Threat Brief — 2026-10-02 — KEV Catalog Grows Again

CISA has formally added the FortiMail zero-day (CVE-2026-104286KEV) to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation and triggering federal remediation deadlines. Google announced a meaningful defensive hardening in Android 17 that restricts accessibility-service access to verified tools only. Separately, researchers surfaced that intimate deepfake extortion sites are operating on mainstream cloud infrastructure rather than hidden darknet hosting.

Top items

• FortiMail CVE-2026-104286KEV added to CISA KEV catalog. CISA formally placed this unauthenticated arbitrary-file-write zero-day in Fortinet FortiMail on its Known Exploited Vulnerabilities list on Thursday, following reports of active exploitation. This is a genuine development in a story first reported 2026-10-01 by BleepingComputer; the KEV catalog addition elevates urgency and imposes a federal remediation timeline. (src: The Hacker News) — (first reported: BleepingComputer)

• Android 17 Advanced Protection locks accessibility services to verified tools. Google announced that when Advanced Protection mode is enabled, only applications classified as verified Accessibility Tools will be permitted to access Android's accessibility services. This directly targets a long-standing abuse vector where malicious apps request accessibility permissions to overlay screens, harvest credentials, and automate clicks. The restriction represents a notable platform-level mitigation. (src: The Hacker News)

• Intimate deepfake extortion sites run on mainstream cloud infrastructure. Researchers traced the digital supply chain of non-consensual intimate deepfake sites and found them operating on Cloudflare, Google, and Proton infrastructure rather than obscure darknet hosting. The reliance on mainstream CDN and email providers means existing abuse-reporting channels are available, but the findings suggest these platforms are not yet effectively disrupting the activity. (src: SecurityLab)

• Windows 11 26H2 silently auto-enables backups on work PCs. The 26H2 feature update — first reported 2026-10-02 as a general release — includes a behavioural change where backups are automatically enabled on corporate devices unless administrators explicitly opt out. This is a developing detail in the ongoing 26H2 story: the silent default reversal could cause unplanned data egress to cloud storage on managed devices. (src: SecurityLab)

• China frames AI cybersecurity as national infrastructure. Chinese policy moves indicate AI-driven cybersecurity is being positioned as critical national infrastructure, with preparation for offensive and defensive AI-on-AI confrontation. This is strategic rather than immediately tactical, but it signals sustained investment in automated attack and defence tooling at state scale. (src: SecurityLab)

Themes

Mainstream platform abuse persists. Both the deepfake-hosting findings and the Microsoft X account compromise illustrate that attackers continue to operate on well-known infrastructure rather than retreating to hidden corners. The defensive challenge is not lack of visibility but lack of timely platform-level disruption.

Silent defaults create risk. The Windows 11 26H2 backup behaviour echoes a broader pattern of vendor updates that change security-relevant settings without explicit administrator consent, shifting the burden from opt-in to opt-out.

===

THREAT-TOPICS===

[{"slug":"fortimail-cve-2026-104286KEV-zero-day-exploitation","headline":"CISA adds FortiMail CVE-2026-104286KEV to KEV catalog","findingIds":[15118],"status":"developing","development":"CISA formally added the FortiMail unauthenticated file-write zero-day to its KEV catalog, confirming active exploitation and triggering federal remediation deadlines"},{"slug":"android-17-advanced-protection-accessibility-lock","headline":"Android 17 restricts accessibility services to verified tools under Advanced Protection","findingIds":[15128],"status":"new"},{"slug":"intimate-deepfake-sites-mainstream-infrastructure","headline":"Deepfake extortion sites operate on Cloudflare, Google, and Proton infrastructure","findingIds":[15122],"status":"new"},{"slug":"windows-11-26h2-2026-update","headline":"Windows 11 26H2 silently auto-enables backups on corporate PCs","findingIds":[15121],"status":"developing","development":"New detail: 26H2 changes backup defaults on work PCs to opt-out, creating potential unplanned data egress on managed devices"},{"slug":"china-ai-cybersecurity-national-infrastructure","headline":"China positions AI cybersecurity as national infrastructure for AI-on-AI conflict","findingIds":[15126],"status":"new"}]