hardware must upgrade Dell System Update installations to version 2.3.0.0 or later immediately and isolate server management networks.
SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities On October 13, 2026, SAP released 22 new and updated security notes addressing multiple vulnerabilities. The most severe, CVE-2026-89111 (CVSS 10.0), affects the SAP Cloud SDK for Python and could expose OAuth2 credentials through server-side request forgery. Other critical vulnerabilities include CVE-2026-89110 (NetWeaver Visual Composer, CVSS 9.9), CVE-2026-89107 (S/4HANA, CVSS 9.9), and CVE-2026-89108 (Manufacturing Integration and Intelligence, CVSS 9.1). These flaws could enable unauthorized operations, code execution, or system compromise under specified conditions. SAP reported no known active exploitation. Florida operators should install the applicable October security updates.
'AgentCorruption' Puts AWS Environments at Risk With Single Prompt On October 8, 2026, Zenity researchers described AgentCorruption, a demonstrated attack against Amazon Bedrock AgentCore involving prompt manipulation, access to instance metadata, and overly permissive default roles. Researchers showed how an agent could disclose temporary credentials and potentially enable access to other agents, session data, and stored secrets within the same AWS account and region. Amazon Web Services (AWS) stated that the research mischaracterized expected behavior as a vulnerability. AWS had previously introduced IMDSv2 authentication for newly deployed agents and restricted default role permissions. Florida operators should review agent permissions, metadata access, and least-privilege configurations.
Kimsuky Operation GitPower Uses GitHub to Deliver Malware and Steal Data Researchers identified Operation GitPower, a North Korea-linked Kimsuky espionage campaign targeting Ukrainian specialists in diplomacy, security, and international policy. Attackers used tailored emails, fraudulent conference invitations, and research requests to distribute malicious archives and disguised Windows shortcuts. Codeberg hosted archives, GitLab supplied scripts and decoys, and GitHub supported payload delivery and data transfers. The infection chain used Windows scripting, PowerShell, and scheduled tasks for persistence and reconnaissance. Most observed attempts were unsuccessful. Florida government agencies, research institutions, and defense organizations should monitor suspicious shortcuts, script execution, scheduled tasks, and unauthorized transfers involving trusted code-hosting platforms.
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto On October 9, 2026, researchers reported active exploitation of two Ahsay Cloud Backup Suite (AhsayCBS) vulnerabilities: CVE-2026-105133, an authentication bypass, and CVE-2026-105134, an operating system command injection flaw. Attackers chained the vulnerabilities to deploy JavaServer Pages (JSP) web shells and XMRig cryptocurrency miners. Although the vendor reportedly fixed both in version 10.3.2, researchers confirmed that version 10.3.4 remained vulnerable. Huntress observed attacks against at least five organizations and published compromise indicators and Sigma detection rules. Florida operators should restrict management interfaces to trusted IP addresses, investigate compromise, and restore affected hosts from clean backups.
Information Technology Sector Recommendations:
No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.
Hackers breached propulsion system of U.S.-bound oil tanker Officials familiar with the matter said Federal Bureau of Investigation (FBI) and Coast Guard investigators found evidence that unidentified hackers temporarily accessed the propulsion system of the supertanker VL Prosperity as it approached Galveston, Texas. Agencies boarded the vessel in late August after it lost communications. Investigators have not determined how the breach occurred, who was responsible, or what the hackers could control. The FBI said it has no reports of operational disruptions, vessel instability, crew danger, or environmental impacts. Florida port authorities and tanker operators should segment bridge and propulsion networks, isolate satellite gateways, and verify manual fallback controls.”
Rationale: The article relies on anonymous officials, reports “temporary access,” and says the extent of hacker control is unclear. The summary overstates this as confirmed control of locomotion, misdates the event as early October, and attributes the no-damage finding to the boarding teams.
South Africa Seeks Help After Cyberattack Targets Air Traffic Control On September 30, 2026, reporting described an investigation into suspected cyber incidents affecting Air Traffic and Navigation Services in southern Africa. Monitoring detected ransomware-associated malware in operational technology supporting aviation weather services at Port Elizabeth Airport, South Africa. Investigators also examined possible data theft at Maputo International Airport in Mozambique and potential effects at East London Airport. The precise intrusion dates, causes, and scope remained uncertain. Internal teams implemented containment and malware removal, while the agency requested external forensic assistance. Florida aviation operators should monitor weather-service operational networks, segment critical systems, and maintain tested incident-response procedures.
Exposed Hacker Server Reveals Toolkit Used in Viva Aerobus-Linked Intrusion ThreatMon researchers reported that on September 25, 2026, an unauthenticated attacker staging server at 151.243.232.123 exposed tools used in a Microsoft SQL Server intrusion linked to a Viva Aerobus-side environment. The attackers appear to have used the xp_cmdshell feature to run Windows commands and Base64-encoded PowerShell, and the 17 recovered tools targeted credentials using Mimikatz and browser and Windows credential theft. ThreatMon published SHA-256 indicators. Available evidence does not confirm lateral movement or exfiltration of passenger or payment data. Florida organizations running SQL Server should disable xp_cmdshell where unnecessary, rotate exposed database credentials, and review service-account privileges.
Transportation Systems Sector Recommendations:
No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.
This bulletin is produced by USF’s Strategic and Cyber Intelligence Program, in collaboration with Cyber Florida, to deliver timely, actionable insights and recommendations to help Critical Infrastructure owners and operators better protect Florida’s Critical Infrastructure.
1 min read
Cyber Florida : October, 5, 2026
Florida Critical Infrastructure Cybersecurity Intelligence This bulletin is produced by USF’s Strategic and Cyber Intelligence Program, in...
1 min read
Cyber Florida : October, 5, 2026
Originally Published Sept 23, 2026
1 min read
Cyber Florida : October, 5, 2026
Originally Published Sept 9, 2026