The daily cybersecurity brief
15 stories 4 critical 6 min read Updated 06:30 IST
Prioritize defense against unauthenticated RCE in Ivanti Connect Secure VPN devices due to active exploitation. Also, address the Docker Hub vulnerability enabling image tampering via PATs. Monitor for credential theft targeting global users.
Today in 60 seconds
- A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days Active in-the-wild exploitation of a vulnerability chain allows unauthenticated RCE in Ivanti Connect Secure VPN devices.
- Docker Hub Vulnerability Allows Impersonation and Image Tampering via PAT A critical flaw in Docker Hub allowed attackers to impersonate users and manipulate container images using PATs. Do this today Review and rotate all Personal Access Tokens used with Docker Hub.
- Microsoft Seizes Phishing Platforms Used by Chinese Cybercriminals Microsoft seized domains powering three phishing platforms used by Chinese cybercriminals to target credentials globally.
No stories match your search.
Actively Exploited 4
-
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days Active in-the-wild exploitation of a vulnerability chain allows unauthenticated RCE in Ivanti Connect Secure VPN devices.
Active in-the-wild exploitation of a vulnerability chain allows unauthenticated RCE in Ivanti Connect Secure VPN devices.
- CVE
- CVE-2026-102866, CVE-2026-104935, CVE-2026-21510, +2 more
- Wed 14 OctIvanti Connect Secure: Active Exploitation of Two Zero-Days Added to CISA KEV
- TodayA Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
Also covered by Volexity, BleepingComputer
{"coverage":1,"evidence":1,"freshness":0.358,"importance":1,"novelty":0.6,"quality":0.95,"total":0.891} -
Cisco Patches Hardening Updates for Secure Email Gateway and Web Manager Cisco released hardening updates for Secure Email Gateway and Web Manager addressing multiple vulnerabilities, two of which are actively exploited.
Cisco released software hardening releases for Secure Email Gateway and Secure Email and Web Manager following an internal security review. These updates address multiple internally discovered vulnerabilities, including two known to be actively exploited. No workarounds are available for these vulnerabilities.
Why it matters. Active exploitation of these flaws allows unauthenticated remote attackers to execute commands with root privileges on the affected appliances. Immediate patching is required to mitigate risk.
Do this today Upgrade Cisco Secure Email Gateway to 15.5.5-014 or 16.0, or Cisco Secure Email and Web Manager to 15.5.5-006 or 16.0.
- Affected
- Cisco Secure Email Gateway, Cisco Secure Email and Web Manager
Also covered by BleepingComputer, The Register
{"coverage":0.898,"evidence":0.9,"freshness":0.779,"importance":0.75,"novelty":1,"quality":0.95,"total":0.858} -
Unit 42 Reports PEERSTITCH Implant via FortiGate Exploitation Attackers used multiple vulnerabilities to deploy memory-resident malware on FortiGate firewalls.
Attackers initially compromised a FortiManager appliance by exploiting CVE-2024-47575. They then used CVE-2025-61624 to deploy PEERSTITCH, a memory-resident malware on managed FortiGate firewalls. PEERSTITCH communicates via legitimate process traffic, avoiding conventional detection.
Why it matters. The malware is designed to evade detection by leaving no persistent binaries or opening listening ports. The initial access provided access to configurations and credentials for over 500 managed devices.
Do this today Review logs for activity related to CVE-2024-47575 and CVE-2025-61624.
- Affected
- FortiGate, FortiManager
- CVE
- CVE-2024-47575
{"coverage":0.387,"evidence":1,"freshness":0.92,"importance":0.75,"novelty":1,"quality":0.95,"total":0.82} -
CISA Adds Four Exploited Vulnerabilities to KEV Catalog CISA added four vulnerabilities to the KEV Catalog due to evidence of active exploitation.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. These include issues in Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS.
Why it matters. These vulnerabilities are frequently exploited by malicious actors and pose significant risks to organizations. Federal agencies are required to prioritize rapid remediation for KEV Catalog vulnerabilities on publicly exposed assets.
Do this today Prioritize remediation for CVE-2026-0322, CVE-2026-76519, CVE-2026-105133, and CVE-2026-105134.
- Affected
- Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, Ahsay AhsayCBS
- CVE
- CVE-2026-0316, CVE-2026-0319, CVE-2026-0322, +3 more
Also covered by Palo Alto Networks PSIRT
{"coverage":0.613,"evidence":0.9,"freshness":0.697,"importance":0.75,"novelty":1,"quality":0.95,"total":0.807}
Vulnerabilities & Patches 4
-
Docker Hub Vulnerability Allows Impersonation and Image Tampering via PAT A critical flaw in Docker Hub allowed attackers to impersonate users and manipulate container images using PATs.
A vulnerability in Docker Hub (CVE-2026-105445) allowed an attacker to impersonate users by exploiting how Personal Access Tokens (PATs) were reassigned during account conversions. This permitted unauthorized actions like pulling, pushing, or deleting images within the target's repositories.
Why it matters. This flaw represents a software supply chain risk, enabling attackers to publish malicious images under legitimate names. The vulnerability allowed actions within the scope of the compromised token.
Do this today Review and rotate all Personal Access Tokens used with Docker Hub.
- Affected
- Docker Hub users with Personal Access Tokens (PATs)
- CVE
- CVE-2026-105445
Also covered by GBHackers
{"coverage":0.613,"evidence":0.7,"freshness":0.393,"importance":0.75,"novelty":1,"quality":0.95,"total":0.726} -
AhsayCBS: Auth Bypass and Path Traversal Lead to RCE Chaining authentication bypass and path traversal in AhsayCBS allows unauthenticated RCE.
Researchers demonstrated chaining CVE-2026-105133, an authentication bypass in API components, with CVE-2026-105134, a file write path traversal. This combination allows an attacker to create administrator accounts and upload webshells.
Why it matters. Successful exploitation allows command execution as SYSTEM on Windows or root on Linux. This indicates a critical risk of full system compromise.
Do this today Apply hotfixes released by Ahsay.
- Affected
- AhsayCBS
- CVE
- CVE-2026-105133, CVE-2026-105134
Also covered by r/netsec
{"coverage":0.387,"evidence":0.7,"freshness":0.796,"importance":0.75,"novelty":1,"quality":0.85,"total":0.723} -
curl Patches HTTP/2 Upload Flaw Allowing Client-Side Code Execution A flaw in curl's HTTP/2 upload handling permits a malicious server to execute code on the client machine.
A flaw in curl's HTTP/2 upload handling allows a malicious server to corrupt the client's memory during an upload process. This vulnerability was demonstrated to allow for client-side code execution.
Why it matters. Successful exploitation enables an attacker to execute arbitrary code on the machine performing the upload.
Do this today Upgrade curl to version 8.23.0 or later.
- Affected
- curl
{"coverage":0.387,"evidence":0.5,"freshness":0.701,"importance":0.75,"novelty":1,"quality":0.8,"total":0.658} -
Linux Kernel vhost Flaw (CVE-2026-74580) Allows Local Root and Host Escape A flaw in the Linux vhost subsystem allows local users to achieve root privileges and potentially escape to the host.
CVE-2026-74580, named Vghost, is a flaw in the Linux vhost subsystem. This vulnerability permits a local user to read and write kernel memory, resulting in root access. The flaw also presents a vector for an untrusted virtual machine to write to and hijack the host's memory.
Why it matters. Local privilege escalation and guest-to-host escape capabilities increase the potential impact of a compromised low-privilege account. Immediate mitigation is required to prevent system compromise.
Do this today Review vendor advisories for patches related to the vhost subsystem.
- Affected
- Linux kernel versions
- CVE
- CVE-2026-74580
Also covered by r/netsec
{"coverage":0.387,"evidence":0.4,"freshness":0.545,"importance":0.75,"novelty":1,"quality":0.8,"total":0.618}
Worth watching
-
Conference talk How I Got Arrested By The FBI For Hacking
Malware & Ransomware 1
-
Hirudo Android Malware Replaces Banking Apps to Steal Credentials Hirudo malware replaces legitimate banking apps with patched versions to bypass security checks and steal credentials.
Hirudo is an Android malware that replaces legitimate banking applications with modified versions. These patched apps use a hooking engine to bypass security checks such as app-signature and Play Integrity checks. Once active, the malware can steal credentials, capture screen data, and record audio.
Why it matters. This malware targets the application layer security mechanisms within banking apps, representing an escalation in financial fraud techniques. Defenders must assume device-level integrity checks may be bypassed by the malware's internal processes.
Do this today Avoid installing APK files from unofficial Android stores.
- Affected
- Android devices
Also covered by The Hacker News
{"coverage":0.613,"evidence":0,"freshness":0.68,"importance":0.75,"novelty":1,"quality":0.95,"total":0.58}
Threat Actors & Campaigns 4
-
Microsoft Seizes Phishing Platforms Used by Chinese Cybercriminals Microsoft seized domains powering three phishing platforms used by Chinese cybercriminals to target credentials globally.
Microsoft, with partners, obtained a court order to seize and redirect domains underlying YAM Store, CoGUI, and Iron Man. These platforms were used to send malicious messages impersonating over 75,000 organizations.
Why it matters. The platforms facilitated the theft of credentials and personal information from consumers, healthcare, and financial institutions across multiple countries.
Also covered by SecurityWeek, CyberScoop
{"coverage":1,"evidence":0,"freshness":0.717,"importance":0.75,"novelty":1,"quality":0.95,"total":0.642} -
Cyberattack Targets Danfoss Refrigeration Controllers in French Supermarkets Attackers remotely triggered defrost cycles on refrigeration controllers at French supermarkets.
A cyberattack disrupted refrigeration at numerous French supermarkets by remotely triggering the defrost function on units. Reports indicate the attack targeted older versions of Danfoss refrigeration controllers.
Why it matters. This demonstrates the potential for physical disruption of critical food supply infrastructure via industrial control systems.
- Affected
- Danfoss refrigeration controllers
- Tue 13 OctDanfoss Refrigeration Controllers Targeted in French Supermarket Cyberattack
- Wed 14 OctDanfoss Refrigeration Controllers Targeted in Supermarket Cyberattack
- TodayCyberattack Targets Danfoss Refrigeration Controllers in French Supermarkets
Also covered by BleepingComputer, SecurityWeek
{"coverage":1,"evidence":0,"freshness":0.128,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.543} -
North Korean Group Uses Fraudulent IT Workers to Infiltrate US Sectors North Korea utilized fraudulent remote workers and laptop farms to gain persistent access to corporate networks.
The FBI and CrowdStrike disrupted FAMOUS CHOLLIMA, a North Korean operation placing fraudulent remote IT workers within U.S. companies. The infrastructure allowed operatives to maintain access using genuine corporate endpoints rather than requiring initial exploits. This involved U.S.-based facilitators managing device delivery and connectivity.
Why it matters. This scheme demonstrates that employment fraud can establish persistent corporate access by compromising the hardware and identity layer. Endpoint artifacts and connectivity patterns must be scrutinized for convergence across unrelated employers.
Do this today Review endpoint telemetry for hardware or software identifiers that appear across unrelated employee accounts.
{"coverage":0.387,"evidence":0,"freshness":0.584,"importance":0.75,"novelty":1,"quality":0.65,"total":0.506} -
North Macedonia Police Arrest Suspected Administrator of OLVX Market Law enforcement arrested the suspected administrator of the OLVX cybercrime market in North Macedonia.
North Macedonian police and the FBI arrested the suspected administrator of the OLVX cybercrime market in a joint operation. OLVX was a market active since 2023 where cybercriminals traded stolen data and credentials. The suspect also allegedly ran a Telegram group named ONEMILI.
Why it matters. The OLVX market facilitated the sale of personally identifiable information and login credentials, posing a risk to digital security.
{"coverage":0.387,"evidence":0,"freshness":0.899,"importance":0.5,"novelty":1,"quality":0.95,"total":0.493}
Breaches & Incidents 2
-
TFG London Cyberattack Impacts IT Systems for Multiple Fashion Brands TFG London confirmed a cybersecurity incident impacting IT systems for Phase Eight, Hobbs, and Whistles.
TFG London detected a cybersecurity incident affecting IT systems supporting the Phase Eight, Hobbs, and Whistles brands. The company activated incident response plans upon detecting the attack on October 11.
Why it matters. While physical stores remain open, the unavailability of IT systems suggests potential operational disruption. Customers should remain alert for related phishing or social engineering attacks.
Do this today Monitor for phishing or social engineering attempts targeting employees or customers of the affected brands.
- Affected
- Phase Eight, Hobbs, Whistles, Inside Story, White Stuff
Also covered by GBHackers
{"coverage":0.613,"evidence":0,"freshness":0.408,"importance":0.75,"novelty":1,"quality":0.95,"total":0.553} -
Credential Compromise Infiltration via Misconfigured VPN Gateway Attackers used compromised credentials through a misconfigured VPN to conduct extensive reconnaissance on a European bank's internal systems.
Threat actors used valid, compromised credentials to gain initial access via a misconfigured, third-party-managed VPN gateway. The activity involved months of reconnaissance, including extensive host and network scanning and repeated password-guessing campaigns against internal systems.
Why it matters. The incident demonstrates that weak identity controls and perimeter access weaknesses can allow attackers to map and probe internal infrastructure even without advanced zero-day exploitation.
Do this today Implement phishing-resistant MFA and reduce standing administrative privileges on all access points.
{"coverage":0.387,"evidence":0,"freshness":0.675,"importance":0.75,"novelty":1,"quality":0.65,"total":0.516}
CVE spotlight
| CVE | Affects | CVSS | EPSS | Status |
|---|---|---|---|---|
| CVE-2026-104935 | Ivanti Connect SecureAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. Thi… | 8.6 | 26% | Exploited (KEV)CISA due 16 Oct |
| CVE-2026-96951 | Microsoft WindowsImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypa… | 8.8 | — | Exploited (KEV)CISA due 16 Oct |
| CVE-2026-32202 | Microsoft WindowsProtection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | 4.3 | 5% | Exploited (KEV)CISA due 12 May (passed) |
| CVE-2026-21510 | Microsoft WindowsProtection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. | 8.8 | 25% | Exploited (KEV)CISA due 3 Mar (passed) |
| CVE-2024-47575 | Fortinet FortiManagerA missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, Fo… | 9.8 | 95% | Exploited (KEV)CISA due 13 Nov (passed) |
| CVE-2026-105134 | —A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do o… | 10.0 | 2% | Not in KEV |
Quiz
Yesterday's answer
According to the CISA advisory, which vulnerability added to the KEV catalog relates to Microsoft Windows Command Injection?
Microsoft Windows Command Injection
The story explicitly states that CVE-2026-96951 relates to Microsoft Windows Command Injection.
Today's question
According to the story, what mechanism allowed an attacker to impersonate users via the Docker Hub vulnerability (CVE-2026-105445)??
Locked in. The answer is in tomorrow's brief.
On the radar tomorrow
- KEV deadline tomorrowCVE-2026-104935 · Ivanti Connect Secure
- KEV deadline tomorrowCVE-2026-96951 · Microsoft Windows
- WatchingAnthropic warns self-replicating AI could spread to your smart devices
- WatchingOpenAI engineer arrested for allegedly planting spy device in office
Also worth your time
Exploits
Tools
- FrancescoStabile/numasecThe AI Agent for Cyber Security.
- KatrielMoses/voidaccessSelf-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to …
Community
- Anthropic's Sept 2026 threat report: attackers prompt-injected an eval sandbox, stole customer API keys, then burned the victims' own compute to attack ~30 AI labs
- AhsayCBS Deep-Dive: Auth Bypass to RCE
- tensorlake@0.5.144: A Worm With Valid Provenance, and the Firewall Rule That Stops It
- Vghost (CVE-2026-74580): Linux kernel vhost stale IOTLB cache leading to universal LPE and Guest-to-Host escape vector
- Passkeys are a trap
- We Let AI Fuzz Adobe Reader for a Week. It Found a Critical Zero-Day CVE-2026-81983
Podcasts
- 180: Conti
- Risky Business #855 -- ShinyHunters done sowing, enters reaping phase
- SN 1100: Booby Trapping LLMs - AI Frenzy in Cybercrime
- SANS Stormcast Wednesday, October 14th, 2026: October 2026 Patch Tuesday: Microsoft Fixes 1,417 Vulnerabilities; Ivanti Connect Secure Exploited; Adobe ColdFusion and Commerce Critical Patches
That's today's brief.
The next brief lands at 06:30 IST.