# IT Daily Roundup – October 4, 2026

> Oct 4, 2026 · #security #microsoft #ransomware #ai

Warlock ransomware exploits SharePoint ToolShell vulnerabilities, GitLab patches a critical AI Gateway RCE, and Google tests broad Gemini access to Mac files and applications.

## 1. Warlock Ransomware: SharePoint ToolShell Flaws as an Entry Point into Critical Infrastructure

The Warlock threat group, linked to the Chinese nexus of threat actors, escalated attacks against organizations in Portuguese- and Spanish-speaking countries spanning Europe, Africa, and Latin America. Attackers exploited a chain of four SharePoint vulnerabilities known as ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) — deploying web shells, collecting ASP.NET machine keys, and achieving remote code execution on SharePoint servers. In the next phase, they used a BYOVD (bring your own vulnerable driver) technique with the K7RKScan.sys driver (CVE-2025-1055) to disable antivirus and EDR solutions, established remote access via VS Code tunnels, and ultimately deployed ransomware to 33 or more hosts within a single network using Group Policy and logon scripts. Victims included a water utility, a telecommunications operator, a regional government body, and a university.

> **Why this matters:** Microsoft SharePoint is part of M365, which the majority of SME businesses today use as a portal, intranet, or document storage. While Warlock primarily targeted critical infrastructure, the attack technique is fully transferable to any organization with an incompletely patched SharePoint Server. Recommended action: verify with your IT partner that patches for the ToolShell vulnerabilities (CVE-2025-49704 and related) are installed; if you run SharePoint on-premise, check for web shell presence and suspicious logins. SharePoint Online within M365 is updated automatically — the risk there is lower. The use of VS Code tunnels as a C2 communication channel is a sophisticated technique that bypasses standard firewall rules — another argument for deploying EDR with behavioral anomaly detection.

## 2. GitLab: Critical AI Gateway RCE (CVE-2026-90970) — Patching Mandatory for Self-Hosted Instances

GitLab patched a critical vulnerability CVE-2026-90970 in AI Gateway — the component that mediates communication between GitLab and AI models within the Duo Agent Platform feature. The flaw lies in insufficient input neutralization: an authenticated user with Duo Agent Platform access can escape the prompt template sandbox via a specially crafted flow configuration and execute arbitrary commands directly on the server. Affected versions are AI Gateway 19.2.3 and earlier, 19.3.1 and earlier, and 19.4.0; fixed versions are 19.2.4, 19.3.2, and 19.4.1. GitLab notified affected customers ahead of the public disclosure. GitLab.com (the cloud version) is protected automatically; the risk applies exclusively to self-hosted installations.

> **Why this matters:** Companies that self-host GitLab — most often for source code control, compliance requirements, or integration with internal infrastructure — must update AI Gateway immediately. While the vulnerability requires existing authentication and Duo Agent Platform access (reducing risk compared to a fully unauthenticated attack), in an environment where GitLab holds access to production secrets, SSH keys, and the entire source codebase, any ability to execute commands on the server is extremely serious. If you are not actively using AI Gateway, consider temporarily disabling it until the patch is applied. This is also a good opportunity for GitLab instance administrators to review the overall status of other components and dependencies.

## 3. Google Gemini Set to Gain Full Access to Mac Files, Apps, and the Web

Researchers discovered a hidden "Additional sandbox options" feature in the test version of Google Gemini for macOS that would allow the AI agent to read, create, modify, or delete files anywhere on a Mac's disk — not just in explicitly permitted folders. Beyond files, Gemini would gain the ability to directly interact with apps like Mail, Safari, and Messages and perform actions within them. Google states that for sensitive operations (purchases, money transfers, account creation, accepting legal terms, modifying personal information) the feature would request permission; for other actions, no permission would be required. The feature is not yet publicly available and Google has not confirmed a release timeline or which Gemini model will support this capability.

> **Why this matters:** For businesses where employees use or plan to use AI tools on Macs, this is a signal to establish a corporate AI policy before the software establishes it for you. Unrestricted file access without repeated consent means an AI agent could read contracts, financial documents, contact databases, or login configurations — and under certain conditions transfer them elsewhere. Recommended approach: define which AI tools are permitted in your organization and under what conditions; prioritize enterprise plans with explicit data-training opt-out; and when any AI tool requests "extended system access," respond with denial until your IT partner has assessed the security implications. For Gemini specifically, monitor when and how this feature becomes available.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-10-04-it-daily-roundup.html