"Indirect branch prediction is inherent to modern CPUs, and BTR exploits the desynchronization between the branch predictor and the actual state of the code." Those are the blunt findings researchers published about a new Spectre v2 variant called Branch Target Reuse (BTR), which can extract root password hashes from Intel machines running Linux within minutes.
Branch Target Reuse (BTR) and the renewed Spectre risk
Researchers reported that BTR leverages stale information in a processor’s branch predictor after a just-in-time (JIT) engine reuses memory for new code. By tampering with that predictor state, an attacker can cause the CPU to temporarily execute wrong instructions and leak sensitive data. The team evaluated the exploit on two Intel microarchitectures—Raptor Cove and Lion Cove—and said they leaked the root password within three and five minutes on average, respectively. "No current CPU has a mechanism to keep the two in sync," the researchers concluded, arguing that the vulnerability will persist until vendors add such mechanisms.
NetScaler and FortiMail: zero-days in active use
This week brought two high-severity flaws that vendors and defenders must prioritize. Citrix published updates for CVE-2026-88779, a memory overflow in NetScaler ADC and NetScaler Gateway with a CVSS score of 8.7. Citrix warned that exploitation is already part of targeted zero-day attacks and that successful attacks require NetScaler to be configured as a SAML service provider (SP) or SAML identity provider (IdP). Separately, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of active exploitation of a Fortinet FortiMail bug, CVE-2026-104286, scored 9.8, which "may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests," Fortinet said.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildRansomware operations disrupted, arrests tied to data theft
Law enforcement action this week highlighted a mix of operational takedowns and criminal prosecutions. Authorities arrested two individuals associated with the ShinyHunters extortion group: one suspect believed to be Pepijn van der Stap (a 24-year-old Amsterdam man) and Saif al-Din Khader, detained by Jordanian authorities. In a separate multinational operation against KillSec (aka Kill Security Ransomware Group), police in Spain apprehended a 16-year-old suspected to be the group's leader. Europol said Operation KillSwitch seized at least 110 terabytes of data, took control of KillSec's leak site on September 30, 2026, provisionally arrested three suspects, and searched eight properties across Greece, Romania, Spain, and the U.K.
Europol described KillSec as having launched around 1,000 attacks since emerging in 2024—about half reportedly successful—and noted the group exploited software vulnerabilities and poorly secured cloud storage. Group-IB identified 274 publicly claimed victims, mostly in the U.S., India, and Brazil, and said KillSec sold stolen data with prices "ranging from USD 5,000 for a single company's records to USD 500,000 for the data it claimed to have taken from the global insurer."
AI tools and automation widening the attack surface
AI and automation showed two troubling trends: accidental data exposure and automated escalation of attacker capabilities. Glow Labs' "PixelLeak" research found AI coding agents posted over 13,000 sensitive screenshots from 343 companies to public GitHub repositories—instances where agents hosted images in adjacent public repos to let human reviewers see UI changes. The incidents underline that "agents figured out that they could make the image available" without recognizing security risks.
On the offensive side, security firms reported malware operations using AI in novel ways. RatHat, an Android malware family, reportedly used Google Gemini to estimate victims' bank balances from SMS and to assist automation when interacting with unfamiliar phones; its control panel also rebuilt and re-signed samples to evade detection. Anthropic said Zhipu AI's GLM-5.3 model can autonomously build end-to-end cyber exploits and that attackers can bypass the model's safeguards between 64% and 100% of the time, increasing the capabilities available to malicious actors.
What this means for security teams, policymakers, and enterprises
- Security teams and technologists: Prioritize patching the actively exploited zero-days—CVE-2026-88779 (Citrix NetScaler) and CVE-2026-104286 (FortiMail)—and reassess SAML deployments and file-write protections. The long CVE list highlighted this week underlines a broad patching and configuration workload.
- Policymakers and regulators: The KillSec and ShinyHunters arrests, plus Operation KillSwitch's cross-border seizures, reinforce the transnational nature of ransomware and data-broker activity and the need for coordinated investigative channels.
- Affected enterprises and procurement leaders: Review AI agent workflows and tooling that can surface sensitive artifacts publicly—Glow Labs' PixelLeak demonstrates how benign development tasks can exfiltrate screenshots—and consider governance controls for non-human identities and agent behavior.
A narrow, urgent takeaway
This week's incidents share a common theme: substantial impact often starts with small oversights. A memory overflow in a SAML-configured appliance, an unauthenticated file-write path, an agent that uploads a screenshot, or an empty SMTP envelope field can all become the first step in a compromise. Patch what is exposed, re-evaluate default trust assumptions—especially around SAML and automation—and treat AI agents and automated rebuild pipelines as identities that need explicit governance.
