Cisco ASA/FTD: Unauthenticated RCE via SSL VPN Denial of Service

Critical·KEV·CVSS 8.6·6 outletsNew Cisco ASA/FTD: Unauthenticated RCE via SSL VPN Denial of Service Unauthenticated remote attackers can cause denial of service on Cisco ASA/FTD via SSL VPN logic errors. Do this today Upgrade to fixed software releases for ASA or FTD. Read the full story ↓
High·CVSS 9.8New Linux Kernel TCP Flaw (CVE-2026-98432) Allows Root Command Execution A flaw in the Linux kernel's TCP code allows unauthenticated remote attackers to execute root commands. Do this today Apply kernel updates addressing CVE-2026-98432. Read the full story ↓
Info·PoC publicNew Anthropic AI Model Finds Chained Exploits in Major Browsers and OSes An unreleased AI model demonstrated chaining multiple vulnerabilities across major operating systems and browsers. Read the full story ↓

From the editor

Prioritize remediation for the Cisco ASA/FTD SSL VPN denial of service vulnerability. Address the Linux Kernel TCP flaw (CVE-2026-98432) to prevent unauthenticated root command execution. Monitor for exploitation techniques demonstrated against major browsers and operating systems.

Anmol Singh YadavEditor, PwnSpectrum

Actively Exploited 4

Cisco ASA/FTD: Unauthenticated RCE via SSL VPN Denial of Service Critical·KEV·CVSS 8.6·6 outlets·Cisco PSIRTNewRead Unauthenticated remote attackers can cause denial of service on Cisco ASA/FTD via SSL VPN logic errors.
A vulnerability in the Remote Access SSL VPN service of Cisco ASA and FTD software allows an unauthenticated, remote attacker to cause the device to reload unexpectedly. This flaw stems from logic errors when secondary authentication is configured on a tunnel group. Exploitation requires sending a crafted request during SSL remote access VPN connection attempts.

Why it matters. Successful exploitation results in a denial of service condition for the affected firewall devices. The vulnerability is listed in CISA KEV and has a maximum CVSS score of 8.6.

Do this today Upgrade to fixed software releases for ASA or FTD.

Affected
ASA Software, FTD Software

CVE
CVE-2026-76418

Read on Cisco PSIRT Post on X LinkedIn

Also covered by BleepingComputer, SecurityWeek
```
{"coverage":1,"evidence":1,"freshness":0.4,"importance":0.75,"novelty":1,"quality":0.95,"total":0.86}
```
PHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Critical·KEV·PoC public·CVSS 9.8·EPSS 100%·24 outlets·Fortinet PSIRTDay 8NewRead Two critical PHP RCE vulnerabilities allow unauthenticated remote code execution in web-facing applications.
CVE-2026-109618 allows RCE via improper handling of memory after out-of-memory errors. CVE-2026-109619 allows RCE due to stale global state referencing freed request memory. These affect all PHP installations serving web requests.

Why it matters. Successful exploitation of these vulnerabilities permits unauthenticated remote code execution on affected web servers. Immediate patching is required to prevent system compromise.

Do this today Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately; consider taking PHP-based systems offline if patching is delayed.

Affected
All PHP installations serving web requests

CVE
CVE-2026-109618, CVE-2026-109619, CVE-2026-115560
1. Thu 22 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
2. Fri 23 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
3. Sat 24 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
4. Mon 26 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
5. Tue 27 OctPHP Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Allow RCE
6. Wed 28 OctPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
7. Thu 29 OctPHP RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
8. TodayPHP Core RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Read on Fortinet PSIRT Post on X LinkedIn

Also covered by CISA, Unit 42
```
{"coverage":1,"evidence":1,"freshness":0.002,"importance":1,"novelty":0.6,"quality":0.95,"total":0.855}
```
CISA Adds Two Exploited Vulnerabilities to KEV Catalog Critical·KEV·CVSS 7.8·EPSS 16%·4 outlets·CISANewRead CISA added two vulnerabilities, CVE-2026-41709 and CVE-2026-46300, to the KEV Catalog due to active exploitation.
CISA added CVE-2026-41709, an insufficient logging vulnerability in Broadcom VMWare ESX, and CVE-2026-46300, a Linux Kernel variable initialization flaw, to its KEV Catalog. Evidence of active exploitation was cited for both vulnerabilities.

Why it matters. These vulnerabilities are actively exploited and represent significant risks, requiring immediate prioritization for remediation efforts.

Do this today Prioritize remediation for CVE-2026-41709 and CVE-2026-46300.

Affected
Broadcom VMWare ESX, Linux Kernel

CVE
CVE-2026-41709, CVE-2026-46300

Read on CISA Post on X LinkedIn

Also covered by SecurityWeek, The Hacker News
```
{"coverage":0.898,"evidence":1,"freshness":0.358,"importance":0.75,"novelty":1,"quality":0.95,"total":0.841}
```
Volt Typhoon Exploits Zero-Days in Enterprise Management Platforms Critical·Exploited·Silent Train Researchers via GBHackersNewRead Volt Typhoon exploited multiple zero-days in centralized management platforms to gain access to critical infrastructure.
Volt Typhoon exploited multiple unknown vulnerabilities in enterprise management platforms to penetrate strategically significant organizations. The group utilized a framework called Silent Train, which routed operations through compromised non-U.S. devices before reaching domestic relay nodes. Campaigns targeted endpoint management, network administration, and SD-WAN orchestration.

Why it matters. Compromising these control planes provided broad visibility and privileged functionality, potentially allowing attackers to maintain access for extended periods. Defenders should prioritize securing management infrastructure against lateral movement techniques.

Do this today Review unauthorized “Accepted publickey for vmanage-admin” events and validate control-plane peering connections for Cisco devices.

Affected
Quest KACE, Versa Director, N-able N-central, Cisco Catalyst SD-WAN, VeloCloud Orchestrator

Read the original · Silent Train Researchers Post on X LinkedIn

Summarised from GBHackers.
```
{"coverage":0.387,"evidence":0.9,"freshness":0.648,"importance":1,"novelty":1,"quality":0.65,"total":0.813}
```

Vulnerabilities & Patches 4

Linux Kernel TCP Flaw (CVE-2026-98432) Allows Root Command Execution High·CVSS 9.8·The Hacker NewsNewRead A flaw in the Linux kernel's TCP code allows unauthenticated remote attackers to execute root commands.
CVE-2026-98432 is a flaw in the Linux kernel's TCP code. The vulnerability allows a remote attacker with no credentials to execute commands as root on affected Linux servers.

Why it matters. Successful exploitation grants an attacker root-level command execution on the host system.

Do this today Apply kernel updates addressing CVE-2026-98432.

Affected
Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions

CVE
CVE-2026-98432

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.7,"freshness":0.778,"importance":0.75,"novelty":1,"quality":0.8,"total":0.716}
```
Hitachi Energy CoreTec Product: OS Command Injection and Dirty Frag Vulnerabilities High·CVSS 8.8·EPSS 94%·CISANewRead CoreTec product versions are vulnerable to OS command injection and Dirty Frag, impacting confidentiality, integrity, and availability.
Hitachi Energy CoreTec Product is affected by OS command injection and Dirty Frag vulnerabilities (CVE-2026-13162, CVE-2026-43284). Exploitation could allow authenticated users with specific roles to execute arbitrary system commands.

Why it matters. Successful exploitation impacts the confidentiality, integrity, and availability of the product, affecting critical energy infrastructure sectors worldwide.

Do this today Review and apply recommended immediate actions from Hitachi Energy regarding CoreTec product vulnerabilities.

Affected
CoreTec5/<=3.4.0, 5.0.0; CoreTec4/<=3.4.0

CVE
CVE-2026-13162, CVE-2026-43284

Read on CISA Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.6,"freshness":0.697,"importance":0.75,"novelty":1,"quality":0.95,"total":0.698}
```
Hitachi Energy TRO600 Series: Multiple Vulnerabilities Include RCE Risk High·CVSS 8.7·CISANewRead Multiple vulnerabilities exist in Hitachi Energy TRO600 series products, allowing potential remote code execution.
Multiple vulnerabilities affect Hitachi Energy TRO600 series products. These flaws can allow remote code execution and sensitive information disclosure. One vulnerability allows an authenticated attacker to bypass network access restrictions.

Why it matters. Exploitation could lead to further attacks against critical infrastructure sectors, specifically energy.

Do this today Review CISA's Recommended Immediate Actions for specific mitigation steps.

Affected
TRO600/<=9.2.1.6, TRO600/<=9.1.1.0, 9.2.2.1, 9.1.2.0

CVE
CVE-2026-106087, CVE-2026-10756

Read on CISA Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.697,"importance":0.75,"novelty":1,"quality":0.95,"total":0.648}
```
Cisco Finesse SSRF Vulnerability (CVE-2026-20362) High·CVSS 7.2·Horizon3.aiNewRead Unauthenticated SSRF in Cisco Finesse allows limited information disclosure via crafted HTTP requests.
CVE-2026-20362 is a high-severity SSRF vulnerability in the web-based management interface of Cisco Finesse. An unauthenticated remote attacker can send crafted HTTP requests through the affected server. This flaw stems from improper input validation in the Finesse web interface's embedded Apache Shindig content proxy.

Why it matters. Exploitation allows an attacker to direct requests to loopback-only or internal network services, enabling infrastructure enumeration and access to internal service responses.

Do this today Restrict access to the Finesse web interface to trusted networks or authenticated VPN connections.

Affected
Cisco Finesse

CVE
CVE-2026-20362

Read on Horizon3.ai Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.37,"importance":0.75,"novelty":1,"quality":0.85,"total":0.605}
```

Worth watching

Malware analysis Reverse Engineering Proves What We Suspected All Along.. Low Level · 29 Oct
Walkthrough Cloudflare is offering a $3,000 bounty for any unique PHO2SHELL bypass. NahamSec · 28 Oct
Malware analysis AI Meets Minecraft John Hammond · 28 Oct
Exploitation The $2,000 php2shell Challenge Was Unexploitable LiveOverflow · 26 Oct

Malware & Ransomware 3

Hugging Face Malware Campaign Hijacks GPUs; Fake GitHub Kit Targets AI Agents High·Pluto Security via BleepingComputerNewRead Malicious models on Hugging Face mine crypto; a fake GitHub kit targets AI agents with a RAT.
A crypto-mining campaign resurfaced on Hugging Face, abusing the trust_remote_code option to execute malicious code upon model loading. Separately, a fake Solana starter kit on GitHub tricks AI coding agents into installing a NetSupport RAT.

Why it matters. Enabling remote code execution via model loading or following suspicious GitHub instructions can lead to crypto mining, reverse shell access, or persistent remote control of systems.

Do this today Do not load models from untrusted sources with trust_remote_code enabled.

Affected
GPU hosts running self-hosted inference servers (Xinference, GPUStack)

Read the original · Pluto Security Post on X LinkedIn

Summarised from BleepingComputer.
```
{"coverage":0.387,"evidence":0,"freshness":0.924,"importance":0.75,"novelty":1,"quality":0.95,"total":0.57}
```
Volt Typhoon Linked to Cisco SD-WAN Key-Stealing Malware via CVE-2026-20127 High·Lumen via SecurityWeekNewRead A threat actor linked to Volt Typhoon exploited a Cisco SD-WAN vulnerability to deploy malware for key harvesting.
An actor exploited CVE-2026-20127, a critical Cisco SD-WAN vulnerability, to remotely gain admin rights without credentials. This allowed the deployment of KeyDrift malware, which harvests encryption keys from SD-WAN controllers.

Why it matters. Successful exploitation grants persistent access and the ability to siphon keying material protecting both control and data plane traffic. This indicates a high risk of network compromise and data exfiltration.

Do this today Review SD-WAN controller configurations for signs of unauthorized keying material exfiltration.

Affected
Cisco SD-WAN controllers

Read the original · Lumen Post on X LinkedIn

Summarised from SecurityWeek.
```
{"coverage":0.387,"evidence":0,"freshness":0.668,"importance":0.75,"novelty":1,"quality":0.9,"total":0.54}
```
GitHub Supply Chain Attack Targets 61 Public Repositories via Issues High·Radware via The RegisterNewRead Attackers used malicious content in GitHub issues to trigger workflows and attempt credential theft across numerous open source repositories.
Researchers identified a coordinated campaign targeting 61 public GitHub repositories using malicious content hidden in issues, pull requests, or comments. This content triggered automated workflows, which incorporated attacker-controlled code to attempt exfiltrating environment variables.

Why it matters. The attack vector allows execution of code within CI/CD environments using only the ability to submit an issue, posing a significant supply chain risk to widely used open source projects.

Do this today Apply least-privilege access to CI/CD workflows and limit secrets available to workflows triggered by external events.

Read the original · Radware Post on X LinkedIn

Summarised from The Register.
```
{"coverage":0.387,"evidence":0,"freshness":0.697,"importance":0.75,"novelty":1,"quality":0.85,"total":0.538}
```

Breaches & Incidents 3

DHS Data Leak Exposes Personal Information of 41,000 Employees High·Ars TechnicaNewRead A data leak exposed personal and professional information belonging to over 41,000 DHS and ICE personnel.
A data leak was disclosed containing personal and professional information on more than 41,000 U.S. Department of Homeland Security employees. The exposed data included details regarding undercover agents and surveillance groups.

Why it matters. The leak compromises the sensitive personal and operational details of numerous federal employees.

Affected
U.S. Department of Homeland Security employees, ICE agents

Read on Ars Technica Post on X LinkedIn

Also covered by GBHackers, Hacker News
```
{"coverage":0.613,"evidence":0,"freshness":0.46,"importance":0.75,"novelty":1,"quality":0.9,"total":0.553}
```
DHS Employee Data Leak Allegedly Stolen from Okta SSO System High·TechCrunch via SecurityWeekNewRead Over 41,000 DHS employee records, including access details, were allegedly leaked from an Okta single sign-on system.
A threat actor leaked a database containing personal and work information for over 41,000 US Department of Homeland Security employees. The compromised data reportedly includes names, work emails, phone numbers, job titles, and system access details.

Why it matters. The leak provides potential attackers with a roadmap detailing which employees have access to specific internal systems and applications.

Affected
DHS employees, CBP, ICE, HSI personnel

Read the original · TechCrunch Post on X LinkedIn

Summarised from SecurityWeek.
```
{"coverage":0.387,"evidence":0,"freshness":0.714,"importance":0.75,"novelty":1,"quality":0.9,"total":0.544}
```
So-net Data Breach: Exposure of 2.6 Million Customer Records High·So-net(ソネット) via SecurityWeekNewRead Hackers accessed So-net's member database, exposing personal data, passwords, and bank records for millions of Japanese subscribers.
Hackers gained unauthorized access to the So-net member database on October 19. The exposed data includes names, DOBs, phone numbers, email addresses, and details from 16 bank accounts. So-net reset passwords for impacted email addresses.

Why it matters. The breach exposed PII, credentials, and financial details, increasing risk of identity theft and account takeover for affected individuals.

Affected
So-net and Plala customers in Japan

Read the original · So-net(ソネット) Post on X LinkedIn

Summarised from SecurityWeek.
```
{"coverage":0.387,"evidence":0,"freshness":0.678,"importance":0.75,"novelty":1,"quality":0.9,"total":0.541}
```

AI Security 1

Anthropic AI Model Finds Chained Exploits in Major Browsers and OSes Info·PoC public·Dark ReadingNewRead An unreleased AI model demonstrated chaining multiple vulnerabilities across major operating systems and browsers.
An unreleased version of the Anthropic AI model identified and chained multiple vulnerabilities in Chrome, Safari, Android, Windows, and Linux. The model generated working proof-of-concept exploits after being prompted.

Why it matters. This demonstrates the capability of AI models to automate the discovery and chaining of complex, multi-vector vulnerabilities.

Affected
Chrome, Safari, Android, Windows, Linux

Read on Dark Reading Post on X LinkedIn

Also covered by The Hacker News
```
{"coverage":0.613,"evidence":0.5,"freshness":0.322,"importance":0.5,"novelty":1,"quality":0.85,"total":0.584}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2026-97229	GitLab Community Edition and Enterprise EditionGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th…	10.0	18%	Exploited (KEV)CISA due 1 Nov
CVE-2026-76418	Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareA vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Fi…	8.6	1%	Exploited (KEV)CISA due 1 Nov
CVE-2026-46300	Linux KernelIn the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coa…	7.8	16%	Exploited (KEV)CISA due 31 Oct
CVE-2026-41709	Broadcom VMware ESXVMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations …	2.7	1%	Exploited (KEV)CISA due 11 Nov
CVE-2026-111497	Google BrotliA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows…	9.8	83%	Exploited (KEV)CISA due 10 Nov
CVE-2026-48356	Adobe Commerce and MagentoAdobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution…	9.3	45%	Exploited (KEV)CISA due 10 Nov

Quiz

Yesterday's answer

According to the provided text, what vulnerability mechanism does CVE-2026-109618 exploit to achieve RCE?

improper handling of memory after out-of-memory errors

The story explicitly states that CVE-2026-109618 allows RCE through improper handling of memory after out-of-memory errors.

Today's question

According to the provided text, what is the direct result of successfully exploiting this vulnerability in Cisco ASA/FTD?

The week in review

On the radar tomorrow

KEV deadline tomorrowCVE-2026-46300 · Linux Kernel
KEV deadline Sun 1 NovCVE-2026-76418 · Cisco Secure Firewall ASA Software and Cisco Secure FTD Software
CTF starts Fri 06:30 UTCHacker's Gambit 2026 (Round 2 – Grand Finale)
WatchingMultiple Node.js CVEs
WatchingApple backports CoreGraphics zero-day patches to older iPhones

Also worth your time

Exploits

PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCERemote · CVE-2026-109618
pizzafy-1.0 - SQLiWebApps
South River Technologies Titan MFT Server 26.0.0 - code executionRemote
Synametrics Syncrify 6.2 - command executionRemote
Keycloak 26.7.2 - Unauthenticated Account TakeoverWebApps

Tools

gpustack/gpustackIn today's news · via BleepingComputer · AI security · PythonManages GPU clusters for AI model serving and provisions on-demand, SSH-accessible GPU instances.
huggingface/safeagentsNew · 31 stars in 1 day · AI security · PythonThis proxy intercepts and inspects tool calls made by AI agents before they reach the model server.
Aryma-f4/gulpsuiteNew · 33 stars in 11 days · Web & AppSec · RustProvides a cross-platform suite for web security testing, including DAST scanning, proxying, and vulnerability auditing.

Community

Podcasts

181: RickyDarknet Diaries · 01:20:15
Snake Oilers: Minimal.dev, Request Rocket and TRM LabsRisky Business · 44:26
SN 1102: A Strategic Plug Pull - Lessons From a Global Patch-and-Panic Fire DrillSecurity Now · 2:54:06
SANS Stormcast Thursday, October 29th, 2026: ClickFix Campaign Targets macOS and Windows; EDK II UEFI PXE Pre-Boot RCE (CVE-2026-97631); Qwen AI Model Data Exfiltration; LiteLLM Master Key LeakSANS Internet Storm Center · 8:13

And finally

AI Agent Exploits Unprotected Models for Autonomous Cyberattacks

Attackers developed an AI agent exploiting unprotected web models for autonomous cyberattacks. The agent can execute tools, scan targets, and mine cryptocurrency.

Source: Security · via CSO Online

End of No. 249

That's today's brief.

Coming upKEV deadline tomorrow: CVE-2026-46300 · Linux Kernel

The next brief lands at 06:30 IST.

Friday, 30 October 2026

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 3

Breaches & Incidents 3

AI Security 1

CVE spotlight

Quiz

The week in review

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally

Keyboard shortcuts

Top stories

From the editor

Actively Exploited 4

Vulnerabilities & Patches 4

Worth watching

Malware & Ransomware 3

Breaches & Incidents 3

AI Security 1

CVE spotlight

Quiz

The week in review

On the radar tomorrow

Also worth your time

Exploits

Tools

Community

Podcasts

And finally