https://kevintswaney.com/vuln-watch Zero-days and actively exploited vulnerabilities affecting mainstream platforms, curated by Kevin Swaney. Only what matters, with what to do about it. en-us Sun, 25 Oct 2026 12:00:00 GMT https://kevintswaney.com/vuln-watch Group-IB and NyxLab disclosed a k0t campaign that harvested 70,000+ credentials from exposed Fortinet and Palo Alto appliances via CVE-2025-64446, CVE-2026-0257, and brute force, persisting with MeshCentral and AdaptixC2. Patch edge devices, pull management off the internet, and rotate stored credentials. By Kevin Swaney. Sun, 25 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Everest claimed 590 GB from PwC on October 22; PwC confirmed on October 23 that a third-party learning platform vendor was hit, saying no client or sensitive personal data was involved. The 590 GB figure itself is unverified. By Kevin Swaney. Sun, 25 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Capcom confirmed on October 24 that hackers breached its CAPCOM ID membership service, exposing more than 11.7 million customer accounts. Change that password, enable MFA, and watch for phishing built on gaming account details. By Kevin Swaney. Sun, 25 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch BlackX, a UEFI bootkit from an early 2026 espionage campaign, exploited the Baton Drop flaw to bypass Secure Boot and load a driver that interferes with Kaspersky and Avast protections. Enforce Secure Boot validation and apply firmware updates. By Kevin Swaney. Sun, 25 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch CISA added CVE-2026-110447 to KEV on October 23, confirming active exploitation of the Collabora Online Built-in CODE Server command injection. Upgrade richdocumentscode to 26.4.303 or later, or remove the app, and hunt for web shells left behind. By Kevin Swaney. Sat, 24 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Qilin published a leak-site listing naming Commonwealth Community Bank on October 24. Nothing beyond the listing is confirmed, so treat it as a trigger to verify, not proof of a breach. By Kevin Swaney. Sat, 24 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Arista disclosed CVE-2026-114625, a critical SQL injection in VeloCloud Orchestrator On-Prem under active exploitation: the lowest-privilege read-only role can escalate to superuser. Patch on-prem VCO to 5.2.3.18, 6.1.3.10, or 6.4.2.12, restrict the web interface to admin networks, and block the two observed attacker IPs. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch CVE-2026-113380 in Signal's RingRTC calling library lets a malicious caller flood the call's event queue so your hang-up never processes, keeping audio and possibly video streaming after you think the call ended. Update Signal; the fix is RingRTC 2.72.0. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Sophos named BRONZE SANDCASTLE, a China-aligned cluster active since mid-2025, using DLL sideloading through legitimate signed apps like Sandboxie to deploy encrypted in-memory backdoors across Asia and Africa. Hunt the loader sequence, not single files: adjacent DLLs, config.ini reads, and vssadmin or ntds.dit access. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Cisco patched 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications, including a critical RCE-as-root in Expressway (CVE-2026-76466). No exploitation reported yet. Update Expressway to X15.5.20 and Snort 3 to 3.12.4.0 in your next maintenance window. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Fixes landed October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but details leaked October 20 and AWS honeypots caught exploit attempts starting October 17. Patch PHP everywhere today: the flaw is in the interpreter, not any one app. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Ten vulnerabilities fixed October 21 across Node 26.x, 24.x, and 22.x. The worst is an out-of-bounds write in the Brotli decoder that can run attacker code. Upgrade to 26.12.1, 24.22.1, or 22.23.4, including containers, runners, and bundled products. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch An unauthenticated RCE affects self-managed GitLab all the way back to 7.0 (2014). If you patched the October 12 bug, you are not done: fixed releases are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch LiteLLM 1.107.0 carried malware in all seven PyPI wheels and the Docker images, delivered through stolen GitHub CLI OAuth tokens. If you pulled it anywhere, treat the host as compromised and rotate every secret it could see. Last safe version: 1.106.2. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch The FBI, CISA, the US Secret Service, and German and UK agencies published joint advisory AA26-293A on SafePay ransomware, active since August 2024 with 600+ victims. It names five exploited edge-device CVEs and ships fresh IOCs. Patch edge devices, enforce MFA on remote access, and hunt for LOLBin activity. By Kevin Swaney. Wed, 21 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Unit 42 confirms Qilin, INC, and Settra ransomware operators are actively exploiting the PAN-OS GlobalProtect authentication bypass, in CISA KEV since May 2026. Attackers establish VPN sessions that look legitimate and can bypass MFA. Patch now and explicitly terminate existing sessions. By Kevin Swaney. Wed, 21 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Burger King Japan disclosed that attackers accessed a mobile-app customer database between October 2 and 7, exposing 11 million records with names, birth dates, and phone numbers. No payment card data reported so far. Segment customer data stores away from app servers and watch for targeted phishing. By Kevin Swaney. Tue, 20 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch The n0n ransomware group listed 38 maritime firms across 18 countries, demanding $2.4M to $14M in Bitcoin per target with an October 19 deadline. The claims are UNVERIFIED; no victims have confirmed incidents. Maritime and OT-adjacent firms should verify backups, segment OT networks, and hunt the group's tooling. By Kevin Swaney. Tue, 20 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Beyond Gravity, Switzerland's state-owned space company, disclosed a targeted cyberattack by what it called a highly professional threat actor, with Chinese involvement suspected internally. Aerospace suppliers should treat this as a supply-chain warning: segment engineering networks and enforce phishing-resistant MFA on privileged accounts. By Kevin Swaney. Tue, 20 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Comparitech reports ransomware attacks against US healthcare organizations rose 64% in Q3 2026, with confirmed attacks exposing 618,149 patient and staff records. Healthcare CISOs should assume they are in the target set: segment clinical systems, drill downtime procedures, and ensure backups can restore EHRs without paying. By Kevin Swaney. Tue, 20 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Canva confirmed enterprise customer records were exposed after attackers hit Canny, a third-party feedback tool with a standing connection into its Salesforce environment. The Seven Deadly Sins group claims it spent 72+ hours inside Canva's Salesforce and sold the data; claimed volumes are unverified. Audit every third-party app with persistent CRM access. By Kevin Swaney. Mon, 19 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Apple patched CVE-2026-20700, a memory corruption flaw in dyld that lived in every Apple OS for nearly twenty years, exploited in extremely sophisticated targeted attacks chained with two December 2025 WebKit zero-days. In CISA KEV. Update to iOS 26.3 / macOS Tahoe 26.3 or the legacy releases now. By Kevin Swaney. Mon, 19 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch UTA0576 has exploited Ivanti Connect Secure appliances since October 3, including a fully patched 22.8R2.4 build, chaining CVE-2026-104935 with an RCE and an unpatched privilege escalation. The actor runs entirely in memory with no malware, evading Ivanti's Integrity Checker Tool. Patch now and hunt the published artifacts; assume cached AD credentials are burned. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Adobe's October 13 emergency bulletin patched CVE-2026-103849, a CVSS 10.0 pre-auth RCE in the Magento email template engine. Sansec reproduced four attack paths in 24 hours and warns working exploits are days away. Not yet in CISA KEV. Update to the 2026-oct releases and keep September's StyleSmuggler fix in place. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Helix added Quikrete and Bay Alarm to its leak site October 17-18 with timed-release download links. Neither company has confirmed an incident; no attack vector or data volume disclosed. Treat as extortion pressure, not a confirmed breach. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Ledger confirmed unauthorized implants in wallets sold via reseller CryptoBilis that read the 24-word recovery phrase off the screen and transmit it over LTE, undetectable by Genuine Check. Buy direct from the manufacturer; if you bought from CryptoBilis, move funds to a fresh wallet. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch BeyondTrust disclosed CVE-2026-102764 on October 15: an unauthenticated file-operations flaw in Remote Support exploited since late August by ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus espionage actor. Added to CISA KEV October 16 with a federal deadline of October 19. Patch BT26-05-RS and treat every exposed appliance as potentially compromised. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch CISA added CVE-2025-61624 to KEV on October 16: a path traversal in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that Unit 42 says attackers used to deploy PEERSTITCH, a memory-resident implant evading FortiOS detection. Federal deadline October 19. Patch per FG-IR-26-122 and hunt rogue FortiManager registrations. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Trojanized Rank Math SEO PRO 3.0.123 packages served October 15-16, 2026 carried a backdoor with C2 at rank1cdn[.]com, planting hidden PHP backdoors, rogue admins, and credential harvesters. Update to 3.0.124 and treat any install from the 11-hour window as fully compromised. CVSS 9.8. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Attackers are actively exploiting CVE-2026-110447, a critical command execution flaw in the Collabora Online Built-in CODE Server app, to backdoor Nextcloud servers. Upgrade to 26.4.303 or later and do forensics: a patched server is no proof it was never compromised. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Central Ohio Primary Care acknowledged an August vishing attack that exposed protected health and personal information of more than 1.4 million patients and employees. No malware was needed; the attacker posed as a trusted source to reach PHI files. The Chaos ransomware group's claimed credit is UNVERIFIED. Require call-back verification for any voice request that moves access or credentials. Fri, 16 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Microsoft, Health-ISAC, JC3, and partners disrupted the YAM Store marketplace and its CoGUI, Haozi, and Iron Man phishing kits under a federal court order. The kits supported 1B+ messages since January 2026 against 75,000+ organizations. Hunt Entra ID sign-in logs for device-code flow abuse and audit app consent grants; the operators persist through app-only auth with stolen client secrets. Fri, 16 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch The DOJ charged 14 individuals and seized roughly 187 computers, targeting 40+ laptop farms in the Famous Chollima group's North Korean remote IT worker scheme. Vet every remote worker like a privileged account: verify identity, audit remote access logs for geographic anomalies, and geofence VPN and remote desktop. Fri, 16 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Cisco disclosed CVE-2026-76519, a path traversal in Secure Email Gateway's Advanced Malware Protection that lets an unauthenticated attacker run commands as root via a crafted email attachment. Second SEG zero-day in a month. Federal remediation deadline October 17. Check Content Scanner Tools version via the contentscannerstatus CLI and hunt for Cisco's compromise-indicator alerts. Thu, 15 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Palo Alto Networks disclosed CVE-2026-0322, a code injection in the PAN-OS management interface that gives an authenticated attacker with network access root on the firewall. Very limited exploitation observed. Federal deadline October 17. Restrict management access to trusted internal IPs, patch now, enable Threat IDs 510046 and 510047 for interim coverage. Thu, 15 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch UTA0576 chained three zero-days on Ivanti Connect Secure for unauthenticated root: an auth bypass and file-write race (CVE-2026-104935) plus an unpatched privesc. The actor stole domain credentials, hunted LAPS and BitLocker keys, and wiped logs. In-memory-only payloads evade Ivanti's Integrity Checker. Patch to 22.8R2.5, 25.1.1.2, 25.1.3.0, or 25.1.3.1, then forensically hunt. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Of 1,400+ October Patch Tuesday fixes, CVE-2026-96951 was already exploited in the wild: a Windows Shell command injection that bypasses Mark of the Web, stripping warnings from downloaded files. Deploy across Windows 10, 11, and Server first. Two other disclosed zero-days show no confirmed exploitation yet. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch N0n claims encrypted files at Florida architecture firm Company #22 with stolen data to be exposed October 14 at 12:00 UTC. No verified samples, no company statement, no ransom demand disclosed. A claim with a deadline is still just a claim. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Microsoft shipped an out-of-band Exchange Server update on October 2 for CVE-2026-96940, an elevation-of-privilege flaw (CVSS 8.8) that lets an authenticated attacker read other users' mailboxes in the same organization. No exploitation observed yet, but Microsoft tags it "Exploitation More Likely." If you run on-prem Exchange, apply the update now. Tue, 13 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch The Gentlemen ransomware group has listed KFC on its leak site, alongside this week's Deloitte and MoneyGram claims. No data samples posted, no company confirmation. Treat as a claim, not a confirmed breach. Tue, 13 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch An integer overflow in GitLab's CI/CD Regular Expression Compiler lets an unauthenticated attacker run arbitrary code on self-managed CE/EE servers via a crafted regex in a CI/CD configuration. Upgrade to 19.2.8, 19.3.4, or 19.4.2 immediately. GitLab.com already patched. No confirmed exploitation yet. Mon, 12 Oct 2026 22:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Memory overflow in NetScaler ADC/Gateway (CVSS 9.5) allowing RCE or DoS on appliances configured as SAML SP or IdP. Third NetScaler patch round in under two weeks. Upgrade to 14.1-73.46+, 13.1-64.29+, or corresponding FIPS builds. Citrix reports no known exploitation; CISA urged patching October 9. Mon, 12 Oct 2026 22:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch The five CVEs tied to China-linked Flax Typhoon carried an October 11 federal remediation deadline. That date has passed. The FBI seized seven domains tied to the campaign's MicroScan scanner and FishHub spear-phishing malware. CISA calls for forensic triage on exposed instances, not just patching. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect/Prisma Access, five months after Palo Alto's May patch. Upgrade affected builds, disable unnecessary authentication overrides, and terminate all active GlobalProtect sessions after patching. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch A ransomware attack on Japanese cloud provider IDC Frontier hit 495 companies and local government services. Four cloud zones were damaged so badly customer data is likely unrecoverable. Validate offline backups and know which single providers your critical workloads depend on. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch The Gentlemen listed MoneyGram on its leak site claiming a breach of the payment network. No data samples posted, no company confirmation. Treat as a claim only until samples or a statement appear. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Seven-nation joint advisory attributes active exploitation to actors tied to Integrity Technology Group. Five CVEs: CVE-2015-3306 (ProFTPD), CVE-2015-5477 (ISC BIND), CVE-2016-3081 (Apache Struts), CVE-2021-3199 (ONLYOFFICE Docs), CVE-2023-22894 (Strapi). Hunt internet-exposed instances, patch or decommission. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Path traversal plus improper NULL byte handling that can allow an unauthenticated attacker in. Added to CISA KEV October 1, 2026. Patch immediately if you run FortiMail. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Hex encoding flaw allowing an unauthenticated remote attacker to access the system. Added to CISA KEV September 30, 2026. Patch and review access logs. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Out-of-bounds write in CoreGraphics that can lead to arbitrary code execution across Apple platforms. Added to CISA KEV September 29, 2026. Push Apple updates to managed and unmanaged devices. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/vuln-watch Code injection allowing an authorized attacker to execute code over the network. Added to CISA KEV September 25, 2026. Scope exposure: internet-facing SharePoint servers first. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney)