This brief covers October 15–17, 2026. Items are drawn from vendor advisories and primary reporting, with dates checked against the source pages. The window was quiet: one new, verified development, followed by a few still-active campaigns.

BeyondTrust discloses Remote Support authentication bypass exploited as a zero-day since August (CVE-2026-102764)

BeyondTrust · October 15, 2026

BeyondTrust published advisory BT26-05 for CVE-2026-102764, a critical (CVSS 9.3) authentication bypass in Remote Support (RS) that lets an unprivileged remote attacker perform file operations on an appliance. RS 26.2.3 and earlier are affected, and Privileged Remote Access shares the code and was patched as a precaution. BeyondTrust says first exploitation was August 29 and was contained September 28; patches shipped October 8 (SaaS and self-hosted). Google’s Mandiant/GTIG attributes the activity to Armory Castle (formerly UNC5221), a suspected China-nexus espionage group. Observed post-exploitation included web shells, a tunneler and log wiping. Shadowserver counts more than 1,400 exposed instances. KEV listing was not confirmed in the sources reviewed.

“We are aware of only a small number of impacted organizations at this time.” — Kelli Vanderlee, Google Threat Intelligence Group, via CyberScoop

Source: BeyondTrust advisory BT26-05 · BleepingComputer · CyberScoop

Still developing

Cisco Secure Email Gateway path traversal exploited for root (CVE-2026-76519)

Cisco · October 14, 2026

CVSS 9.8. A crafted attachment can let an attacker write files and run commands as root when File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Cisco says there are no workarounds; fixes are AsyncOS 16.5.0-780 or Content Scanner Tools 25.3.0.5525+. Added to CISA KEV on October 14 (federal deadline October 17).

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco, via SecurityWeek

Source: SecurityWeek · Help Net Security

Palo Alto PAN-OS management interface RCE exploited (CVE-2026-0322)

Palo Alto Networks · October 14, 2026

CVSS 8.6. An authenticated attacker with network access to the management interface can execute code as root on PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are not affected. Fixes are available across supported PAN-OS branches, and there is no full workaround, so restrict management access to trusted internal IPs. Added to KEV October 14.

“Very limited exploitation has been observed targeting the Palo Alto Networks management interface” — Palo Alto Networks advisory, via BleepingComputer

Source: BleepingComputer

Windows Shell Mark-of-the-Web bypass exploited before patch (CVE-2026-96951)

Microsoft · October 13, 2026

CVSS 8.8. A Windows Shell security feature bypass that lets a crafted file evade Mark of the Web protections; exploited as a zero-day and fixed in October Patch Tuesday. Added to KEV October 13 (federal deadline October 16). No public PoC was documented.

Source: SOC Prime analysis · BleepingComputer

This brief covers the trailing ~48 hours (October 15–17, 2026).

Primary sources:

• BeyondTrust security advisories
• CISA KEV alert, October 14
• CISA KEV alert, October 13

This brief covers the trailing ~48 hours ending October 15, 2026. Items are drawn from vendor advisories, CISA alerts and original research, with each CVE traced to its primary source.

Ivanti Connect Secure authentication-bypass zero-day (CVE-2026-104935) exploited in the wild

Ivanti · October 13, 2026

Ivanti disclosed CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure that lets a remote, unauthenticated attacker run arbitrary commands (CVSS 8.6 per Rapid7’s analysis). Volexity tracks the activity as UTA0576, which chained the flaw with other bugs, including a privilege-escalation flaw that remains unpatched, to get root on patched appliances. Fixes are available for the authentication bypass. CISA added it to the KEV catalog on October 13.

“At the time of disclosure, Ivanti is aware of limited exploitation in the wild.” — Ivanti, via BleepingComputer

Source: Ivanti advisory · Canadian Centre for Cyber Security AV26-1035 · BleepingComputer · Rapid7

Cisco Secure Email Gateway path-traversal RCE (CVE-2026-76519) exploited before a fix

Cisco PSIRT · October 14, 2026

A crafted email attachment can write arbitrary files and execute commands as root on Cisco Secure Email Gateway appliances (CVSS 9.8, Critical). Appliances are vulnerable when the File Reputation service is enabled and Content Scanner Tools is older than 25.3.0.5525. No workarounds exist; fixes include AsyncOS 15.5.5-014, AsyncOS 16.5.0-780, or Content Scanner Tools 25.3.0.5525 or later. It is in the CISA KEV catalog (added October 14).

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco Security Advisory

Source: Cisco advisory · Help Net Security

Palo Alto PAN-OS management-interface RCE (CVE-2026-0322) under limited exploitation

Palo Alto Networks · October 14, 2026

CVE-2026-0322 is an authenticated remote code execution flaw in the PAN-OS management interface (CVSS 8.6, High) affecting PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are not affected. Fixed releases exist across the 10.2, 11.1, 11.2, 12.1 and 12.2 branches. There are no workarounds, though restricting management access to trusted internal IPs reduces risk. Help Net Security reports it was added to KEV with the Cisco flaw.

“Very limited exploitation has been observed targeting the Palo Alto Networks management interface.” — Palo Alto Networks advisory

Source: Palo Alto Networks advisory · Help Net Security

Ahsay AhsayCBS authentication bypass and command injection chain added to KEV (CVE-2026-105133, CVE-2026-105134)

CISA · October 14, 2026

CISA added both AhsayCBS flaws to KEV. Attackers chain them, bypassing authentication and then running commands as SYSTEM, and have planted webshells and cryptominers on internet-facing servers. Per Help Net Security, Ahsay acknowledged earlier patches were incomplete; the fixes are the v10.3.4.45 hotfix and v9.15.2.70, followed by a reboot. CVSS scores were not stated in the sources reviewed.

Source: CISA alert · Help Net Security

Microsoft October Patch Tuesday: record volume, one exploited Windows Shell zero-day (CVE-2026-96951)

Microsoft · October 13, 2026

Microsoft’s October release fixed well over 1,400 CVEs, a record, including one actively exploited zero-day: CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web protections (CVSS 8.8 per Lansweeper). Two other flaws were publicly disclosed, including CVE-2026-108398, a .NET Framework WDAC bypass found by Google Project Zero’s James Forshaw. Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 received their final updates.

“If there’s solace to be had, it’s in the fact that only one of these bugs is under active attack.” — Dustin Childs, Zero Day Initiative

Source: CyberScoop · BleepingComputer · Lansweeper

This brief covers the trailing ~48 hours (October 13–15, 2026).

Primary sources:

• Ivanti Security Advisory, CVE-2026-104935
• Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp
• Palo Alto Networks, CVE-2026-0322
• CISA KEV alert, October 14, 2026

This brief covers developments from October 11–13, 2026, drawn from primary advisories and original sources wherever available.

GitLab patches CVSS 10.0 unauthenticated code-execution flaw in CI/CD regex compiler

GitLab · October 12, 2026

GitLab released 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler rated CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It affects self-managed GitLab CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. No in-the-wild exploitation has been reported and the CVE is not reported as a CISA KEV entry; GitLab.com is already patched.

“…could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration…” — GitLab patch release notes

Source: GitLab patch release 19.4.2; BleepingComputer.

Attackers hijack Danfoss refrigeration controllers at French supermarkets

CERT-FR · October 12, 2026

CERT-FR issued alert CERTFR-2026-ALE-012 citing numerous compromises of Danfoss AK-SM and AK-SC devices exposed to the internet. Press reports say the attack began the night of October 11 and forced freezers and fridges into defrost at hundreds of stores. No CVE has been tied to the attack; the entry point is unknown. The AK-SM 800 (end of life since 2021) and AK-SC 355 receive no patches, and Danfoss fixed three earlier AK-SM 800A flaws (CVE-2025-41450/41451/41452) in 2025. CERT-FR advises disconnecting or filtering access and, if compromise is suspected, a factory reset, patching, and rotating all secrets.

“…aware of incidents in France affecting a limited number of refrigeration management systems.” — Danfoss, to Reuters (as reported by The Hacker News)

Source: CERT-FR alert; The Hacker News; BleepingComputer.

Ledger confirms hardware implant in wallets sold via a Southeast Asian reseller

Ledger · October 11, 2026

Ledger confirmed that a device bought through reseller CryptoBilis contained an unauthorized hardware implant, tied to reported crypto thefts. Ledger says a limited number of devices are affected and all confirmed cases came through that reseller. It paused sales via CryptoBilis and advised recent buyers not to set up devices, or to move funds to a new signer with a new seed. Loss estimates (above $86 million, from a pseudonymous analyst) are unverified. No CVE applies.

“…to not initiate set up if you have not done so yet” — Ledger, on X

Source: Ledger statement; The Hacker News; BleepingComputer.

Still developing

SonicWall SMA 1000 CVSS 10.0 SSRF under active exploitation

Previdian / SonicWall · October 9, 2026

CVE-2026-102255 is a pre-authentication SSRF in the SMA1000 Work Place interface (CVSS 10.0). Patched in 12.4.3-03670 and 12.5.0-03082; versions 12.4.3-03526 and 12.5.0-02952 and older are affected. Previdian observed 135 exploitation attempts from two US IPs between October 9 and 10. It is not listed in CISA KEV per Previdian.

“A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface” — SonicWall PSIRT, as quoted by Previdian

Source: Previdian; SonicWall advisory SNWLID-2026-0017; The Hacker News.

Bricksforge WordPress plugin file-upload RCE exploited in the wild

Patchstack · October 8, 2026

CVE-2026-85097 (CVSS 10.0) is an unauthenticated arbitrary file upload in Bricksforge 3.1.8.9 and earlier, fixed in 3.1.8.10. Patchstack first saw exploitation October 7 and recorded 63 unique source IPs, with attackers uploading GIF/PHP polyglots.

“Bricksforge validates a file’s MIME type when it is first uploaded.” — Patchstack

Source: Patchstack; The Hacker News.

This brief covers the trailing ~48 hours (October 11–13, 2026).

Primary sources:

• GitLab patch release 19.4.2
• CERT-FR CERTFR-2026-ALE-012
• Ledger statement
• Previdian CVE-2026-102255
• Patchstack Bricksforge

This brief covers the trailing ~48 hours ending October 12, 2026. It was a quieter window for new advisories, so the items below are drawn from vendor, researcher and company disclosures and checked against primary pages. Active campaigns that began slightly earlier are listed at the end.

Ledger confirms hardware implant in wallets sold by reseller CryptoBilis

Ledger · October 11, 2026

Ledger said an affected device contained an unauthorized hardware implant, and that the incident involves a “limited” number of devices, all sold through the reseller CryptoBilis in Southeast Asia. CryptoBilis has paused sales of its hardware wallet inventory while the investigation continues. Ledger told buyers from this reseller in the last 90 days not to begin setup, and advised anyone who already set up a device to move assets to a new signer with a new seed. Blockchain investigator Specter estimated losses above $86 million (an estimate, not a Ledger figure). No CVE applies; this is a supply-chain tampering case.

“Also, we strongly advise users not to purchase from unauthorized resellers” — Ledger, October 11 update

Source: Ledger update, Oct 11 · Ledger implant disclosure · The Hacker News

Daiichi Kosho: malware at contractor Nippon Columbia exposes about 8.7 million records

Daiichi Kosho / BleepingComputer · October 11, 2026

Japan’s largest karaoke operator, Daiichi Kosho, disclosed that malware on an employee’s computer at its contractor, Nippon Columbia Group, exposed 8,631,000 customer records and 93,000 employee records. Exposed fields include names, genders, dates of birth, email addresses and phone numbers; the company says passwords are not included. NCG reported the infection on October 5 and isolated the system the next day. Data theft has not been confirmed. No CVE or KEV entry applies.

Daiichi Kosho “has not confirmed any data theft or leaks” — as reported by BleepingComputer

Source: BleepingComputer, citing Daiichi Kosho’s website notices

CrowdStrike: attacker used ARTEX AI and Claude agents against South Korean banks

CrowdStrike / BleepingComputer · October 10, 2026

CrowdStrike confirmed that a Chinese-speaking actor used the ARTEX AI penetration-testing suite together with Claude agents in attacks on South Korean financial institutions, including Shinhan Bank, KB Kookmin Bank and Hana Bank. The intrusions exposed client personal and credit card data and caused outages in some cases. CrowdStrike found open directories holding Claude Code session histories and ARTEX configuration files, and saw no clear plan to monetize the stolen data. The ARTEX developer has since closed the source and stopped updates, though derivatives exist. No CVE is involved.

“The threat actor likely accessed DeepSeek via the likely LLM API proxy/reseller xcai[.]pro,” — CrowdStrike, as reported by BleepingComputer

Source: BleepingComputer

Still developing

SonicWall SMA 1000 SSRF (CVE-2026-102255) draws exploitation attempts

SonicWall / Help Net Security · patched October 6–7, 2026; exploitation attempts reported October 8–12

A pre-authentication server-side request forgery in the Appliance Work Place interface affects SMA 1000 models 6210, 7210 and 8200v. It is fixed in hotfixes 12.4.3-03670 and later, and 12.5.0-03082 and later. The Hacker News reports a CVSS of 10.0 and 135 exploitation attempts seen by Previdian; Defused Cyber also reported attempts beginning October 8. It is unknown whether any succeeded, and no KEV listing has been confirmed. SMA 100 Series and SonicWall firewalls are not affected.

Unauthenticated attackers could “direct the appliance to issue requests on their behalf” — SonicWall, via Help Net Security

Source: SonicWall PSIRT SNWLID-2026-0017 · Help Net Security · BleepingComputer · The Hacker News

Bricksforge WordPress plugin file upload (CVE-2026-85097, CVSS 10.0) exploited

Patchstack · October 8, 2026

An unauthenticated arbitrary file upload in Bricksforge versions 3.1.8.9 and earlier allows remote code execution. Patchstack first saw exploitation on October 7 at 21:47 UTC; the fix is version 3.1.8.10. No KEV listing has been confirmed.

“Our telemetry shows active exploitation attempts targeting Bricksforge installations” — Patchstack

Source: Patchstack · The Hacker News

P7 DarkSword: new iOS spyware variant steals crypto-wallet data

iVerify · October 8, 2026

iVerify identified P7 DarkSword during an August investigation of an infected customer device. It leaves a smaller on-device footprint, extracts keychain data, steals crypto-wallet data (including from imToken), and supports two-way command-and-control with a configurable beacon. The iVerify post names no CVEs; module names reference iOS 18.4 through 18.7.

“P7 DarkSword improves on earlier variants in three areas:” — iVerify

Source: iVerify · The Hacker News

This brief covers the trailing ~48 hours (October 10–12, 2026).

Primary sources:

• Ledger (X)
• Daiichi Kosho disclosure via BleepingComputer
• CrowdStrike findings via BleepingComputer
• SonicWall PSIRT
• Patchstack
• iVerify