This brief covers October 17–19, 2026. It is a quieter window, and items are drawn from vendor and researcher primary sources, with outlet reporting linked alongside.

ConnectWise disables application identities after Microsoft 365 tenants compromised

ConnectWise · October 17, 2026

Unknown actors obtained unauthorized access to ConnectWise application identities and used them to sign in to customer Microsoft 365 tenants. ConnectWise says it first identified the issue on October 14, disabled seven application identities at 07:00 UTC on October 17, suspended Cloud Backup by revoking certificates, and took SaaS Security and Cloud Management offline. Huntress observed sign-in activity from the associated IP address against almost 1,000 Entra tenants, about 300 of them successful. Disabling the connections blocks new authentication but does not undo changes already made inside a tenant. No CVE has been assigned, and ConnectWise says it is not yet clear whether a product vulnerability contributed.

“Since implementing these mitigations, we have not observed successful threat activity in the environments we monitor.”
— ConnectWise advisory update, as quoted by The Hacker News

Source: The Hacker News · BleepingComputer · ConnectWise status page

OpenCode Console breach may have exposed customers’ OpenAI, Anthropic and Google API keys

OpenCode · October 17, 2026

An intruder reached a legacy system in OpenCode’s hosted Console, where workspaces store their own third-party provider keys. OpenCode emailed affected users on October 17; it says keys “may have been exposed” for about 1.4% of Console users and has not confirmed any were copied. Keys stored locally by the CLI and desktop apps are reportedly not affected. Some users report unauthorized provider charges, but those are individual claims. No CVE applies. Anyone with a provider key saved in the Console should rotate it. Vendor wording is as relayed by The Hacker News; the original X posts were not independently retrieved.

“Action Required: Potential provider key breach.”
— OpenCode notification email subject, as reported by The Hacker News

Source: The Hacker News · OpenCode on X

Still developing

SiteGuard Server Edition WAF command injection exploited in the wild (CVE-2026-106931)

JPCERT/CC (JVN) · October 14, 2026 · widely reported October 18

OS command injection (CWE-78) in SiteGuard Server Edition 2.20 and later, when the statistics function is enabled (the default). JVN scores it CVSS v4.0 8.5 and v3.0 7.8 and states exploitation in the wild has been confirmed; successful abuse runs commands as root or SYSTEM. Fixed in 8.00 Update 5 (Apache, Nginx, IIS) and 7.00 Update 6 (FreeBSD), with a file-replacement patch for versions that cannot be upgraded. The vendor advises downloading diagnostic information before patching, since remediation can erase attack traces. No KEV entry was confirmed in the sources reviewed.

“Abuse has already been confirmed.”
— SiteGuard vendor alert, as quoted by BleepingComputer

Source: JVN · SiteGuard alert · BleepingComputer

Drupal core and Entity List RCE flaws patched; exploits expected soon (CVE-2026-108097, CVE-2026-108099)

Drupal Security Team · October 14, 2026 · reported October 17

SA-CORE-2026-014 (CVE-2026-108097) is rated “Critical 19/25” by Drupal and affects core 8.9.0 through releases before 10.6.19, 11.3.19 and 11.4.10, plus Drupal 12 pre-releases before beta2. Drupal says core alone is not directly exploitable but serious exploit paths exist through contributed modules, one requiring no authentication. A companion Entity List module flaw, CVE-2026-108099, is fixed in 3.0.10. Drupal publishes no CVSS score for the core flaw, and no in-the-wild exploitation has been confirmed. Uninstalling the Field UI module is the stopgap if you cannot upgrade.

“At least one known exploit path does not require authentication.”
— Drupal SA-CORE-2026-014

Source: Drupal SA-CORE-2026-014 · SA-CONTRIB-2026-218 · BleepingComputer

Unpatched Broadcom WPS flaw allows root code execution from Wi-Fi range

Quentin Kaiser · October 16, 2026 · reported October 19

A long-standing bug in Broadcom’s proprietary WPS implementation lets an unauthenticated attacker in radio range leak memory and execute code without the network key. Affected chips include BCM3380, BCM3383 and BCM33834 (eCos) and BCM3390, BCM65xx and BCM68xx (Linux). Broadcom would not assign a CVE, none of the devices the researcher tested were patched, and no real-world exploitation has been reported. Replacement of unpatched hardware is the practical mitigation.

“Yet they refused to assign a CVE to this vulnerability or to communicate publicly about it”
— Quentin Kaiser

Source: Quentin Kaiser · The Hacker News

This brief covers the trailing ~48 hours (October 17–19, 2026).

Primary sources:

• JVN (JPCERT/CC) JVN88474777
• SiteGuard vendor alert
• Drupal SA-CORE-2026-014
• Drupal SA-CONTRIB-2026-218
• ConnectWise status page
• Quentin Kaiser research post

This brief covers October 15–17, 2026. Items are drawn from vendor advisories and primary reporting, with dates checked against the source pages. The window was quiet: one new, verified development, followed by a few still-active campaigns.

BeyondTrust discloses Remote Support authentication bypass exploited as a zero-day since August (CVE-2026-102764)

BeyondTrust · October 15, 2026

BeyondTrust published advisory BT26-05 for CVE-2026-102764, a critical (CVSS 9.3) authentication bypass in Remote Support (RS) that lets an unprivileged remote attacker perform file operations on an appliance. RS 26.2.3 and earlier are affected, and Privileged Remote Access shares the code and was patched as a precaution. BeyondTrust says first exploitation was August 29 and was contained September 28; patches shipped October 8 (SaaS and self-hosted). Google’s Mandiant/GTIG attributes the activity to Armory Castle (formerly UNC5221), a suspected China-nexus espionage group. Observed post-exploitation included web shells, a tunneler and log wiping. Shadowserver counts more than 1,400 exposed instances. KEV listing was not confirmed in the sources reviewed.

“We are aware of only a small number of impacted organizations at this time.” — Kelli Vanderlee, Google Threat Intelligence Group, via CyberScoop

Source: BeyondTrust advisory BT26-05 · BleepingComputer · CyberScoop

Still developing

Cisco Secure Email Gateway path traversal exploited for root (CVE-2026-76519)

Cisco · October 14, 2026

CVSS 9.8. A crafted attachment can let an attacker write files and run commands as root when File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Cisco says there are no workarounds; fixes are AsyncOS 16.5.0-780 or Content Scanner Tools 25.3.0.5525+. Added to CISA KEV on October 14 (federal deadline October 17).

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco, via SecurityWeek

Source: SecurityWeek · Help Net Security

Palo Alto PAN-OS management interface RCE exploited (CVE-2026-0322)

Palo Alto Networks · October 14, 2026

CVSS 8.6. An authenticated attacker with network access to the management interface can execute code as root on PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are not affected. Fixes are available across supported PAN-OS branches, and there is no full workaround, so restrict management access to trusted internal IPs. Added to KEV October 14.

“Very limited exploitation has been observed targeting the Palo Alto Networks management interface” — Palo Alto Networks advisory, via BleepingComputer

Source: BleepingComputer

Windows Shell Mark-of-the-Web bypass exploited before patch (CVE-2026-96951)

Microsoft · October 13, 2026

CVSS 8.8. A Windows Shell security feature bypass that lets a crafted file evade Mark of the Web protections; exploited as a zero-day and fixed in October Patch Tuesday. Added to KEV October 13 (federal deadline October 16). No public PoC was documented.

Source: SOC Prime analysis · BleepingComputer

This brief covers the trailing ~48 hours (October 15–17, 2026).

Primary sources:

• BeyondTrust security advisories
• CISA KEV alert, October 14
• CISA KEV alert, October 13

This brief covers the trailing ~48 hours ending October 15, 2026. Items are drawn from vendor advisories, CISA alerts and original research, with each CVE traced to its primary source.

Ivanti Connect Secure authentication-bypass zero-day (CVE-2026-104935) exploited in the wild

Ivanti · October 13, 2026

Ivanti disclosed CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure that lets a remote, unauthenticated attacker run arbitrary commands (CVSS 8.6 per Rapid7’s analysis). Volexity tracks the activity as UTA0576, which chained the flaw with other bugs, including a privilege-escalation flaw that remains unpatched, to get root on patched appliances. Fixes are available for the authentication bypass. CISA added it to the KEV catalog on October 13.

“At the time of disclosure, Ivanti is aware of limited exploitation in the wild.” — Ivanti, via BleepingComputer

Source: Ivanti advisory · Canadian Centre for Cyber Security AV26-1035 · BleepingComputer · Rapid7

Cisco Secure Email Gateway path-traversal RCE (CVE-2026-76519) exploited before a fix

Cisco PSIRT · October 14, 2026

A crafted email attachment can write arbitrary files and execute commands as root on Cisco Secure Email Gateway appliances (CVSS 9.8, Critical). Appliances are vulnerable when the File Reputation service is enabled and Content Scanner Tools is older than 25.3.0.5525. No workarounds exist; fixes include AsyncOS 15.5.5-014, AsyncOS 16.5.0-780, or Content Scanner Tools 25.3.0.5525 or later. It is in the CISA KEV catalog (added October 14).

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco Security Advisory

Source: Cisco advisory · Help Net Security

Palo Alto PAN-OS management-interface RCE (CVE-2026-0322) under limited exploitation

Palo Alto Networks · October 14, 2026

CVE-2026-0322 is an authenticated remote code execution flaw in the PAN-OS management interface (CVSS 8.6, High) affecting PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are not affected. Fixed releases exist across the 10.2, 11.1, 11.2, 12.1 and 12.2 branches. There are no workarounds, though restricting management access to trusted internal IPs reduces risk. Help Net Security reports it was added to KEV with the Cisco flaw.

“Very limited exploitation has been observed targeting the Palo Alto Networks management interface.” — Palo Alto Networks advisory

Source: Palo Alto Networks advisory · Help Net Security

Ahsay AhsayCBS authentication bypass and command injection chain added to KEV (CVE-2026-105133, CVE-2026-105134)

CISA · October 14, 2026

CISA added both AhsayCBS flaws to KEV. Attackers chain them, bypassing authentication and then running commands as SYSTEM, and have planted webshells and cryptominers on internet-facing servers. Per Help Net Security, Ahsay acknowledged earlier patches were incomplete; the fixes are the v10.3.4.45 hotfix and v9.15.2.70, followed by a reboot. CVSS scores were not stated in the sources reviewed.

Source: CISA alert · Help Net Security

Microsoft October Patch Tuesday: record volume, one exploited Windows Shell zero-day (CVE-2026-96951)

Microsoft · October 13, 2026

Microsoft’s October release fixed well over 1,400 CVEs, a record, including one actively exploited zero-day: CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web protections (CVSS 8.8 per Lansweeper). Two other flaws were publicly disclosed, including CVE-2026-108398, a .NET Framework WDAC bypass found by Google Project Zero’s James Forshaw. Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 received their final updates.

“If there’s solace to be had, it’s in the fact that only one of these bugs is under active attack.” — Dustin Childs, Zero Day Initiative

Source: CyberScoop · BleepingComputer · Lansweeper

This brief covers the trailing ~48 hours (October 13–15, 2026).

Primary sources:

• Ivanti Security Advisory, CVE-2026-104935
• Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp
• Palo Alto Networks, CVE-2026-0322
• CISA KEV alert, October 14, 2026

This brief covers developments from October 11–13, 2026, drawn from primary advisories and original sources wherever available.

GitLab patches CVSS 10.0 unauthenticated code-execution flaw in CI/CD regex compiler

GitLab · October 12, 2026

GitLab released 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler rated CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It affects self-managed GitLab CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. No in-the-wild exploitation has been reported and the CVE is not reported as a CISA KEV entry; GitLab.com is already patched.

“…could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration…” — GitLab patch release notes

Source: GitLab patch release 19.4.2; BleepingComputer.

Attackers hijack Danfoss refrigeration controllers at French supermarkets

CERT-FR · October 12, 2026

CERT-FR issued alert CERTFR-2026-ALE-012 citing numerous compromises of Danfoss AK-SM and AK-SC devices exposed to the internet. Press reports say the attack began the night of October 11 and forced freezers and fridges into defrost at hundreds of stores. No CVE has been tied to the attack; the entry point is unknown. The AK-SM 800 (end of life since 2021) and AK-SC 355 receive no patches, and Danfoss fixed three earlier AK-SM 800A flaws (CVE-2025-41450/41451/41452) in 2025. CERT-FR advises disconnecting or filtering access and, if compromise is suspected, a factory reset, patching, and rotating all secrets.

“…aware of incidents in France affecting a limited number of refrigeration management systems.” — Danfoss, to Reuters (as reported by The Hacker News)

Source: CERT-FR alert; The Hacker News; BleepingComputer.

Ledger confirms hardware implant in wallets sold via a Southeast Asian reseller

Ledger · October 11, 2026

Ledger confirmed that a device bought through reseller CryptoBilis contained an unauthorized hardware implant, tied to reported crypto thefts. Ledger says a limited number of devices are affected and all confirmed cases came through that reseller. It paused sales via CryptoBilis and advised recent buyers not to set up devices, or to move funds to a new signer with a new seed. Loss estimates (above $86 million, from a pseudonymous analyst) are unverified. No CVE applies.

“…to not initiate set up if you have not done so yet” — Ledger, on X

Source: Ledger statement; The Hacker News; BleepingComputer.

Still developing

SonicWall SMA 1000 CVSS 10.0 SSRF under active exploitation

Previdian / SonicWall · October 9, 2026

CVE-2026-102255 is a pre-authentication SSRF in the SMA1000 Work Place interface (CVSS 10.0). Patched in 12.4.3-03670 and 12.5.0-03082; versions 12.4.3-03526 and 12.5.0-02952 and older are affected. Previdian observed 135 exploitation attempts from two US IPs between October 9 and 10. It is not listed in CISA KEV per Previdian.

“A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface” — SonicWall PSIRT, as quoted by Previdian

Source: Previdian; SonicWall advisory SNWLID-2026-0017; The Hacker News.

Bricksforge WordPress plugin file-upload RCE exploited in the wild

Patchstack · October 8, 2026

CVE-2026-85097 (CVSS 10.0) is an unauthenticated arbitrary file upload in Bricksforge 3.1.8.9 and earlier, fixed in 3.1.8.10. Patchstack first saw exploitation October 7 and recorded 63 unique source IPs, with attackers uploading GIF/PHP polyglots.

“Bricksforge validates a file’s MIME type when it is first uploaded.” — Patchstack

Source: Patchstack; The Hacker News.

This brief covers the trailing ~48 hours (October 11–13, 2026).

Primary sources:

• GitLab patch release 19.4.2
• CERT-FR CERTFR-2026-ALE-012
• Ledger statement
• Previdian CVE-2026-102255
• Patchstack Bricksforge