Weekly Security Watch
Trusted access layers dominated the week: identity tokens, mailboxes, VPNs, access-policy platforms, and OT integrators. It is also demonstrated that AI is now helping criminals choose targets and fraud paths after compromise, while the vulnerability set shows continued pressure on infrastructure that mediates trust.
Important developments
AI-Enabled EvilTokens industrializes identity compromise
Microsoft disrupted EvilTokens, an AI-enabled phishing-as-a-service platform linked to more than 12,000 compromised inboxes across over 10,000 organizations. The service abused device-code authentication, stole tokens, analysed mailboxes and helped attackers prepare targeted fraud. Microsoft seized 50 websites and disabled more than 150 supporting domains; UK police arrested two men on suspicion of related offences.
This is a practical example of AI improving targeting and post-compromise decision-making, not merely writing better phishing messages.
Impact: Operational: Account takeover can lead to email exfiltration, malicious inbox rules, payment fraud and lateral movement through Microsoft Graph permissions. Regulatory: Personal-data exposure and material service impact require prompt assessment under GDPR, NIS2 and, for financial entities, DORA. Financial services, construction, distribution, real estate, higher education and healthcare were among affected sectors reported by Microsoft.
Recommended actions: Disable device-code authentication where unnecessary; apply conditional access controls; revoke sessions and tokens after suspected compromise; hunt for malicious inbox rules, unfamiliar device registrations and unusual graph activity.
Sources:
ENISA Threat Landscape 2026 reframes EU board priorities
ENISA published its 2026 Threat Landscape, based on incidents observed during 2025. It reports that DDoS and unauthorized access represented large shares of recorded activity, while phishing remained a common enabling technique. ENISA also highlights vulnerability exploitation, supply-chain dependencies, cloud environments and third-party providers as persistent sources of impact.
The report provides an EU-specific evidence base for security investment and resilience decisions.
Sources:
https://www.enisa.europa.eu/publications/enisa-threat-landscape-2026
https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202026_Final.pdf
‘AI is scaling up cyber threats,’ says NCSC
The NCSC stated on September 24 that AI is accelerating and expanding cyberattacks against government and society, making attacks larger and more complex and increasing the need for action. Organizations must treat AI-enabled abuse as a current operational issue rather than a future scenario.
Impact: Security teams should expect faster social engineering, content generation and campaign scaling, increasing pressure on detection and response. Organizations covered by the Dutch Cybersecurity Act must ensure risk management and governance remain proportionate to changing threats. Dutch government, essential and important entities, and organizations with high-value identities or public services are the main potential targets.
Recommended actions: Update threat models for AI-assisted fraud and impersonation; strengthen payment verification; rehearse executive-impersonation scenarios; measure token theft and identity response times.
Source:
https://www.ncsc.nl/nieuws/ai-versnelt-en-vergroot-de-dreiging-nu-handelen-noodzakelijk
Third-party ICS access receives new CISA and FBI guidance
CISA and the FBI published considerations for critical-infrastructure operators working with third-party industrial-control-system integrators. The guidance warns that integrators may hold extensive access to operational processes and recommends least privilege and secure frameworks for third-party access.
Integrator access can create a concentration path into operational technology and physical processes.
Impact: Compromise can expose industrial environments to disruptive or destructive effects affecting equipment and critical functions. Entities that fall under NIS2 should connect third-party OT access controls to supply-chain risk management and incident preparedness. Energy, water, manufacturing, transport and other operators using external control-system engineering or support are potential targets.
Recommended actions: Identify all integrator connections; remove standing privileges; centrally control remote access; test isolation from provider networks; require onsite backups and joint degraded-communications exercises.
Sources:
https://www.cisa.gov/topics/industrial-control-systems/integrators-engineering-firms
Critical vulnerabilities
F5 BIG-IP APM flaw actively exploited
The NCSC warned that a 9.8-rated vulnerability in F5 BIG-IP Access Policy Manager is under active exploitation. ENISA EUVD describes unauthenticated remote code execution where APM is configured as an OAuth Authorization Server.
An internet-facing access platform can become an entry point into trusted environments.
Impact: Remote code execution may enable appliance compromise, credential exposure and follow-on access. Affected Dutch NIS2 and DORA entities should document exposure, remediation and incident-assessment decisions.
Recommended actions: Identify affected configurations, apply vendor remediation immediately, restrict management exposure and perform compromise assessment rather than relying on patching alone.
Sources:
https://www.ncsc.nl/alerts/kwetsbaarheid-in-f5-networks-big-ip-apm-met-actief-misbruik
Check Point VPN and management products added to KEV
CISA added CVE-2026-85102 and CVE-2026-93616 on September 22. The first can permit unauthenticated remote code execution on affected Security Gateway and Spark Firewall VPN deployments; the second allows unauthenticated script upload and execution on management and logging products.
Impact: Compromise can undermine perimeter controls, expose logs and provide a foothold for lateral movement.
Recommended actions: Apply vendor mitigations; conduct the forensic triage requested by CISA guidance; inspect for unexpected scripts, accounts and configuration changes; rotate exposed secrets.
Sources:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
WordPress vulnerability exploited in the wild
The NCSC reported active exploitation of CVE-2026-87902 on September 24. The flaw may allow an unauthenticated attacker to perform harmful actions on a server hosting a WordPress website.
WordPress is widely used for public websites and often connects to customer, marketing and content workflows.
Impact: Compromise can affect website integrity, availability and potentially connected data or credentials.
Recommended actions: Install available updates now; review web and server logs; inspect administrator accounts, plugins and scheduled tasks; isolate compromised sites before restoration.
Sources:
https://www.ncsc.nl/alerts/kwetsbaarheid-in-wordpress-wordt-actief-misbruikt-update-nu
Linux kernel exploitation requires fleet-level prioritization
CISA added CVE-2025-39964, a Linux kernel race condition, and CVE-2026-53266, a Linux kernel out-of-bounds write, to KEV on 18 September based on evidence of active exploitation.
Kernel vulnerabilities can affect broad server, appliance and cloud workloads, but remediation depends on the exact distribution and kernel build.
Impact: Successful exploitation can undermine host isolation and system integrity. Risk owners should document asset scope and remediation priority for critical services. Cloud, hosting, technology, telecoms and organizations operating large Linux estates are potentially affected.
Recommended actions: Map affected kernel versions through software inventory; prioritize exposed and high-value systems; apply distribution fixes; reboot where required; monitor for abnormal privilege escalation.
Sources:
Takeaways
Common patterns
Trusted access layers dominated the week: identity tokens, mailboxes, VPNs, access-policy platforms, and OT integrators. The recurring root causes are excessive standing privilege, externally reachable control planes, weak session revocation, incomplete dependency visibility and patching without forensic validation. EvilTokens demonstrates that AI is now helping criminals choose targets and fraud paths after compromise, while the vulnerability set shows continued pressure on infrastructure that mediates trust.
Sector insights
Financial services should focus on token theft, payment fraud and DORA incident classification. Critical infrastructure and manufacturing should prioritize third-party OT access and isolation testing. Dutch public-sector and NIS2 entities should connect the NCSC AI warning with identity controls, executive-impersonation exercises and supplier oversight.
Strategic recommendations
CISOs should establish an emergency path for exploited identity and access infrastructure, combining patching with compromise assessment. Security leaders should disable unused authentication flows, revoke tokens during response and monitor control-plane changes. Risk leaders should map concentration across Microsoft 365, VPN, F5 and OT integrators. Privacy officers should predefine evidence needed to determine whether mailbox, web or gateway compromise exposed personal data. Boards should request assurance that privileged third parties can be disconnected without stopping critical operations.
Board-level narrative
Concentration of business risk in systems that grant and manage trust can be an issue. Attackers are using AI to exploit relationships inside compromised mailboxes while continuing to target gateways, management platforms and third-party access. Operational resilience therefore depends on the organization’s ability to revoke trust quickly, isolate suppliers and recover under degraded conditions. Governance should require accountable ownership for identity flows, internet-facing control planes and OT remote access. Regulatory exposure rises when known exploitation is met only with routine patching rather than documented triage, containment and reporting decisions.
This overview was generated with AI assistance and has been verified and edited by a human editor. If you have spotted a factual error, please let us know in the comments.
The information contained in this security watch is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. CISO Community and CISO Platform Nederland assume no legal liability or responsibility for any damage resulting from either the use or inability to use the information included. This includes damage resulting from the inaccuracy or incompleteness of the information contained in the briefing.
