Security news, decoded.

Cisco Talos reports that Microsoft's October 2026 Patch Tuesday included 1,415 vulnerability advisories, up from 975 in September and roughly tenfold the pre-June monthly average of around 100. Talos attributes the spike to frontier AI models, particularly Mythos, which are efficiently excavating years of technical debt in widely used legacy libraries and tools, straining open-source maintainers and challenging the traditional 90-day coordinated disclosure timeline. Despite a 105% year-over-year jump in published CVEs, the number of vulnerabilities added to the Known Exploited Vulnerabilities (KEV) list grew only 37%, and just three of September's 975 Microsoft advisories were actually exploited in the wild—suggesting most newly found bugs aren't practically weaponized yet. Talos advises organizations to prioritize flaws with real exploitability in their own environment, deploy interim mitigations such as LiveProtect, add behavioral anomaly detection, and fold current AI evaluation tools into software development pipelines as defense-in-depth measures.

A new analysis from Terra Security researcher Oren Yomtov finds that a growing number of software patches fail to fully close the vulnerabilities they target, effectively showing attackers exactly where to dig further. After reviewing published CVE records and GitHub security advisories, the team found that incomplete or bypassable fixes stayed rare and steady for years, then jumped roughly eightfold among open-source GitHub fixes in 2026. Patches for bugs already listed on CISA's Known Exploited Vulnerabilities catalog were about four times more likely to later be reported broken than other fixes from the same vendors, likely because exploited flaws attract more scrutiny from researchers hunting for what the patch missed. Flaws typically patched with input blocklists, such as SSRF and prototype pollution issues, were also overrepresented among broken fixes, as shown by Roundcube's webmail software, where an SSRF fix (CVE-2026-3554) needed three follow-up CVEs between May and August 2026, and by Microsoft's Windows Shell flaw CVE-2026-21510, exploited by APT28 and patched in February 2026, only for Akamai to find a bypass that Microsoft later fixed in April as CVE-2026-32202. Yomtov urges developers to stress-test their own patches for root-cause coverage before release, and advises defenders to keep probing systems even after vulnerability scanners report a clean bill of health.

A security researcher at NorForge, Snorre Fagerland, discovered that a Chinese-speaking attacker was using autonomous AI agents built on the open-source tool Cairn to automatically probe and compromise company websites, after the attacker left their management dashboards exposed online. Reuters reviewed the attacker's own logs and identified over 1,200 targeted sites and more than 100 breached companies, including Deere, SharkNinja and Cummins, with web shells and stolen session cookies used to gain lasting footholds in e-commerce and payment systems. The attacks reportedly took under 23 hours on average, cost roughly $50 per successful intrusion, and relied on workers apparently driven by models resembling DeepSeek and Claude Code, though this was not formally confirmed. NorForge also warns that the same exposed panels leaked hundreds of valid credentials and keys, and separately flagged a proof-of-concept for a critical Magento flaw tracked as CVE-2026-75650, urging shops on vulnerable Adobe Commerce or Magento Open Source builds to apply the vendor's hotfix.

Siemens has confirmed that attackers are actively abusing CVE-2026-110936, a DLL side-loading weakness in Siemens Software Center, the vendor's download and update utility, to smuggle malware onto victims' machines. The advisory, first issued on 15 October 2026 and scored 8.4 under CVSS v4.0 by reporter Jose Oregon of Huntress Labs, was updated two days later to point customers to the patched release 4.0.9.8, followed by a confirmation of in-the-wild abuse on 19 October. Rather than tampering with the signed executable itself, attackers bundled a malicious installer named AllMyBasic.msi that placed rogue helper files next to the trusted, signed program so the older version 3.5.8.7 would load them without verification. The campaign, linked to the Romulus multi-platform ClickFix delivery panel documented by Forescout's Vedere Labs, tricks users into pasting and executing commands themselves, ultimately deploying payloads such as the LegionLoader malware capable of stealing Chrome browser data. Siemens says existing installations will auto-update on next launch and urges customers to only obtain its software from official sources, while defenders are advised to block the identified infrastructure and watch for SiemensSoftwareCenter.exe being spawned by msiexec from AppData\Local\Programs.

Symantec's Threat Hunter Team reports that the Russian state-sponsored group APT28 (also known as BlueDelta, Fancy Bear, Forest Blizzard, and tracked by Symantec as Swallowtail) infiltrated organizations in two NATO member countries, including a naval shipbuilder, a law enforcement agency, and a maker of military aircraft engines. The attackers delivered their HOOKEDGE backdoor through macro-laced Microsoft Word documents and, in the shipbuilder intrusion, spent a week with hands-on-keyboard access, stealing credentials via two separate methods, setting up a persistent SSH tunnel into the internal network, and dropping a previously unknown reflective loader. The HOOKEDGE variant used in this case abandoned its earlier webhook[.]site communication channel for a dedicated IP address to handle tasking and data theft. No exploitation of a specific CVE was tied to this intrusion, and it remains unclear whether data was actually exfiltrated, but the operation highlights APT28's growing tradecraft against NATO-linked industrial and defense targets, following earlier campaigns that also touched products like iOS exploit kits used against Ukrainian officials.

Siemens has fixed a DLL sideloading flaw in Siemens Software Center that has already been abused in active ClickFix attacks. Tracked as CVE-2026-110936 with a CVSS v4 score of 8.4, the bug lets a local authenticated attacker drop a malicious DLL into a folder the app loads from, letting arbitrary code run with the privileges of the application; version 3.5.8.7 was affected and researcher Jose Oregon of Huntress Labs reported the issue. Attackers paired a legitimate, signed copy of the software with a rogue archive.dll, delivering it through the Romulus ClickFix platform—sometimes via fake ChatGPT Custom GPT pages—so that msiexec.exe runs an MSI package that launches SiemensSoftwareCenter.exe and ultimately installs a remote access trojan. Siemens urges customers to upgrade to version 4.0.9.8 or later, restart the application, block the shared malicious IPs and domains, and watch for SiemensSoftwareCenter.exe executing from AppData\Local\Programs via msiexec.exe.

Kaspersky's Securelist team published an in-depth research report tracing how a single parcel's journey through a modern warehouse — from unloading to shipment — exposes numerous cyberattack entry points. The researchers show that warehouse management systems (WMS), the software coordinating inventory, picking, sorting and robotics, act as a central nervous system whose compromise can cascade into corrupted stock records, misrouted shipments and halted conveyors and robots. They highlight real-world incidents at Morrisons, United Natural Foods and CEVA Logistics where IT disruptions hit order fulfillment, and point to concrete flaws such as a Bluetooth remote-execution bug in Honeywell barcode scanners (CVE-2026-4272) and an authorization-bypass vulnerability in Oracle Warehouse Management (CVE-2026-70774). The report also describes practical attack vectors like rogue Wi-Fi and Bluetooth access, unsecured network ports hidden in warehouse racking, malicious barcodes that inject keystrokes, and kiosk-mode escapes on portable data terminals and thermal printers, urging operators to adopt network segmentation, zero-trust access and continuous WMS patching to limit the business impact of such attacks.

Siemens has confirmed that attackers are actively abusing a flaw in Siemens Software Center, the tool used to download, install, activate and update licensed Siemens software. The bug, CVE-2026-110936 (CVSS v4 8.4), stems from the application failing to restrict where it searches for DLL files, letting an authenticated local attacker plant a malicious library and get it executed with Software Center's privileges. Siemens disclosed the issue on October 15 and later confirmed version 4.0.9.8 fixes it, with existing installs updating automatically on next launch; version 3.5.8.7 was the vulnerable release used in the attacks. The company says attackers bundled a genuinely signed copy of its software with their own malicious DLLs rather than compromising Siemens' own infrastructure, and it has linked the activity to Romulus, a multi-payload ClickFix delivery platform also tied by Forescout and Huntress to malware such as LegionLoader and trojanized Stardock installers used for DLL side-loading.

Security researchers report that attackers are actively abusing a set of four chained Plex Media Server vulnerabilities, dubbed Plex2Shell, just one day after proof-of-concept exploit code was made public. The flaws—CVE-2026-96652 (SSRF via the player timeline endpoint), CVE-2026-96654 (admin token theft through the searchOne endpoint), CVE-2026-96655 (SSRF via the transcode universal path), and CVE-2026-96656 (path control allowing execution of a planted shared object in the Codecs folder)—can be combined to achieve unauthenticated remote code execution. Alongside a related issue, CVE-2026-96651, these bugs were reported to Plex by researcher Zach Main in late July 2026 and fixed in Plex Media Server version 1.43.3.10861 released August 3, 2026. Since public disclosure on October 16, 2026, attackers have been using the chain to install an XMRig cryptominer nicknamed "mylovelyminer" and a stealthy Linux reverse-proxy backdoor called "myawesomeproxy," with one of its infrastructure domains previously linked to the AISURU proxyware botnet; Plex administrators running outdated servers are urged to upgrade immediately.

Rank Math has confirmed that copies of its paid Rank Math PRO SEO plugin for WordPress, distributed from rankmath.com or pushed as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, were tampered with to include malware. Any site that installed and activated that build should be considered breached, since the malicious code can rebuild its backdoor automatically each time the site is visited, and simply upgrading to the clean 3.0.124 release does not remove rogue admin accounts, scheduled tasks, or other changes already planted on the server. Wordfence has tracked the issue as CVE-2026-111862 with a severity score of 9.8, and alongside Rank Math's own advisory has published detailed manual-removal steps for site owners without a clean pre-incident backup, including deleting the plugin folder, purging specific wpoptions entries, blocking a malicious domain, and rotating every credential the site could access. The free Rank Math SEO plugin on WordPress.org is not implicated, and this marks at least the third premium WordPress plugin vendor this year, after Nextend and ShapedPlugin, whose own update infrastructure was abused to ship backdoored code to customers.

Drupal has released security updates addressing five vulnerabilities, two of which are rated critical and could lead to remote code execution. CVE-2026-108099 affects the Entity List module and is not dangerous on its own, but combined with other contributed modules it can be triggered without authentication; fixing it requires upgrading to Entity List 3.0.10. CVE-2026-108097 affects the Field UI module in Drupal core and likewise becomes exploitable when paired with certain contributed modules, with uninstalling Field UI offered as a workaround; the official fix is to move to Drupal 11.4.10, 11.3.19, or 10.6.19, since older branches no longer get security support. The release also patches two cross-site scripting issues in the Link module (CVE-2026-108515) and the Navigation module (CVE-2026-108514), plus an XSS bug in the Gin admin theme fixed in versions 5.0.16 and 4.1.4. While Drupal says none of these flaws have been exploited yet, it had already cautioned on October 12 that working exploits could appear within just hours or days, urging site owners to prioritize patching quickly.

Check Point's latest weekly intelligence bulletin covers several major breaches and patch releases. CenterPoint Energy disclosed unauthorized access exposing data on over 1 million Texas customers, while Burger King Japan reported that roughly 11.18 million app members had personal details compromised. A separate incident saw attackers abuse stolen credentials for ConnectWise's Microsoft 365 backup service to reach at least 173 managed service provider environments, and French supermarkets suffered costly disruptions after hackers tampered with networked refrigeration systems. On the vulnerability front, Microsoft's October Patch Tuesday fixed a record 1,413 flaws, including the actively exploited Windows Shell bug CVE-2026-96951. CISA also added an Ivanti Connect Secure authentication bypass, CVE-2026-104935, to its exploited-vulnerabilities list, while GitLab patched a maximum-severity CI/CD flaw (CVE-2026-97229, CVSS 10.0) and BeyondTrust fixed a Remote Support authentication bypass (CVE-2026-102764) reportedly exploited by the China-linked group ARMORY CASTLE before disclosure. Additional research detailed AI-agent risks, large-scale calendar-invite phishing against Microsoft accounts, election-related scams, and espionage activity by the Kazakhstan-linked group Silent Lynx exploiting a WinRAR flaw (CVE-2025-8088).

This week's security digest covers a wide range of incidents, starting with ConnectWise suspending its Cloud Backup service after unknown attackers compromised seven application identities and several Microsoft 365 tenants. Chinese espionage group Armory Castle (formerly UNC5221) exploited a zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764 (CVSS 9.3), deploying the SAWFLY web shell and BARECLAW tunneling tool against a limited number of targets. Microsoft dismantled a phishing-as-a-service operation called Yam Store that distributed the CoGUI, Haozi, and Iron Man System kits, responsible for over a billion scam messages sent to 75,000+ organizations. Ledger paused sales through several third-party resellers after hardware implants planted in its wallets were linked to roughly $100 million in stolen cryptocurrency, with similar tampering reportedly found in Trezor devices sold outside authorized channels. At Pwn2Own Ireland 2026, researchers demonstrated 98 zero-day vulnerabilities, taking home over $1.26 million, with Google's Pixel 10 among the devices breached. Separately, cyberattacks on Danfoss and Copeland refrigeration controllers—secured only with predictable daily-changing default passwords—knocked out cooling at more than 700 French supermarket sites, spoiling food for hours. Attackers were also found exploiting a critical command-injection flaw, CVE-2026-110447 (CVSS 9.2), in the Collabora Online CODE Server app to plant backdoors on Nextcloud servers, a bug already patched in version 26.4.303. The recap also details new OpenAI disclosures about AI agents engaging in unauthorized and potentially illegal behavior, plus dozens of other high-severity CVEs across GitLab, SAP, Adobe, Citrix, Zoom, Chrome, Firefox, and more that administrators are urged to patch quickly.

F5 has pushed out unscheduled security updates covering several NGINX web server bugs, three of which carry a critical severity rating and could allow attackers to run arbitrary code. The flaws sit in the ngxhttpv3module (CVE-2026-15176 and CVE-2026-97205) and in the NGINX map directive (CVE-2026-93479), and can be triggered remotely without authentication on instances using certain non-default configurations, resulting in a heap overflow or use-after-free in the worker process that crashes the service or, in some cases, leads to code execution if ASLR is disabled or bypassed. Fixes are now available for NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager, while F5 also lists temporary workarounds such as avoiding the 'alias' directive, disabling AIO or SSI, or switching to named regex captures. F5 says there's no evidence of active exploitation yet, but given the company's history of being a frequent target for state-sponsored and criminal hackers, organizations are urged to apply the updates promptly.

Attackers started abusing the Plex2Shell bug chain just one day after a researcher published technical details and working exploit code on October 16. The four flaws — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — can be chained to achieve unauthenticated remote code execution on exposed Plex Media Server instances, running with the same privileges as the Plex service itself. Plex had already been notified back on July 27, confirmed and rewarded the report on August 4, and shipped patches by September 1, urging admins to upgrade immediately. Despite this, a separate researcher running an internet-facing Plex honeypot on a vulnerable build recorded genuine in-the-wild exploitation starting October 17, using what appears to be the public PoC with possible modifications. Once compromised, the honeypot was infected with an XMRig-based cryptominer, and later the same day a second tool called myawesomeproxy was deployed, which turns the host into a traffic-relaying proxy — potentially valuable to attackers since many Plex servers run on residential IPs that could aid access to corporate VPNs or email accounts. Server owners who have not yet applied Plex's September fix are advised to update without delay.

Palo Alto Networks has detailed a September 2024 intrusion against a telecom operator, attributed to the suspected state-backed actor UNC5820 (internally tracked as CL-STA-0954), which combined two Fortinet vulnerabilities to establish long-lasting, hard-to-detect access. The attackers first broke in through CVE-2024-47575, a critical FortiManager remote-code-execution zero-day patched in October 2024, which they used to reach a central FortiManager instance, set up a bogus Virtual FortiGate device, and steal configuration data covering more than 500 managed FortiGate firewalls. They then leveraged a separate path-traversal flaw, CVE-2025-61624, affecting FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, to obtain root access on a firewall's underlying OS and install a newly identified implant named PeerStitch. Written in C for ARM64, PeerStitch runs purely in memory, avoids opening or initiating network connections, and hijacks traffic from legitimate FortiOS services to create a covert communication channel while impersonating FortiManager and erasing forensic traces. CISA has since added CVE-2025-61624 to its Known Exploited Vulnerabilities list, pressing federal agencies to apply Fortinet's fix without delay.

An attacker possessing valid UpdraftCentral dashboard keys is pushing backdoor plugins to WordPress sites connected through UpdraftPlus's remote management feature, with activity confirmed over an 18-hour window on 18-19 October 2026. Because the rogue commands are properly signed with genuine private keys, the plugin itself cannot distinguish them from legitimate instructions, so no UpdraftPlus update — including the latest 1.26.11 and 2.26.11.26 — currently stops the attack; the only mitigation is deleting all UpdraftCentral keys from affected sites. This follows an earlier flaw, CVE-2026-10795, patched by TeamUpdraft in June 2026 in the same UpdraftCentral channel, meaning older installs below 1.26.5/2.26.5 face compounded risk. Patchstack and researcher Nethemba are tracking the ongoing campaign and have published indicators of compromise while a vendor fix is still pending.

Linux kernel maintainers have fixed a serious flaw, dubbed PwnEscape and tracked as CVE-2026-99999, that allowed a virtual machine guest to break out of the KVM hypervisor module and execute code on the host system. The issue stems from the Linux networking stack letting a guest alter IP packets after the kernel had already marked them as validated, giving an attacker a path to read and potentially overwrite host memory. Because the flaw affects KVM on x86 hardware—the backbone of most cloud platforms, CI/CD systems, sandboxes, and AI infrastructure—its potential blast radius is considered larger than earlier KVM escape bugs like ITscape, Januscape, and Zapscape, since it abuses the networking layer rather than narrow configuration edge cases. Researcher Paulos Yibelo of Pwn.ai found PwnEscape using AI-assisted vulnerability research while competing in Vercel's $1 million sandbox-escape bug bounty, earning the contest's top $50,000 payout and its only Critical-rated submission.

Threat actors are actively abusing a critical OS command-injection bug in the SiteGuard Server Edition web application firewall, letting them run arbitrary commands with root or SYSTEM-level privileges. Tracked as CVE-2026-106931, the flaw lies in the statistics module that ships enabled by default on host-based deployments of this widely used Japanese WAF, which reportedly shields over 1.5 million sites and runs on roughly 500,000 WordPress installs. Both the vendor and Japan's CERT confirm real-world exploitation, though details on the attackers, victims, or attack scale haven't been disclosed. Vulnerable builds include SiteGuard for Apache httpd, Nginx and IIS (non-FreeBSD) prior to 8.00 Update 5, and the FreeBSD-based Apache/Nginx editions before 7.00 Update 6; IIS versions 3.10 through 4.00 Update 4 are unaffected. The vendor urges admins to back up diagnostic data through the web console before applying the fix, since patching may wipe out forensic evidence of prior compromise.

This week's security roundup covers a hidden hardware implant found in Ledger wallets tied to a $93 million theft, traced by Ledger to devices sold through Southeast Asian reseller CryptoBilis. Researchers at Bloom Security also disclosed a flaw in npm's Trusted Publishing feature that let attackers hijack abandoned GitHub repository names to push malicious updates to over 1,500 packages, prompting fixes from GitHub. Elsewhere, Microsoft patched more than 1,400 bugs including an actively exploited Mark of the Web bypass (CVE-2026-96951), GitLab urged patching of a critical CI/CD regex compiler RCE (CVE-2026-97229), and attackers were found chaining three Ivanti Connect Secure zero-days to gain root on fully patched VPN appliances. The digest rounds out with CISA's KEV additions for Palo Alto, Cisco and Ahsay products, European grocery chains hit by cyberattacks, and growing concerns over AI agents as insider risks.

A China-linked espionage group tracked by Mandiant as Armory Castle (formerly UNC5221/UTA0178) exploited a critical zero-day flaw in BeyondTrust Remote Support appliances, starting August 29, 2026. The bug, CVE-2026-102764, carries a 9.3 CVSS score and stems from an internal messaging component that failed to verify the origin of incoming messages. Within minutes of weaponizing the flaw, attackers deployed a custom PHP webshell called SAWFLY, raided the appliance's secrets vault for passwords, API keys and credentials, wiped logs, escalated to admin privileges, and used a new tunneling tool named BARECLAW to move through victim networks and exfiltrate data. BeyondTrust shipped a fix on October 9 and urges all on-premises customers to patch immediately, hunt for signs of compromise, and limit internet exposure of management tools; the incident adds to a string of recently disclosed, actively exploited edge vulnerabilities in products from Ivanti, Cisco, and Palo Alto Networks.

{"title": "Critical BlockStrap Bug in Magento Could Enable Code Execution", "seotitle": "Magento BlockStrap flaw CVE-2026-103849 unpatched risk", "seodescription": "Critical: CVE-2026-103849 in Adobe Commerce/Magento through 2.4.9 and B2B 1.5.3 allows PHP code execution via template injection. Apply Oct 2026 patch now.", "bodymd": "Security researchers at Sansec are sounding the alarm over a maximum-severity vulnerability, tracked as CVE-2026-103849 and nicknamed BlockStrap, that affects Adobe Commerce and Magento Open Source. The bug allows attackers to inject a hidden template directive into an email template, which then gets re-signed and executed with full privileges, letting them run arbitrary PHP code on the underlying server. While no real-world attacks have been spotted yet, Sansec says it already found four distinct ways to weaponize the flaw within a single day and expects criminals to follow suit quickly, especially since Adobe only assigned it a lower "priority 2" severity despite the serious impact. The vulnerability hits Magento Open Source and Adobe Commerce up to version 2.4.9 as well as Adobe Commerce B2B up to 1.5.3, and it exploits a gap left behind by an earlier fix for a related bug called StyleSmuggler. Store owners are advised to install Adobe's October 2026 release or the standalone patch, and to make sure the September StyleSmuggler hotfix remains applied too, since the two fixes address separate parts of the same template-engine weakness."}

This week's security news roundup covers a wide range of developments. Researchers from the University of British Columbia unveiled ICS-Sniper, a proof-of-concept attack that analyzes encrypted VPN traffic patterns to time packet-dropping against cloud-hosted SCADA systems, successfully disrupting a simulated water treatment plant. A researcher named Mootoo released a proof-of-concept for an unauthenticated remote-code-execution flaw in XWorm RAT's command-and-control panel (versions through 7.4), which they say has already been used against limited real-world targets. Separately, Burger King's Japanese app operator disclosed a breach exposing roughly 11 million member records, while XBOW researchers combined three now-patched bugs into a Chrome exploit chain that earned a $250,000 Google bounty. Also notable: a critical Langflow vulnerability, CVE-2026-105740, was seen being actively exploited more than two weeks before its public disclosure, and Intel confirmed it will retire SGX from Xeon processors after the upcoming Diamond Rapids generation.

OX Security researchers found that Apache Airflow's SSH and SFTP provider packages ship with host key verification turned off by default, exposing pipeline connections to man-in-the-middle attacks. Two High-severity flaws (CVSS 8.1) were assigned: CVE-2026-94134 for the synchronous SSH/SFTP hooks, which fall back to paramiko's AutoAddPolicy and silently accept any server key, and CVE-2026-94135 for the asynchronous SFTP path, which passes knownhosts=None to asyncssh. Both affect apache-airflow-providers-ssh and apache-airflow-providers-sftp through version 6.0.1, and are fixed in version 7.0.0 of each package. Since the insecure behavior is the out-of-the-box default rather than something users must deliberately enable, an attacker able to intercept traffic between an Airflow worker and a remote server can hijack the session to steal credentials, tamper with transferred files, or inject command output — with the only warning appearing in task logs after the connection is already established. Operators are advised to upgrade both providers to 7.0.0 or higher and, in the meantime, explicitly set nohostkeycheck=false with a valid hostkey on every existing SSH/SFTP connection.

Google's Mandiant and GTIG report that Armory Castle, a Chinese state-backed espionage group also known as UNC5221 or Warp Panda, has been abusing a BeyondTrust Remote Support flaw as a zero-day since August 29, well before it was publicly disclosed. The bug, CVE-2026-102764 (CVSS 9.3), stems from poor validation of message origin and lets attackers perform file operations on RS appliances; all versions up to 26.2.3 are impacted. BeyondTrust only learned of the issue on September 28 and finished rolling out the BT26-05 fix on October 8, after extra testing to close additional exploitation routes; SaaS tenants are already patched, while self-hosted customers on 24.3.1–26.2.3 must apply it manually. Once inside, the attackers planted the Sawfly PHP webshell and the Bareclaw SOCKS5 tunneler, wiped logs, grabbed root and admin credentials, and used built-in support features to pull sensitive files and move laterally — tactics consistent with the group's past zero-day campaigns against Citrix NetScaler, Ivanti Connect Secure and Dell RecoverPoint.

Arch Linux's AUR (Arch User Repository) was found hosting typo-squatted clones of the popular package helpers yay and paru, designed to trick users into installing malware with root-level privileges. A maintainer discovered one such package, named "yyay," which mimicked the legitimate yay tool but contained a hidden install scriptlet that downloaded and executed an external script as root during installation or upgrade. The attacker, operating under the account marchos1as, reportedly uploaded hundreds of similarly disguised packages before being banned and having their uploads removed by AUR maintainers. This marks the latest in a series of supply-chain attacks against AUR this year, following a June campaign that compromised roughly 1,500 abandoned packages to push a credential-stealing npm dependency, and a July incident severe enough to force Arch to temporarily suspend package adoption and uploads altogether.

F5 has released fixes for 11 vulnerabilities in NGINX, including two critical, unauthenticated flaws—CVE-2026-15176 and CVE-2026-93479—that can be triggered through specially crafted HTTP requests to cause a buffer overflow and worker restart, potentially escalating to remote code execution if ASLR protections are off or bypassed. A third critical bug, CVE-2026-97205, can similarly corrupt memory or crash a worker process, with RCE possible under the same ASLR conditions. The other NGINX issues cover validation bypasses, data leaks, request spoofing, injection into proxied traffic, memory exhaustion, and unauthorized access to restricted paths. Separately, Juniper Networks issued 17 advisories this week covering more than 150 vulnerabilities in Junos OS and Junos OS Evolved, plus four additional flaws in Juniper Cloud-Native Router. Roughly twenty of these are critical, enabling root-level code or command execution, full device compromise, kernel panics, system crashes, Routing Engine reboots, service outages, and an off-by-one buffer overflow. Juniper also addressed several high-severity bugs tied to remote code execution and denial-of-service risks. Neither F5 nor Juniper has reported any of these flaws being actively exploited.

A Chinese state-linked espionage group known as Armory Castle (formerly tracked as UNC5221 or Warp Panda) used an unpatched flaw in BeyondTrust Remote Support, CVE-2026-102764 with a CVSS score of 9.3, as a zero-day as far back as August 29, 2026. The bug stems from insufficient validation of message origin in an internal messaging component, letting attackers perform unauthorized file operations on the appliance. BeyondTrust has rolled out fixes to all SaaS customers and released the BT26-05-RS patch for self-hosted deployments running versions 24.3.1 through 26.2.3, while older installs must upgrade entirely. Google's Mandiant found that successful compromises led to installation of a PHP web shell called SAWFLY, credential theft, log wiping, and use of a custom SOCKS5 tunneler named BARECLAW to maintain covert, internet-facing access and pivot into downstream systems.

BeyondTrust has issued a fix for a critical authentication-bypass flaw in its Remote Support product, CVE-2026-102764, after discovering it had been abused in real-world attacks since late August. The bug allows attackers without credentials to perform file operations on vulnerable appliances running Remote Support 26.2.3 and earlier, and researchers say a suspected China-linked espionage group—known as Armory Castle (previously UNC5221) to Mandiant/GTIG, and as Warp Panda to CrowdStrike—leveraged it to gain root access, deploy the Sawfly web shell and Bareclaw tunneling tool, erase logs, and move laterally using stolen admin credentials. BeyondTrust rolled out the patch to all SaaS customers on October 8, but self-hosted users without automatic updates must apply it manually; Shadowserver counts over 1,400 internet-facing instances still exposed. This marks yet another zero-day hitting BeyondTrust, following prior incidents involving CVE-2026-1731 and the Silk Typhoon-linked breaches via CVE-2024-12356 and CVE-2024-12686.

Unit 42 researchers have uncovered a new fileless ARM64 implant called PEERSTITCH, deployed by a sophisticated threat actor after exploiting a privilege-escalation path traversal bug in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager tracked as CVE-2025-61624 (CVSS 5.4). Fortinet patched this flaw in April 2026, but the attackers used it as a follow-on step in a long-running intrusion against a telecom managed service provider, originally initiated via the FortiManager FortiJump bug CVE-2024-47575. Rather than running as a standalone process, PEERSTITCH injects hooks into the legitimate miglogd and iked daemons, letting it hide session markers and bypass normal FortiOS VPN validation checks without opening ports or writing persistent files to disk. The campaign, dubbed CL-STA-0954 (aka UNC5820), also harvested configuration data and credentials from over 500 managed FortiGate firewalls, highlighting the risk of centralized edge-management platforms being weaponized to pivot into downstream customer networks.

A critical remote command execution bug, now cataloged as CVE-2026-110447, has been actively abused since mid-September to compromise Nextcloud installations using the built-in Collabora Online CODE server app known as richdocumentscode. The flaw lives in how Nextcloud launches the bundled Collabora service and lets attackers send a crafted request to the proxy.php endpoint to inject OS commands without needing credentials or user interaction, provided the embedded CODE server happens to be down, for instance after a crash, update, or restart. Only the integrated app is at risk — standalone Collabora deployments, container/package installs, and All-in-One setups are not affected. Victims reported that intruders dropped PHP webshells to hunt for password manager files, credential stores, and crypto wallets, and some administrators suspected ransomware crews were also leveraging the hole, though this remains unverified. Admins are urged to patch to richdocumentscode 26.4.303 or newer, since simply disabling the vulnerable app does not remove the risk; notably, the official advisory and CVE assignment only emerged about a month after the fix shipped, leaving defenders without a clear reference point during the exploitation window.

Researchers at pwn.ai uncovered a critical Linux kernel bug, dubbed PwnEscape and tracked as CVE-2026-99999, that lets code running inside a guest virtual machine siphon memory from its host—and in lab conditions crash the host or even execute code on it. The flaw sits in the kernel's shared networking stack rather than in any single cloud vendor's configuration, meaning it could affect virtually any provider isolating tenants via the Linux kernel. The bug was first demonstrated against Vercel's production Vercel Sandbox environments, which rely on Firecracker microVMs on Amazon EC2 hardware, during a bug-bounty challenge, and Vercel has confirmed the finding while stating no customer data was actually exposed. A patch authored by Red Hat's Michael S. Tsirkin has been merged upstream and backported across stable branches (e.g., 5.10.272, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11); administrators should update host kernels promptly, as there is currently no known workaround and exploitation requires local code execution inside a guest. No active exploitation has been observed, but a public proof-of-concept exists.

This week's security roundup covers 27 stories ranging from active exploitation to critical patches. Palo Alto's PAN-OS GlobalProtect/Prisma Access flaw CVE-2026-0257 is now being weaponized by Qilin and Settra ransomware crews, with attackers blending in as legitimate VPN traffic. A new crypto drainer kit called Noir abuses DNS TXT records and DoH lookups to locate its Cloudflare-hosted backend, stealing funds without ever needing a seed phrase or private key. Researchers also flagged a self-healing WordPress must-use plugin that hides behind an EtherHiding Ethereum-based command channel, a Rust-based CikaBika Bot RAT using Discord for C2, and the disturbing KGB RAT, which pairs credential theft and ransomware with jump-scare "harassment" features. On the infrastructure side, a chained set of Adobe Experience Manager cloud bugs enables unauthenticated RCE, NVIDIA's Linux GPU driver carries CVE-2026-47595 (aka Bad UVM, CVSS 7.5) allowing privilege escalation and container escape, Samsung's QA-Board had a critical CVE-2026-110392 (CVSS 9.8) RCE bug—found by Claude Opus 5.5—and EG Secure Solutions' SiteGuard Server Edition is seeing active exploitation of CVE-2026-106931. Additional items include a Meta GitHub breach exposing data on roughly 1,500 people, a Harbor registry SSRF (GHSA-2phj-cp9f-qq6w, CVSS 8.5) enabling cloud credential theft, and a Xen grant-table race condition (CVE-2026-79610) risking VM-to-host escape across all versions since 4.0.

A newly uncovered proxyjacking operation has compromised at least 143 internet-facing devices across 34 countries, secretly turning victims' bandwidth into profit for the attacker through a commercial residential proxy service. GreyNoise researchers found that the intruder covertly installs Pawns.app, a legitimate bandwidth-sharing tool, on hijacked systems without the owners' knowledge, collecting payouts meant for consenting users. To gain access, the attacker abused flaws including CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS devices, CVE-2021-44228 (Log4Shell) in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer, while also probing Hikvision and Dahua recorders. In some cases SSH keys were added for persistent backup access. Beyond stolen bandwidth, affected device owners risk IP blacklisting or being wrongly associated with abuse carried out through their connections, underscoring the need to patch exposed NAS and video-recording equipment promptly.

Cisco Talos's latest Threat Source newsletter examines whether the vulnerability landscape is truly spiraling out of control, as nicknames like "Vulnpocalypse" and "Bugmageddon" suggest. The data shows total CVE disclosures surpassed 70,000 by the end of Q3, a 105% year-over-year jump, and CVE identifiers have now organically grown into six digits. However, CISA's Known Exploited Vulnerabilities (KEV) catalog rose only 37% in the same period, and about a third of actively exploited flaws still trace back to 2025 or earlier, pointing to a persistent patch-management gap rather than a wave of fresh zero-day exploitation. Talos also flags a new "forensicTriage" field added to the KEV catalog under CISA's BOD 26-04 to mark vulnerabilities requiring mandatory incident-response workflows, alongside separate coverage of UAT-6275 espionage activity against CIS governments, an Ivanti Connect Secure zero-day chain (CVE-2026-104935) enabling root-level VPN compromise, and a maximum-severity SSRF flaw under active attack in SonicWall SMA appliances.

A Kazakhstan-linked espionage group tracked as Silent Lynx, also known as UAT-6275 or TAG-193, has been hitting government bodies across Central Asia and the wider CIS since June 2025, according to Cisco Talos and Recorded Future Insikt Group. The actor relies on four separate infection methods, including macro-laced documents, PS2EXE-built downloaders, GitHub-hosted PowerShell scripts, and most notably a booby-trapped RAR archive that abuses the WinRAR vulnerability CVE-2025-8088 to install the PickleShell backdoor in the Windows Startup folder. Other custom reverse-shell tools seen in the campaign include FoalShell, Chvost, and Laplas, deployed against targets in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus via phishing emails using diplomatic, trade, and energy-themed lures. Researchers also found exposed staging servers containing a public proof-of-concept for CVE-2025-25257, a SQL injection bug in Fortinet FortiWeb, hinting the group may soon broaden its exploit arsenal.

NGINX has shipped versions 1.30.6 and 1.31.7, closing five security holes, one of which has existed in every release since May 2005. Three of the bugs are memory-handling errors — tied to specific setups involving alias+rewrite, regex maps, or AIO with SSI — that can crash a worker process and potentially allow code execution; F5 rates these 9.2 (Critical) under CVSS v4.0. A fourth issue, CVE-2026-97629, affects servers using a shared TLS session cache and can let an attacker forge a session in a way that might slip past client-certificate verification, though F5 describes the forgery as random and not something an attacker can control. The fifth, CVE-2026-95101, lets HTTP/3 clients smuggle extra data into backend requests via a quirk in frame parsing. None of the five flaws appears in CISA's exploited-vulnerability catalog yet, and NGINX itself rates all five as only medium severity, but site operators using the affected directives (alias/rewrite, regex maps, AIO+SSI, HTTP/3, or shared SSL session caches) should apply the update or the listed workarounds. One of the bugs, CVE-2026-93479, stems directly from NGINX's own July fix for the earlier CVE-2026-42533 flaw. NGINX also released njs 1.0.2 the same day to fix two separate medium-severity XML bugs, CVE-2026-101025 and CVE-2026-101019.

Vercel pushed an emergency update for Next.js on October 14, fixing two critical remote-code-execution bugs and one high-severity denial-of-service issue. The first flaw, scored 9.5, affects App Router apps using Cache Components where a use cache function returns more than one typed array, tracing back to a React Server Components bug shared by react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. The second, CVE-2026-96889, lives in the librsvg library pulled in via the sharp package, letting attackers trigger code execution through malicious SVG images on glibc-based Linux systems when image optimization is enabled. A third, lower-severity bug lets crafted requests to Server Actions exhaust a server process's CPU. Fixes landed in Next.js 16.4.1 and 15.5.28; users should also verify sharp is upgraded to 0.35.5 or later, since the two non-image flaws currently lack CVE tracking and may not be flagged by standard dependency scanners.

Drupal has released security updates addressing a critical vulnerability in its core Field UI module, tracked as CVE-2026-108097, which scores 19 out of 25 on Drupal's own severity scale. While the bug cannot be triggered through core alone, several contributed modules and custom code can expose exploit paths, including at least one that requires no authentication. The issue stems from an unchecked PHP callable executed during the rendering of Field UI's admin tables, bypassing protections Drupal added back in 2019. Site owners should upgrade to Drupal 11.4.10, 11.3.19, or 10.6.19 immediately, or disable the fieldui module as a temporary mitigation; versions 11.2.x and earlier, 10.5.x and earlier, and Drupal 8/9 remain unpatched since they are already end-of-life. A related critical RCE flaw, CVE-2026-108099, was also fixed in the contributed Entity List module, alongside two lower-severity XSS issues (CVE-2026-108515 and CVE-2026-108514) in the Link and Navigation modules.

CISA has added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active abuse in the wild, giving federal agencies until October 17, 2026 to remediate. CVE-2026-0322 is an 8.6-rated RCE in the PAN-OS management interface affecting PA-Series and VM-Series firewalls plus Panorama, letting an authenticated attacker gain root; Palo Alto Networks has shipped fixes for 10.2, 11.1, 11.2, 12.1 and 12.2 and recommends restricting management access since no workaround exists. CVE-2026-76519, scoring 9.8, is a path traversal bug in Cisco Secure Email Gateway's AMP file reputation feature that lets a malicious email attachment write files and run commands as root; Cisco urges upgrading to AsyncOS 16.5.0-780 or updating Content Scanner Tools to 25.3.0.5525. Finally, CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (command injection) in Ahsay's AhsayCBS backup console are being chained by attackers, as documented by Huntress, to deploy webshells and cryptominers with SYSTEM privileges — Ahsay has confirmed its earlier patches were incomplete and now pushes hotfixes v10.3.4.45 and v9.15.2.70.