Zero-days and actively exploited vulnerabilities affecting mainstream platforms: Microsoft, Apple, Google, Cisco, Palo Alto, Fortinet, and the infrastructure everybody actually runs. Sourced from the CISA Known Exploited Vulnerabilities catalog, vendor advisories, and joint government alerts. No noise, no CVE-of-the-day filler. Just what matters and what to do about it.
Active now
k0t campaign harvested 70,000+ firewall and VPN credentials from exposed edge devices
Threat campaign Group-IB and NyxLab investigation, October 23, 2026 · Fortinet FortiGate/FortiWeb and Palo Alto GlobalProtect · CVE-2025-64446, CVE-2026-0257
Group-IB and NyxLab disclosed a large-scale campaign by a threat actor tracked as k0t, also known as CryptoFeel, Member19, and QazWsxShop, that harvested more than 70,000 credentials from internet-facing Fortinet and Palo Alto appliances. The operator enumerated exposed devices in bulk with FOFA and ZoomEye, then broke in through a FortiWeb path traversal flaw (CVE-2025-64446), a GlobalProtect authentication bypass (CVE-2026-0257), or plain brute force, and stayed in with OpenConnect VPN, MeshCentral agents, and AdaptixC2. Many victims later appeared on Qilin and The Gentlemen ransomware leak sites, which points to an initial access broker role, though Group-IB says the ransomware link is still unconfirmed.
Patch FortiWeb and GlobalProtect now, pull management interfaces off the public internet, and rotate every credential stored on or reachable through these appliances. Hunt for rogue admin accounts, unexpected RMM agents (MeshCentral, Atera, Teramind, AnyDesk), and Rclone exfiltration to Wasabi S3 or MEGA. Fresh k0t infrastructure indicators are in the IoC Library. Note that this is a separate dataset from the earlier FortiBleed haul, with negligible overlap, so a clean FortiBleed check does not clear you here.
PwC confirms incident after Everest claims 590 GB of data (claim unverified)
Confirmed incident Everest leak-site claim October 22, 2026; PwC confirmation October 23, 2026 · Third-party learning platform
The Everest extortion group claimed on October 22 that it stole 590 gigabytes from PwC, including regional HR and learning exports, integration documentation, and e-learning courses, with a countdown timer threatening release. PwC confirmed on October 23 that an incident hit a third-party vendor hosting employee learning records, but said the affected site holds no client data, sensitive personal data, or financial information, and that its network and operations are unaffected.
The 590 GB figure itself is unverified: PwC declined to confirm the amount or the veracity of the claim. The lesson is about third-party exposure: a vendor learning platform became the doorway to employee employment-history data. Audit what your vendors hold, what they can reach, and whether their incident becomes your breach notification.
Capcom confirms breach of 11.7 million CAPCOM ID accounts
Confirmed breach Capcom confirmation October 24, 2026 · CAPCOM ID membership service
Capcom confirmed on October 24 that hackers breached its CAPCOM ID membership service, exposing more than 11.7 million customer accounts. That scale makes it one of the largest consumer gaming breaches of the year, and gaming account details are prime phishing fuel because players reuse passwords and trust game-related mail.
If you hold a CAPCOM ID account, change that password now, turn on multi-factor authentication where it is offered, and treat any game-related password reset or account notice with suspicion until Capcom publishes the exposed fields. Organizations should watch for credential-stuffing waves against their own services using this dataset.
BlackX UEFI bootkit used the Baton Drop flaw to bypass Secure Boot in an espionage campaign
Threat campaign BleepingComputer report October 24, 2026 · Espionage campaign, early 2026 · Targets Kaspersky and Avast protections
A UEFI bootkit dubbed BlackX, deployed in an espionage campaign in early 2026, exploited the Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with Kaspersky and Avast security products. Because it runs before the operating system, it can disable endpoint protection and persist across reinstalls.
Check firmware posture: enforce Secure Boot validation, apply UEFI firmware updates, and treat endpoint protection that silently stops reporting as a firmware-level incident until proven otherwise. Bootkits are rare, but they are the persistence mechanism that survives everything else you do.
CISA adds Collabora Nextcloud flaw to KEV: confirmed exploitation, federal deadline October 26 (CVE-2026-110447)
Active exploitation CISA KEV addition October 23, 2026 \u00b7 Collabora Online Built-in CODE Server \u00b7 CVSS 9.2
CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities catalog on October 23, confirming active exploitation of an operating system command injection in the Collabora Online Built-in CODE Server app for Nextcloud. Unauthenticated attackers can reach proxy.php when the built-in CODE server is not running, a state that routine restarts, upgrades, or crashes can create, and run commands as the web server user. Attackers have used it to plant PHP web shells and hunt for credential stores, password manager artifacts, and crypto wallets.
This page covered the flaw on October 15-16; the KEV listing changes the urgency, not the fix. Upgrade richdocumentscode to 26.4.303 or later, or remove the app, since disabling it alone is not enough. Federal agencies face an October 26 deadline under BOD 26-04, and everyone else should treat patching plus a hunt for web shells and persistence as one job, because a patched server is no proof it was never hit.
Qilin lists Commonwealth Community Bank on its leak site (UNVERIFIED)
Unverified claim Leak-site listing October 24, 2026 \u00b7 Qilin \u00b7 US financial services
Qilin published a leak-site listing naming Commonwealth Community Bank on October 24, according to ransomware trackers. Nothing beyond the listing is confirmed: no confirmed breach, no confirmed data theft, no confirmed encryption, and no scope or root cause.
Treat this as a trigger to verify, not a verdict. Watch for an official statement from the bank, and remember that a leak-site post is itself part of the extortion pressure, not proof of compromise.
Arista patches third exploited VeloCloud Orchestrator zero-day this year: read-only logins escalate to superuser (CVE-2026-114625)
Active exploitation Arista Security Advisory 0199, October 22, 2026 · VeloCloud Orchestrator On-Prem · CVSS 9.9
On October 22, Arista disclosed CVE-2026-114625, a critical SQL injection in VeloCloud Orchestrator On-Prem that attackers are already exploiting. An authenticated user with the lowest built-in role, Enterprise Read Only, can escalate to operator privileges and impersonate a local superuser, collapsing the boundary between a tenant who reads dashboards and an operator who controls the whole SD-WAN fabric. This is the third actively exploited VCO zero-day in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September.
Patch on-prem VCO to 5.2.3.18, 6.1.3.10, or 6.4.2.12 now. Hosted and Dedicated deployments are already fixed. If you cannot patch today, restrict the VCO web interface to trusted admin networks, block the two attacker IPs seen so far (74.82.197.86 and 38.54.50.151), and hunt logs for unusual URL paths, encoded payloads, and unexpected outbound connections before remediating. A leaked read-only credential is no longer a low-severity finding.
A Signal bug could keep your mic and camera on after you hang up (CVE-2026-113380)
Critical Details and proof of concept published October 20, 2026 · RingRTC before 2.72.0 · CVSS 9.3
A critical flaw in RingRTC, the open-source library behind Signal's voice and video calls, lets a malicious caller block your hang-up. The researcher showed that a hang-up is treated as just another event in the call's finite-state-machine queue, with no rate limit on peer-originated events and no priority for hang-ups. Flood the queue with junk and your hang-up waits behind attacker noise, so audio and possibly video keep flowing to the other party while your screen says the call ended. CVE-2026-113380 is rated 9.3, and a conceptual proof of concept is public.
Update Signal everywhere: the fix is RingRTC 2.72.0, shipped September 4, but details only went public this week. The attacker has to be a participant on the call, so this is not a remote eavesdropping bug for strangers, but it is a sharp reminder that terminating a call should be a kill switch, not a queue entry. Until you update, glance at the call indicator after hanging up to confirm the call actually ended.
BRONZE SANDCASTLE: China-aligned cluster plants encrypted backdoors via Sandboxie DLL sideloading
Threat campaign Sophos research, October 20, 2026 · Active since mid-2025 · Victims in Asia and Africa
Sophos named a previously undocumented China-aligned cluster, BRONZE SANDCASTLE, active since mid-2025 against organizations in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Its signature move is DLL sideloading through legitimate signed applications: a malicious sbiedll.dll placed next to the real SandboxieWUAU.exe gets loaded when the trusted program runs. The payload stays encrypted on disk in a config.ini file, decrypts in memory at runtime, and collects system data, keystrokes, and screenshots. Operators have used it to enumerate networks and accounts, and to copy the Active Directory ntds.dit database through Volume Shadow copies.
Hunt for the execution sequence, not single files: signed executables loading adjacent DLLs, config.ini reads followed by in-memory execution, and anomalous use of vssadmin.exe or access to ntds.dit. Sophos documented eight sideloading combinations (Sandboxie, Java, Krita, NVDA, LINE, Sysinternals tools), so do not stop at one executable name. Fresh IoCs, including the version 1.1.5 C2 domains, are in the IoC Library.
Cisco patches 34 flaws across Expressway, IOS XR, Snort 3, and Unified Communications
Patch bundle Cisco security advisories, October 21, 2026 · No known exploitation
Cisco released patches for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications products. The worst is CVE-2026-76466, a critical remote code execution flaw in Expressway Series caused by persistent cookies and weak client certificate validation, which lets an attacker run arbitrary commands as root. Unified Communications products got nine CVEs including critical resource-control and authentication issues, and Snort 3 fixes include critical out-of-bounds write and incorrect calculation flaws (CVE-2026-20236, CVE-2026-20043). IOS XR takes a high-severity denial of service (CVE-2026-76505) plus a Secure Client privilege escalation (CVE-2026-76462).
Cisco says it is not aware of any exploitation in the wild, so this is a patch-window story, not an incident. Update Expressway to X15.5.20, Snort 3 to 3.12.4.0, and apply the Unified Communications and IOS XR updates in your next maintenance window. Meraki MX, cloud-delivered firewall, and Secure Access were updated automatically on October 21; firewall appliances on IOS XE need manual upgrades.
PHP2Shell: two unauthenticated RCE flaws in PHP itself, exploited four days before the patch (CVE-2026-109618, CVE-2026-109619)
Active exploitation PHP Foundation patches October 21, 2026 · PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 · Details leaked October 20
Two critical flaws in the PHP interpreter itself, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Fixes landed October 21 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but the details leaked online October 20 before coordinated disclosure, and AWS honeypots caught exploit attempts starting October 17, four days before the patch. One flaw corrupts memory during out-of-memory handling; the other leaves request state in freed memory, and the upload-progress handler can even hand freed worker memory back to clients inside a PHPSESSID cookie, memory that can hold passwords, session tokens, API keys, or TLS private keys.
Patch PHP everywhere today: PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed, and PHP bundled in cPanel and Plesk are all in scope, and end-of-life branches get no official fix. The old assumption that you have days after a patch drops no longer holds: AWS says PHP2Shell is now broadly exploited in the wild, and the exploit-development cycle keeps compressing as AI tooling turns patch diffs into working exploits in hours. Not yet in CISA KEV.
Node.js October security release: RCE in the Brotli decoder, TLS hostname-check bypasses (CVE-2026-111497)
Critical Node.js security releases October 21, 2026 · Versions 26.12.1, 24.22.1, 22.23.4 · Ten vulnerabilities, four high severity
The October 21 Node.js security release fixed ten vulnerabilities across the 26.x, 24.x, and 22.x lines. The worst is CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that can leak memory or run arbitrary code when a process decodes attacker-controlled Brotli data. The same release fixes three more high-severity flaws: two TLS certificate hostname-check bypasses (CVE-2026-105483 and CVE-2026-106069) and a dns.resolve bug that truncates names containing a NUL character (CVE-2026-105482).
Upgrade to 26.12.1, 24.22.1, or 22.23.4 now, and do not forget where Node hides: container base images, CI/CD runners, developer laptops, Electron apps, and bundled products. The release also drops the compromised eMudhra intermediate CAs from Node's trust store, so this update closes two problems at once. Only the runtime patch covers the outbound path (a fetched response with crafted Brotli data); WAF rules cover inbound only.
GitLab's October 21 release patches a maximum-severity flaw reaching back to version 7.0 (CVE-2026-110264)
Critical GitLab patch release October 21, 2026 · Self-managed GitLab · No reported exploitation yet
GitLab's October 21 patch release fixed CVE-2026-110264, a maximum-severity flaw that lets an attacker run code on a self-managed GitLab server without logging in, affecting every version back to 7.0 from 2014. If you patched the October 12 CVSS 10.0 bug (CVE-2026-97229), you are not done: that update only covered versions 19.2 through 19.4, and the fixed releases sit one patch above them at 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13.
Upgrade self-managed instances now. GitLab has not said what preconditions an attacker needs, so no configuration rules you out, and there is no interim workaround. No exploitation has been reported so far, but the October 12 flaw showed how fast internet-facing DevOps infrastructure gets attention. GitLab.com and Dedicated are already patched.
LiteLLM 1.107.0 shipped with a credential stealer on PyPI and Docker: supply-chain compromise, confirmed
Supply-chain compromise Disclosed October 21, 2026 · LiteLLM (BerriAI) · PyPI window 11:39 to 13:23 UTC October 21
LiteLLM 1.107.0 was published on October 21 carrying malware in all seven PyPI wheel files and the official Docker images: a credential stealer and a remote code loader. BerriAI says the release came through three engineers' GitHub accounts, apparently via stolen GitHub CLI OAuth tokens, with one account triggering the release and another approving it. The payload uses Python startup hooks, so it activates even if the application never imports LiteLLM, and on Proxy installs it queried the database table where upstream provider keys are stored and pulled up to 500 of them.
The last safe version is 1.106.2. If you pulled 1.107.0 anywhere, treat that machine or CI runner as compromised and rotate every secret it could see: cloud credentials, developer secrets, AI provider keys, everything. This is the AI-tooling supply chain the industry now depends on, so treat it like a build-system breach, not a bad pip install.
Joint advisory on SafePay ransomware: 600+ victims, edge-device flaws, living-off-the-land tactics
Joint advisory CISA/FBI joint advisory AA26-293A, October 20, 2026 · SafePay ransomware · 600+ victims across North America, South America, Europe, and Australia
The FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies published a joint #StopRansomware advisory for SafePay, one of the most active ransomware operations in 2026, with at least 600 separate victims since August 2024. Initial access comes through stolen or guessed credentials, brute-force password attacks, phishing, and exploitation of edge-device flaws: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. Once inside, the actors live off the land with PsExec, WinRM, RClone, FileZilla, and 7-Zip, halt the Volume Shadow Copy Service, reset backup appliances to factory defaults, then encrypt with a ChaCha20/RSA hybrid scheme. The advisory ships IOCs in STIX format.
Patch every internet-facing edge device now, especially VPNs, firewalls, and backup products, and enforce phishing-resistant MFA on all remote access. Assume account takeover: hunt for newly created admin accounts, LOLBin use in business hours, and backup systems that go offline or get factory-reset right before encryption. The IoC Library carries the published IP and hash indicators.
Qilin and INC ransomware exploit the PAN-OS GlobalProtect auth bypass (CVE-2026-0257)
Active exploitation Unit 42 threat brief, updated October 19, 2026 · CVE-2026-0257 · Spikey Scorpius (Qilin), Tarnished Scorpius (INC), Settra
Palo Alto Networks Unit 42 confirms ransomware operators are still actively exploiting CVE-2026-0257, the authentication bypass in PAN-OS GlobalProtect portal and gateway components that has been in CISA KEV since May 13, 2026. The named actors are Qilin (Spikey Scorpius) and INC (Tarnished Scorpius), with public reporting also tying Settra ransomware to the flaw. Successful sessions generate gateway-connected events that look like legitimate VPN logins and can bypass MFA, giving the attacker a remote-worker-grade foothold. Post-access activity reported includes reconnaissance with RMM tools, RDP and SMB lateral movement, credential harvesting, and ransomware deployment; ReliaQuest warns the flaw has become a reliable ransomware on-ramp about five months after disclosure.
Patch GlobalProtect now and explicitly terminate existing sessions, because the May patch does not kill active ones. Hunt GlobalProtect logs for successful gateway connections from the Unit 42 attacker IPs and for suspicious host IDs like aa:bb:cc:dd:ee:ff, WINDOWS-LAPTOP-001, and DESKTOP-GP01. Any gateway-connected event from those indicators should trigger incident response, not a shrug.
Burger King Japan confirms breach of 11 million customer records
Confirmed breach Confirmed by Burger King Japan, October 20, 2026 · Mobile app customer database · Attackers had access October 2-7
Burger King Japan disclosed that attackers accessed a server holding mobile app customer data between October 2 and October 7, exposing 11 million customer records including names, birth dates, and phone numbers. The company says the breach came through a compromised server tied to its mobile app, not the restaurant ordering network itself. No payment card data is reported exposed so far, but the exposed fields are exactly what fuels account takeover and phishing campaigns.
If you run a consumer mobile app, treat this as a preview of your own blast radius: segment customer data stores away from app servers, keep retention tight, and rotate any credentials and tokens the app backend touched. Consumers should watch for phishing that uses their name, birth date, and phone number together.
n0n ransomware group lists 38 maritime firms across 18 countries (UNVERIFIED)
Unverified claim Leak-site claims, October 19-20, 2026 · n0n ransomware group · Demands $2.4M to $14M in Bitcoin
The emerging ransomware group n0n listed 38 maritime firms across 18 countries on its extortion site, demanding between $2.4 million and $14 million in Bitcoin per target with a payment deadline of October 19. This is the group's biggest published victim batch so far, following a run of claims through mid-October that includes a Swiss solar company and a Tunisian textile manufacturer. The claims are UNVERIFIED: no victims have confirmed incidents, and the leak site discloses no attack vectors or proof of data theft.
Maritime, logistics, and OT-adjacent firms should treat this the way they treat a storm warning: confirm backups are isolated and tested, keep OT networks segmented from business IT, and hunt for the group's known tooling rather than trusting a clean dashboard. Verify any claim through your own telemetry before assuming a victim list is fiction.
Switzerland's state-owned space company Beyond Gravity reports targeted cyberattack
Targeted attack Disclosed by Beyond Gravity, October 20, 2026 · Suspected state-level actor · Chinese involvement suspected internally
Beyond Gravity, Switzerland's state-owned space company, disclosed a targeted cyberattack it described as the work of a highly professional threat actor, with Chinese involvement suspected internally. The company builds satellites and launch-vehicle structures for commercial and government programs, so the target profile fits technology theft rather than ransomware. No details on intrusion vector, duration, or whether the attacker reached engineering data have been disclosed.
Aerospace and space-industry suppliers should read this as a supply-chain warning: segment engineering networks, enforce phishing-resistant MFA on every privileged account, and log the engineering workstations and product repositories as if an espionage actor is already interested. Space programs now carry the same targeting as defense primes.
US healthcare ransomware attacks rose 64% in Q3 2026, over 618,000 records exposed
Ransomware trend Comparitech report, October 20, 2026 · US healthcare sector · 618,149 records exposed in confirmed attacks
A Comparitech report found ransomware attacks against US healthcare organizations rose 64 percent in the third quarter of 2026, with confirmed attacks exposing 618,149 patient and staff records. Healthcare keeps outpacing other sectors because patient care cannot wait out an encryption event, which makes ransom demands harder to refuse. The count covers confirmed attacks only, so the true total with unreported incidents is higher.
Healthcare CISOs should assume they are already in the target set: keep clinical systems segmented from business IT, drill downtime procedures with actual clinicians, and make sure backups can restore EHRs without paying. Boards should see this number quarterly and treat it as their own risk, not an industry statistic.
Canva confirms third-party breach through feedback tool Canny: Salesforce data in criminal hands
Confirmed breach Confirmed by Canva, October 18-19, 2026 · The Seven Deadly Sins ransomware group · Third-party supply-chain compromise
Canva confirmed that some enterprise customer records were exposed after attackers compromised Canny, the third-party tool it used to collect product feedback, which held a standing connection into Canva's Salesforce environment. Business contact details and contract documentation were exposed, and Canva says it revoked Canny's access, notified affected customers, and is cooperating with agencies. The group calling itself The Seven Deadly Sins listed Canva on its leak site October 16 and claims it spent over 72 hours inside Canva's Salesforce before selling the data to a "private buyer"; the claimed volumes, including more than 2 million Salesforce records, are UNVERIFIED. Canva says its own platform, accounts, passwords, and designs were not touched.
Map every third-party app with persistent access to your CRM and kill standing OAuth grants you do not actively use: a feedback widget with a live line into Salesforce is not a low-risk integration. Then watch for invoice and renewal scams built on the real order and billing documents now in criminal hands, because they will look legitimate.
Apple's first actively exploited zero-day of 2026: a two-decade-old dyld flaw chained in targeted attacks (CVE-2026-20700)
Active exploitation Apple advisory September 29, 2026, in CISA KEV · dyld (Dynamic Link Editor) · chained with two December 2025 WebKit zero-days
CVE-2026-20700 is a memory corruption flaw in dyld, the system component that loads dynamic libraries for every process on iOS and macOS, and it has been there for nearly twenty years. Google's Threat Analysis Group reported it after Apple confirmed it was used in "extremely sophisticated attacks against specific targeted individuals," chained with two WebKit zero-days from December 2025 (CVE-2025-14174 and CVE-2025-43529). An attacker who already has memory write capability can use this flaw for arbitrary code execution at the deepest layer of the operating system, below the sandbox.
Update every Apple device now: iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3, or the legacy releases (iOS 18.7.5, macOS Sequoia 15.7.4, Sonoma 14.8.4). If a high-value target also skipped the December 2025 updates, treat the device as potentially compromised and rebuild it from a known-good backup.
Ivanti Connect Secure zero-day chain exploited by UTA0576, even on fully patched appliances (CVE-2026-104935)
Active exploitation Added to CISA KEV October 13, 2026 · Ivanti Connect Secure · Exploited since October 3, 2026
Volexity caught an actor tracked as UTA0576 exploiting Ivanti Connect Secure appliances since October 3, including one running a fully patched 22.8R2.4 build when researchers found the intrusion on October 5. The chain starts with CVE-2026-104935 (CVSS 8.6): an authentication bypass that routes requests to arbitrary CGI files through a manipulated header, then a race condition in the file upload handler for code execution, and finally a privilege escalation to root that was still unpatched at disclosure. The actor deployed no malware and no web shells, ran entirely from memory, reverted configuration changes, selectively deleted logs, and evaded Ivanti's Integrity Checker Tool, then harvested cached domain credentials, queried Active Directory, and hunted LAPS passwords and BitLocker recovery keys. CISA added the CVE to KEV on October 13.
Patch to the fixed October builds now, but patching is not proof of cleanliness: hunt for repeated requests to /dana-na/auth/url_default/welcome.cgi, the X-DSCGI-PATH header in traffic, a /data/.icscap/ capture directory, and LDAP and Kerberos tooling staged in /tmp. If the appliance faced the internet, assume cached credentials are burned and rotate domain credentials, LAPS passwords, and BitLocker recovery keys.
BlockStrap: CVSS 10.0 pre-auth RCE in Adobe Commerce and Magento, exploits expected within days (CVE-2026-103849)
Critical Adobe bulletin APSB26-153, October 13, 2026 · Adobe Commerce / Magento Open Source · Not yet in CISA KEV
Adobe's October 13 emergency bulletin patched CVE-2026-103849, a CVSS 10.0 pre-authentication remote code execution flaw in the email template engine of Adobe Commerce and Magento Open Source. Attacker-controlled content in a child email template gets signed and then re-scanned at the root level, executing a smuggled {{block}} directive as PHP (CWE-1336). E-commerce security firm Sansec, which named it BlockStrap, reproduced four attack paths within 24 hours of the patch and warns that working exploits are days away, publicly questioning Adobe's Priority 2 rating (patch within 30 days). It is not in CISA KEV, and Sansec had seen no in-the-wild exploitation as of October 15, so the patching window is still open but closing fast.
Move to the 2026-oct releases now: Sansec warns a plain Composer update is not enough, and the October fix is separate from September's StyleSmuggler patch (CVE-2026-75650), which must also be in place. While you patch, look for web shells, unknown admin accounts, and skimming code in checkout flows, because the first working exploit will turn into Magecart card theft.
Helix ransomware group claims Quikrete and Bay Alarm on its leak site (UNVERIFIED)
Unverified claim Leak-site claims, October 17-18, 2026 · Helix ransomware group · No victim confirmation
Helix added Quikrete, the US building-materials manufacturer, to its leak site over October 17-18, posting GoFile links and passwords set to unlock within hours; the group also claimed alarm-industry firm Bay Alarm in the same window. The claims are UNVERIFIED: neither company has confirmed an incident, and the posts disclose no attack vector, data volume, or affected systems. Treat these as extortion pressure tactics, not confirmed breaches.
Do not treat leak-site posts as fact, but do treat them as a drill: verify backup integrity, make sure your own leak-site monitoring covers your vendors, and if you buy from or supply to either company, watch for brand-abuse fraud using their names.
Ledger confirms hardware implants in resold wallets that steal recovery phrases over LTE
Supply-chain compromise Confirmed by Ledger, October 10-13, 2026 · Devices sold via reseller CryptoBilis · Genuine Check cannot detect it
Ledger confirmed that hardware wallets sold through Southeast Asian reseller CryptoBilis contained an unauthorized implant hidden beneath the screen assembly. The implant reads the 24-word recovery phrase off the display during setup and transmits it over LTE through an embedded eSIM, while the Secure Element, firmware, and transaction signing stay untouched, which is why Ledger's Genuine Check authenticity verification cannot detect it. Ledger asked resellers across seven Asian markets to halt sales, MediaMarkt paused Ledger sales across Europe after a German customer found an implant, and blockchain investigators estimate $86 million to $93 million stolen, though the total is UNVERIFIED and Ledger says all confirmed losses trace to CryptoBilis devices.
Buy hardware wallets only direct from the manufacturer, never from resellers or secondhand. If you bought from CryptoBilis in the last 90 days, do not initialize an unused device; if you already set one up, move your assets to a new wallet with a freshly generated recovery phrase.
BeyondTrust zero-day in Remote Support exploited by Chinese espionage group (CVE-2026-102764)
Active exploitation Added to CISA KEV October 16, 2026 · BeyondTrust Remote Support · Federal deadline October 19, 2026
BeyondTrust disclosed CVE-2026-102764 on October 15: an improper origin validation flaw in internal messaging components of Remote Support (formerly Bomgar) that lets an unauthenticated remote attacker perform file operations on the appliance, which can lead to host-level control and access to every credential it stores or brokers. Mandiant and Google Threat Intelligence attribute exploitation since late August 2026 to ARMORY CASTLE (formerly UNC5221, tracked by CrowdStrike as WARP PANDA), a suspected PRC-nexus espionage actor. The actor planted the SAWFLY PHP web shell, gained root, attempted to dump the appliance secrets vault, and deployed the BARECLAW SOCKS5-over-WebSocket tunnel, with a dwell of roughly seven weeks before disclosure. Every Remote Support version up to 26.2.3 is affected, and the BT26-05-RS patch is available.
Treat every exposed self-hosted appliance as potentially compromised: patch first, then hunt for SAWFLY artifacts, unexpected root SUID shells, boot scripts granting passwordless sudo, HAProxy config changes routing BARECLAW tunnels, Jump Item roles raised to Administrator, and gaps in appliance logs. Rotate every credential the appliance has ever brokered, because file access was the entry point and credential theft was the goal.
Fortinet path traversal feeds stealthy PEERSTITCH implant on firewalls (CVE-2025-61624)
Active exploitation Added to CISA KEV October 16, 2026 · FortiOS / FortiPAM / FortiProxy / FortiSwitchManager · Federal deadline October 19, 2026
CISA added CVE-2025-61624 to KEV on October 16: a path traversal in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that lets an authenticated attacker with an admin profile and read-write permissions write or delete arbitrary files through specific CLI commands. Palo Alto Networks Unit 42 reports attackers exploited the flaw in the FortiOS auto-script engine to deploy PEERSTITCH, a memory-resident implant that hooks FortiOS processes, evades detection inside FortiOS memory, and bypasses security checks on tagged VPN sessions. Separately, Unit 42 traced a broader campaign to a telecom provider's FortiManager breached through the FortiJump flaw (CVE-2024-47575), exposing configurations, credentials, and private keys for more than 500 FortiGate firewalls. Federal remediation deadline is October 19.
Patch per Fortinet's FG-IR-26-122 advisory, then hunt for what memory-resident malware leaves behind: rogue FortiGate registrations on FortiManager, unexpected auto-script objects with names like ../../..//setup, attacker C2 traffic to the PEERSTITCH IPs in the IoC library, and forensic gaps such as terminated syslog generation or cleared crash logs. Treat any FortiManager holding a shared config archive as compromised material and rotate the exposed credentials.
Trojanized Rank Math SEO PRO plugin backdoored WordPress sites (CVE-2026-111862)
Supply-chain compromise Disclosed October 17, 2026 · Rank Math SEO PRO for WordPress · CVSS 9.8
Attackers compromised a subset of Rank Math SEO PRO 3.0.123 distribution packages served between October 15 at 20:02 UTC and October 16 at 07:12 UTC, embedding malware that executes on plugin activation. The backdoor beacons to a command-and-control domain at rank1cdn[.]com, plants hidden PHP backdoors, creates rogue administrator accounts, drops a fake WordPress core file and PHP-executable .cache files, registers a system cron marker, and harvests WordPress credentials, database passwords, and API keys. The vendor pulled the trojanized packages and released 3.0.124 as the clean replacement. Actively exploited in the wild.
If you installed or updated Rank Math SEO PRO during the 11-hour window, treat the site as fully compromised: update to 3.0.124, then hunt the three malicious wp_options keys, rogue admin accounts, unexpected .cache files, and unauthorized cron jobs, and rotate every credential the web server could reach. Block rank1cdn[.]com at the edge and audit any site that fetched packages during the window even if activation happened later.
Collabora RCE flaw used to backdoor Nextcloud servers (CVE-2026-110447)
Active exploitation Disclosed October 15-16, 2026 · Collabora Online Built-in CODE Server
Threat actors are actively exploiting CVE-2026-110447, a critical command execution flaw in the Collabora Online Built-in CODE Server app, to plant backdoors on Nextcloud servers. The flaw affects the optional built-in CODE app before version 26.4.303 and requires the CODE service to be temporarily unavailable, a window that routine restarts, upgrades, or crashes can open. Collabora says this uses a different attack path than an earlier flaw, so the earlier fix does not protect you.
Upgrade to 26.4.303 or later now, and do forensics instead of assuming you were never exposed: a patched server is no proof it was never compromised. Check for unknown web shells and persistence artifacts planted during any CODE service downtime, and review logs around restarts and upgrades for the exploit window.
Vishing attack exposes 1.4 million patient records at Central Ohio Primary Care
Confirmed breach Acknowledged October 15, 2026 · Central Ohio Primary Care · Attack discovered August 25, 2026
Central Ohio Primary Care, one of the largest primary care organizations in the United States, acknowledged on October 15 that an August cyberattack exposed protected health and personal information of more than 1.4 million current and former patients and employees. The intrusion began with vishing: a threat actor posing as a trusted source talked its way into unauthorized access to files containing protected health information, with no malware needed. COPC says the vishing was not directed at patients. Several class-action law firms investigating the breach say the Chaos ransomware group has taken credit, a claim that remains UNVERIFIED, and describe the group as known for Microsoft Teams vishing attacks.
The uncomfortable lesson: your helpdesk is a privileged attack surface. Treat any inbound voice or Teams request that moves access or credentials as hostile until proven otherwise, and require call-back verification through a known number. Rehearse this exact scenario, because the attackers needed no exploit here, just a convincing voice. Watch for posted samples or a company statement before treating the Chaos attribution as fact.
Microsoft-led takedown dismantles a billion-message phishing network: Storm-3119 and Storm-2990
Takedown Announced October 14-15, 2026 · Microsoft / Health-ISAC / JC3 and partners · Court-ordered seizure
Microsoft, Health-ISAC, Japan's Cybercrime Control Center (JC3), and partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs disrupted the YAM Store marketplace and the three Chinese-language phishing platforms behind it: CoGUI (also known as NX or FA), Haozi (also Phoenix), and Iron Man. Microsoft tracks the marketplace as Storm-3119 and the kit developers as Storm-2990, assessed with high confidence as Chinese-speaking actors, with no claim of state sponsorship. The kits have supported more than one billion messages since January 2026 against 75,000-plus organizations in 150 countries, with over 750 million aimed at Microsoft customers. Backed by a federal court order, Microsoft seized and redirected domains, disabled more than 20,000 accounts, and blocked over 100,000 fraud domains.
The TTP blueprint matters more than the takedown itself: device-code phishing to steal tokens, fake CAPTCHA gates, geofencing, IP filtering, and tenants rebuilt on expired domains to look legitimate. Hunt your Entra ID sign-in logs for device-code flow abuse and audit app consent grants, because Storm-3119 held admin access through app-only authentication with stolen client secrets, a path that survives password resets on user accounts. Expect the operators to rebuild: the 2,300-plus impersonation templates did not disappear with the domains.
DOJ dismantles Famous Chollima's remote IT worker fraud ring
Takedown Reported October 15, 2026 · Famous Chollima · 14 charged, roughly 187 computers seized
The US Department of Justice charged 14 individuals, including US citizens and Chinese nationals, and seized roughly 187 computers in a disruption of the Famous Chollima group's North Korean remote IT worker scheme, targeting more than 40 laptop farms. The operation turned fraudulent remote IT employment into regime revenue while placing insiders with network access inside US organizations.
If you hire remote workers, vet the human the way you would vet a privileged account: verify the identity of every active remote IT worker, audit remote access logs for geographic anomalies and off-hours activity, and geofence VPN and remote desktop access. A paycheck is a persistence mechanism.
Cisco email gateway zero-day: one malicious attachment to root (CVE-2026-76519)
Active exploitation Added to CISA KEV October 14, 2026 · Cisco Secure Email Gateway · Federal deadline October 17, 2026
Cisco disclosed CVE-2026-76519 on October 14: a relative path traversal in the Advanced Malware Protection feature of Secure Email Gateway that mishandles email attachments. An unauthenticated, remote attacker only has to send a crafted attachment through an unpatched appliance to write arbitrary files and run commands as root on the underlying OS. This is the second SEG zero-day Cisco has patched in a month, after CVE-2026-76461 in September, and CISA's new BOD 26-04 schedule gives federal agencies just three days to remediate, with the deadline set at October 17.
Run the contentscannerstatus CLI command on every appliance: if Content Scanner Tools is below 25.3.0.5525 and File Reputation is enabled on your mail policies, you are exposed. Hunt for Cisco's own self-check alerts ("Suspected compromise indicator was found"), and check firewall and network logs for unusual uploads or downloads to external IPs around your SEG boxes, because the attackers can wipe evidence once they have root. If Cisco contacted you about a potential compromise, rotate credentials and crypto material as the advisory directs.
PAN-OS management interface hands root to authenticated attackers (CVE-2026-0322)
Active exploitation Added to CISA KEV October 14, 2026 · Palo Alto Networks PAN-OS · Federal deadline October 17, 2026
Palo Alto Networks disclosed CVE-2026-0322 on October 14: a code injection flaw in the PAN-OS management interface that lets an authenticated attacker with network access execute arbitrary code as root on the firewall. The vendor reports "very limited exploitation" has already been observed, and CISA added it to the KEV catalog with a three-day federal remediation deadline of October 17 under the new BOD 26-04 schedule. Affected products are PA-Series and VM-Series firewalls and Panorama; Cloud NGFW and Prisma Access are not impacted.
Start with the obvious: the management interface should only be reachable from trusted internal IP addresses, per Palo Alto's own deployment guidance. Patch PAN-OS now, and if you carry a Threat Prevention subscription, enable Threat IDs 510046 and 510047 (content 9159-10287 or newer; they need SSL decryption) for interim coverage. Then audit management-plane logs for authenticated sessions you cannot explain, and treat any session from an untrusted IP as suspect.
Ivanti Connect Secure zero-day chain gives root without a login: CVE-2026-104935
Active exploitation Added to CISA KEV October 13, 2026 · Ivanti Connect Secure · Federal deadline October 16, 2026
An unknown actor Volexity tracks as UTA0576 chained three zero-days on Ivanti Connect Secure appliances to reach root code execution without a login: an authentication bypass in welcome.cgi, a file-write race in wu.cgi (both folded into CVE-2026-104935), and a privilege escalation through the dsinvoked broker that is still unpatched. Once in, the actor stole LDAP domain credentials, hunted Active Directory for LAPS administrator passwords and BitLocker recovery keys, and wiped entries from Ivanti debug logs and Linux audit logs.
This one is hard to detect because the actor never dropped a backdoor: it re-ran the full exploit chain for every command and only patched code in memory, which Ivanti's own Integrity Checker Tool cannot see. Patch to 22.8R2.5, 25.1.1.2, 25.1.3.0, or 25.1.3.1 now, then do forensics instead of assuming you are clean: hunt for tooling artifacts in /tmp (ml.py, rq5.py, mk.py, rr.py), a renamed tcpdump in hidden /data/.icscap directories, and requests to welcome.cgi carrying an X-DSCGI-PATH header pointing somewhere unexpected.
October Patch Tuesday: an exploited zero-day steals Windows' download warnings (CVE-2026-96951)
Active exploitation Patched October 13, 2026 · Windows Shell · CVSS 8.8 · CISA KEV, federal deadline October 16, 2026
Microsoft fixed more than 1,400 flaws in this month's Patch Tuesday, and one was already being exploited in the wild: CVE-2026-96951, a Windows Shell command injection that bypasses Mark of the Web, the mechanism that flags files downloaded from the internet. Strip that flag and a malicious download loses its warnings and safety prompts when a user opens it. Microsoft says large language models drove this month's record volume of vulnerability discoveries.
Deploy this one first across Windows 10, 11, and Server, and brief your users: a downloaded file that asks them to take action is the delivery path here. Two other zero-days were publicly disclosed with no confirmed exploitation yet: CVE-2026-108398 (a .NET Framework bypass of Windows Defender Application Control, found by Google Project Zero's James Forshaw) and CVE-2026-92707 (a MessagePack-CSharp denial of service).
N0n claims files encrypted at Florida design firm, sets exposure deadline: UNVERIFIED
Claimed October 11, 2026 · N0n ransomware group · UNVERIFIED claim
Threat actor N0n claims to have encrypted files at Company #22, a Florida architecture and design firm, and says stolen data will be exposed today, October 14 at 12:00 UTC. The claims have not been independently confirmed: no verified samples, no company statement, and no ransom demand has been disclosed.
A claim with a deadline is still just a claim. Watch for posted samples or an official statement before treating this as a confirmed breach, and expect the usual wave of phishing riding the story if it verifies.
Microsoft rushed an Exchange fix before Patch Tuesday: CVE-2026-96940
High priority Fixed out-of-band October 2, 2026 · Exchange Server · CVSS 8.8
Microsoft broke its normal patch rhythm on October 2 with an out-of-band Exchange Server update. CVE-2026-96940 is an elevation-of-privilege flaw (CVSS 8.8) that lets an authenticated attacker read other users' mailboxes inside the same organization. No exploitation has been observed yet, but Microsoft tagged it "Exploitation More Likely," which is the closest Redmond gets to saying weaponization is a matter of time.
Today's October Patch Tuesday is unusually quiet, so there is no excuse to skip this one. If you run on-prem Exchange, apply the October 2 update now. Note that Windows 11 24H2 Home and Pro also receive their final security update today, so plan the move to 26H2 or 25H2.
The Gentlemen adds KFC to its claimed victims: UNVERIFIED
Claimed October 12, 2026 · The Gentlemen ransomware group · UNVERIFIED claim
The Gentlemen, the group behind this week's Deloitte and MoneyGram claims, has now listed KFC on its leak site, according to an October 12 report. As with the others, no data samples have been posted and the company has not confirmed anything. This is a claim, not a confirmed breach.
Treat leak-site listings as early warning. Watch for posted samples or a company statement before drawing conclusions, and expect the usual wave of brand-name phishing if it verifies.
GitLab CVSS 10.0 RCE in CI/CD regex compiler: CVE-2026-97229
Critical Disclosed October 12, 2026 · Self-managed GitLab CE/EE · CVSS 10.0
An integer overflow in GitLab's CI/CD Regular Expression Compiler lets an unauthenticated attacker run arbitrary code on the server via a crafted regular expression in a CI/CD configuration. Discovered by researcher joaxcar through GitLab's HackerOne program. A compromised GitLab server puts source code, pipeline secrets, and builds at risk, which makes this a supply-chain incident waiting to happen.
Upgrade self-managed instances immediately: 19.2.8, 19.3.4, or 19.4.2 depending on your branch. GitLab.com is already patched and Dedicated customers need no action. No confirmed exploitation yet and not in CISA KEV as of this morning, but unauthenticated RCE on internet-facing DevOps infrastructure does not stay unexploited for long.
Citrix NetScaler SAML memory overflow: CVE-2026-107406
Critical Disclosed October 8, 2026 · NetScaler ADC/Gateway · CVSS 9.5
A memory overflow in NetScaler ADC and Gateway that can lead to remote code execution or denial of service. Only appliances configured as a SAML Service Provider or Identity Provider are affected. Citrix says it is not aware of exploitation, and CISA urged patching on October 9.
This is the third NetScaler patch round in under two weeks, after the September 27 zero-days (CVE-2026-88771, CVE-2026-88772) and the October 4 SAML zero-day (CVE-2026-88779). If you patched for the earlier rounds you are still affected: upgrade to 14.1-73.46+, 13.1-64.29+, or the corresponding FIPS builds. Check your config for "add authentication samlAction" (SP) or "add authentication samlIdPProfile" (IdP) to see if you are in scope.
Flax Typhoon: federal deadline passed, FBI seizes campaign infrastructure
Active exploitation KEV added October 8, 2026 · Federal deadline October 11, 2026 (expired)
The five CVEs tied to China-linked Flax Typhoon (CVE-2015-3306 ProFTPD, CVE-2015-5477 BIND, CVE-2016-3081 Apache Struts, CVE-2021-3199 ONLYOFFICE, CVE-2023-22894 Strapi) carried an October 11 federal remediation deadline. That date has passed. Separately, the FBI seized seven domains tied to the campaign's MicroScan scanner and FishHub spear-phishing malware: c0cc.cc, 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net, and 98aiblog.com. Several mimic Microsoft, LinkedIn, and YouTube branding.
Patching alone is not the ask here. CISA calls for forensic triage (log, shell, and credential review) on any exposed instances of all five products, not just a patch. Hunt the seized domains in mail, proxy, and DNS logs.
Ransomware groups exploiting Palo Alto VPN flaw: CVE-2026-0257
Active exploitation Reported October 11-12, 2026 · PAN-OS GlobalProtect / Prisma Access · CVSS 7.8
ReliaQuest reports Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS, five months after Palo Alto's May patch. Attackers establish unauthorized VPN sessions, then deploy Cobalt Strike, BloodHound, and SharpHound for domain-wide movement. The nasty part: they enter through your own VPN and look like legitimate remote workers, which delays detection. ReliaQuest expects attempts to continue for at least three months.
Upgrade affected PAN-OS builds, disable unnecessary authentication overrides, and terminate all active GlobalProtect sessions after patching to cut off access already established.
IDC Frontier ransomware: 495 organizations hit, data likely unrecoverable
Confirmed October 7, 2026 · IDC Frontier (SoftBank-owned cloud provider, Japan)
A ransomware attack on Japanese cloud provider IDC Frontier hit 495 companies and local government services. Four cloud zones in East Japan Region 1 were damaged so badly the company says customer data there is likely unrecoverable. Recovery depends on customers' own backups. Railway operators, a prefectural police force, and logistics firms are among the affected.
This is the concentration-risk scenario: one regional provider becomes a nationwide supply-chain incident. Validate your offline backups now, and know which single providers your critical workloads depend on.
MoneyGram ransomware claim by The Gentlemen: UNVERIFIED
Claimed October 12, 2026 · The Gentlemen ransomware group · UNVERIFIED claim
The Gentlemen, the same group behind the Deloitte claim covered here on October 11, has listed MoneyGram on its leak site, claiming a breach of the payment network and giving about a week to negotiate. No data samples posted, no company confirmation. Treat this as a claim only: watch for samples or a MoneyGram statement before drawing conclusions. If it verifies, fraud and social-engineering waves targeting MoneyGram users will follow fast.
Flax Typhoon campaign: five exploited flaws, three-day federal deadline
Active exploitation Added to CISA KEV October 8, 2026 · Federal deadline October 11, 2026
A joint advisory from the US, UK, Canada, Australia, New Zealand, Japan, and Spain attributes active exploitation to actors tied to Integrity Technology Group, a China-based company. The five CVEs: CVE-2015-3306 (ProFTPD), CVE-2015-5477 (ISC BIND), CVE-2016-3081 (Apache Struts), CVE-2021-3199 (ONLYOFFICE Docs), CVE-2023-22894 (Strapi). Four date from 2015 to 2021. Patches have existed for years.
The lesson for defenders: the attackers do not need zero-days. They need you to leave internet-facing services unpatched. Hunt for internet-exposed instances of all five products, patch or decommission, and check the CISA advisory for the full detection guidance.
Fortinet FortiMail path traversal: CVE-2026-104286
Added to CISA KEV October 1, 2026 · Fortinet FortiMail
Path traversal plus improper NULL byte handling that can allow an unauthenticated attacker in. Mail gateways sit at the edge and hold credentials, so treat this as patch-immediately if you run FortiMail.
Cisco Catalyst SD-WAN Manager: CVE-2026-76504
Added to CISA KEV September 30, 2026 · Cisco Catalyst SD-WAN Manager
Hex encoding flaw allowing an unauthenticated remote attacker to access the system. SD-WAN managers control the WAN fabric, so compromise here is network-wide. Patch and review access logs.
Apple CoreGraphics out-of-bounds write: CVE-2026-86950
Added to CISA KEV September 29, 2026 · iOS, macOS, iPadOS
Out-of-bounds write in CoreGraphics that can lead to arbitrary code execution across Apple platforms. This is the kind of flaw that ends up in exploit chains, so push the Apple updates to managed and unmanaged devices alike.
Microsoft SharePoint code injection: CVE-2026-65660
Added to CISA KEV September 25, 2026 · Microsoft SharePoint
Code injection allowing an authorized attacker to execute code over the network. SharePoint is deeply embedded in M365 environments, so scope your exposure: internet-facing SharePoint servers first, then internal.
How this page works
I monitor the CISA KEV catalog and major vendor advisories twice daily. When something hits a mainstream platform and is being exploited, it lands here with a short take: what it is, why it matters, and what to do. The page updates as the threat landscape does.
← BACK TO KEVINSWANEY.COM