This brief covers October 17–19, 2026. It is a quieter window, and items are drawn from vendor and researcher primary sources, with outlet reporting linked alongside.

ConnectWise disables application identities after Microsoft 365 tenants compromised

ConnectWise · October 17, 2026

Unknown actors obtained unauthorized access to ConnectWise application identities and used them to sign in to customer Microsoft 365 tenants. ConnectWise says it first identified the issue on October 14, disabled seven application identities at 07:00 UTC on October 17, suspended Cloud Backup by revoking certificates, and took SaaS Security and Cloud Management offline. Huntress observed sign-in activity from the associated IP address against almost 1,000 Entra tenants, about 300 of them successful. Disabling the connections blocks new authentication but does not undo changes already made inside a tenant. No CVE has been assigned, and ConnectWise says it is not yet clear whether a product vulnerability contributed.

“Since implementing these mitigations, we have not observed successful threat activity in the environments we monitor.”
— ConnectWise advisory update, as quoted by The Hacker News

Source: The Hacker News · BleepingComputer · ConnectWise status page

OpenCode Console breach may have exposed customers’ OpenAI, Anthropic and Google API keys

OpenCode · October 17, 2026

An intruder reached a legacy system in OpenCode’s hosted Console, where workspaces store their own third-party provider keys. OpenCode emailed affected users on October 17; it says keys “may have been exposed” for about 1.4% of Console users and has not confirmed any were copied. Keys stored locally by the CLI and desktop apps are reportedly not affected. Some users report unauthorized provider charges, but those are individual claims. No CVE applies. Anyone with a provider key saved in the Console should rotate it. Vendor wording is as relayed by The Hacker News; the original X posts were not independently retrieved.

“Action Required: Potential provider key breach.”
— OpenCode notification email subject, as reported by The Hacker News

Source: The Hacker News · OpenCode on X

Still developing

SiteGuard Server Edition WAF command injection exploited in the wild (CVE-2026-106931)

JPCERT/CC (JVN) · October 14, 2026 · widely reported October 18

OS command injection (CWE-78) in SiteGuard Server Edition 2.20 and later, when the statistics function is enabled (the default). JVN scores it CVSS v4.0 8.5 and v3.0 7.8 and states exploitation in the wild has been confirmed; successful abuse runs commands as root or SYSTEM. Fixed in 8.00 Update 5 (Apache, Nginx, IIS) and 7.00 Update 6 (FreeBSD), with a file-replacement patch for versions that cannot be upgraded. The vendor advises downloading diagnostic information before patching, since remediation can erase attack traces. No KEV entry was confirmed in the sources reviewed.

“Abuse has already been confirmed.”
— SiteGuard vendor alert, as quoted by BleepingComputer

Source: JVN · SiteGuard alert · BleepingComputer

Drupal core and Entity List RCE flaws patched; exploits expected soon (CVE-2026-108097, CVE-2026-108099)

Drupal Security Team · October 14, 2026 · reported October 17

SA-CORE-2026-014 (CVE-2026-108097) is rated “Critical 19/25” by Drupal and affects core 8.9.0 through releases before 10.6.19, 11.3.19 and 11.4.10, plus Drupal 12 pre-releases before beta2. Drupal says core alone is not directly exploitable but serious exploit paths exist through contributed modules, one requiring no authentication. A companion Entity List module flaw, CVE-2026-108099, is fixed in 3.0.10. Drupal publishes no CVSS score for the core flaw, and no in-the-wild exploitation has been confirmed. Uninstalling the Field UI module is the stopgap if you cannot upgrade.

“At least one known exploit path does not require authentication.”
— Drupal SA-CORE-2026-014

Source: Drupal SA-CORE-2026-014 · SA-CONTRIB-2026-218 · BleepingComputer

Unpatched Broadcom WPS flaw allows root code execution from Wi-Fi range

Quentin Kaiser · October 16, 2026 · reported October 19

A long-standing bug in Broadcom’s proprietary WPS implementation lets an unauthenticated attacker in radio range leak memory and execute code without the network key. Affected chips include BCM3380, BCM3383 and BCM33834 (eCos) and BCM3390, BCM65xx and BCM68xx (Linux). Broadcom would not assign a CVE, none of the devices the researcher tested were patched, and no real-world exploitation has been reported. Replacement of unpatched hardware is the practical mitigation.

“Yet they refused to assign a CVE to this vulnerability or to communicate publicly about it”
— Quentin Kaiser

Source: Quentin Kaiser · The Hacker News

This brief covers the trailing ~48 hours (October 17–19, 2026).

Primary sources:

• JVN (JPCERT/CC) JVN88474777
• SiteGuard vendor alert
• Drupal SA-CORE-2026-014
• Drupal SA-CONTRIB-2026-218
• ConnectWise status page
• Quentin Kaiser research post

This brief covers October 15–17, 2026. Items are drawn from vendor advisories and primary reporting, with dates checked against the source pages. The window was quiet: one new, verified development, followed by a few still-active campaigns.

BeyondTrust discloses Remote Support authentication bypass exploited as a zero-day since August (CVE-2026-102764)

BeyondTrust · October 15, 2026

BeyondTrust published advisory BT26-05 for CVE-2026-102764, a critical (CVSS 9.3) authentication bypass in Remote Support (RS) that lets an unprivileged remote attacker perform file operations on an appliance. RS 26.2.3 and earlier are affected, and Privileged Remote Access shares the code and was patched as a precaution. BeyondTrust says first exploitation was August 29 and was contained September 28; patches shipped October 8 (SaaS and self-hosted). Google’s Mandiant/GTIG attributes the activity to Armory Castle (formerly UNC5221), a suspected China-nexus espionage group. Observed post-exploitation included web shells, a tunneler and log wiping. Shadowserver counts more than 1,400 exposed instances. KEV listing was not confirmed in the sources reviewed.

“We are aware of only a small number of impacted organizations at this time.” — Kelli Vanderlee, Google Threat Intelligence Group, via CyberScoop

Source: BeyondTrust advisory BT26-05 · BleepingComputer · CyberScoop

Still developing

Cisco Secure Email Gateway path traversal exploited for root (CVE-2026-76519)

Cisco · October 14, 2026

CVSS 9.8. A crafted attachment can let an attacker write files and run commands as root when File Reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Cisco says there are no workarounds; fixes are AsyncOS 16.5.0-780 or Content Scanner Tools 25.3.0.5525+. Added to CISA KEV on October 14 (federal deadline October 17).

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco, via SecurityWeek

Source: SecurityWeek · Help Net Security

Palo Alto PAN-OS management interface RCE exploited (CVE-2026-0322)

Palo Alto Networks · October 14, 2026

CVSS 8.6. An authenticated attacker with network access to the management interface can execute code as root on PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are not affected. Fixes are available across supported PAN-OS branches, and there is no full workaround, so restrict management access to trusted internal IPs. Added to KEV October 14.

“Very limited exploitation has been observed targeting the Palo Alto Networks management interface” — Palo Alto Networks advisory, via BleepingComputer

Source: BleepingComputer

Windows Shell Mark-of-the-Web bypass exploited before patch (CVE-2026-96951)

Microsoft · October 13, 2026

CVSS 8.8. A Windows Shell security feature bypass that lets a crafted file evade Mark of the Web protections; exploited as a zero-day and fixed in October Patch Tuesday. Added to KEV October 13 (federal deadline October 16). No public PoC was documented.

Source: SOC Prime analysis · BleepingComputer

This brief covers the trailing ~48 hours (October 15–17, 2026).

Primary sources:

• BeyondTrust security advisories
• CISA KEV alert, October 14
• CISA KEV alert, October 13

This brief covers the trailing ~48 hours ending October 15, 2026. Items are drawn from vendor advisories, CISA alerts and original research, with each CVE traced to its primary source.

Ivanti Connect Secure authentication-bypass zero-day (CVE-2026-104935) exploited in the wild

Ivanti · October 13, 2026

Ivanti disclosed CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure that lets a remote, unauthenticated attacker run arbitrary commands (CVSS 8.6 per Rapid7’s analysis). Volexity tracks the activity as UTA0576, which chained the flaw with other bugs, including a privilege-escalation flaw that remains unpatched, to get root on patched appliances. Fixes are available for the authentication bypass. CISA added it to the KEV catalog on October 13.

“At the time of disclosure, Ivanti is aware of limited exploitation in the wild.” — Ivanti, via BleepingComputer

Source: Ivanti advisory · Canadian Centre for Cyber Security AV26-1035 · BleepingComputer · Rapid7

Cisco Secure Email Gateway path-traversal RCE (CVE-2026-76519) exploited before a fix

Cisco PSIRT · October 14, 2026

A crafted email attachment can write arbitrary files and execute commands as root on Cisco Secure Email Gateway appliances (CVSS 9.8, Critical). Appliances are vulnerable when the File Reputation service is enabled and Content Scanner Tools is older than 25.3.0.5525. No workarounds exist; fixes include AsyncOS 15.5.5-014, AsyncOS 16.5.0-780, or Content Scanner Tools 25.3.0.5525 or later. It is in the CISA KEV catalog (added October 14).

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco Security Advisory

Source: Cisco advisory · Help Net Security

Palo Alto PAN-OS management-interface RCE (CVE-2026-0322) under limited exploitation

Palo Alto Networks · October 14, 2026

CVE-2026-0322 is an authenticated remote code execution flaw in the PAN-OS management interface (CVSS 8.6, High) affecting PA-Series, VM-Series and Panorama; Cloud NGFW and Prisma Access are not affected. Fixed releases exist across the 10.2, 11.1, 11.2, 12.1 and 12.2 branches. There are no workarounds, though restricting management access to trusted internal IPs reduces risk. Help Net Security reports it was added to KEV with the Cisco flaw.

“Very limited exploitation has been observed targeting the Palo Alto Networks management interface.” — Palo Alto Networks advisory

Source: Palo Alto Networks advisory · Help Net Security

Ahsay AhsayCBS authentication bypass and command injection chain added to KEV (CVE-2026-105133, CVE-2026-105134)

CISA · October 14, 2026

CISA added both AhsayCBS flaws to KEV. Attackers chain them, bypassing authentication and then running commands as SYSTEM, and have planted webshells and cryptominers on internet-facing servers. Per Help Net Security, Ahsay acknowledged earlier patches were incomplete; the fixes are the v10.3.4.45 hotfix and v9.15.2.70, followed by a reboot. CVSS scores were not stated in the sources reviewed.

Source: CISA alert · Help Net Security

Microsoft October Patch Tuesday: record volume, one exploited Windows Shell zero-day (CVE-2026-96951)

Microsoft · October 13, 2026

Microsoft’s October release fixed well over 1,400 CVEs, a record, including one actively exploited zero-day: CVE-2026-96951, a Windows Shell security feature bypass that evades Mark of the Web protections (CVSS 8.8 per Lansweeper). Two other flaws were publicly disclosed, including CVE-2026-108398, a .NET Framework WDAC bypass found by Google Project Zero’s James Forshaw. Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 received their final updates.

“If there’s solace to be had, it’s in the fact that only one of these bugs is under active attack.” — Dustin Childs, Zero Day Initiative

Source: CyberScoop · BleepingComputer · Lansweeper

This brief covers the trailing ~48 hours (October 13–15, 2026).

Primary sources:

• Ivanti Security Advisory, CVE-2026-104935
• Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp
• Palo Alto Networks, CVE-2026-0322
• CISA KEV alert, October 14, 2026

This brief covers developments from October 11–13, 2026, drawn from primary advisories and original sources wherever available.

GitLab patches CVSS 10.0 unauthenticated code-execution flaw in CI/CD regex compiler

GitLab · October 12, 2026

GitLab released 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler rated CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It affects self-managed GitLab CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. No in-the-wild exploitation has been reported and the CVE is not reported as a CISA KEV entry; GitLab.com is already patched.

“…could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration…” — GitLab patch release notes

Source: GitLab patch release 19.4.2; BleepingComputer.

Attackers hijack Danfoss refrigeration controllers at French supermarkets

CERT-FR · October 12, 2026

CERT-FR issued alert CERTFR-2026-ALE-012 citing numerous compromises of Danfoss AK-SM and AK-SC devices exposed to the internet. Press reports say the attack began the night of October 11 and forced freezers and fridges into defrost at hundreds of stores. No CVE has been tied to the attack; the entry point is unknown. The AK-SM 800 (end of life since 2021) and AK-SC 355 receive no patches, and Danfoss fixed three earlier AK-SM 800A flaws (CVE-2025-41450/41451/41452) in 2025. CERT-FR advises disconnecting or filtering access and, if compromise is suspected, a factory reset, patching, and rotating all secrets.

“…aware of incidents in France affecting a limited number of refrigeration management systems.” — Danfoss, to Reuters (as reported by The Hacker News)

Source: CERT-FR alert; The Hacker News; BleepingComputer.

Ledger confirms hardware implant in wallets sold via a Southeast Asian reseller

Ledger · October 11, 2026

Ledger confirmed that a device bought through reseller CryptoBilis contained an unauthorized hardware implant, tied to reported crypto thefts. Ledger says a limited number of devices are affected and all confirmed cases came through that reseller. It paused sales via CryptoBilis and advised recent buyers not to set up devices, or to move funds to a new signer with a new seed. Loss estimates (above $86 million, from a pseudonymous analyst) are unverified. No CVE applies.

“…to not initiate set up if you have not done so yet” — Ledger, on X

Source: Ledger statement; The Hacker News; BleepingComputer.

Still developing

SonicWall SMA 1000 CVSS 10.0 SSRF under active exploitation

Previdian / SonicWall · October 9, 2026

CVE-2026-102255 is a pre-authentication SSRF in the SMA1000 Work Place interface (CVSS 10.0). Patched in 12.4.3-03670 and 12.5.0-03082; versions 12.4.3-03526 and 12.5.0-02952 and older are affected. Previdian observed 135 exploitation attempts from two US IPs between October 9 and 10. It is not listed in CISA KEV per Previdian.

“A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface” — SonicWall PSIRT, as quoted by Previdian

Source: Previdian; SonicWall advisory SNWLID-2026-0017; The Hacker News.

Bricksforge WordPress plugin file-upload RCE exploited in the wild

Patchstack · October 8, 2026

CVE-2026-85097 (CVSS 10.0) is an unauthenticated arbitrary file upload in Bricksforge 3.1.8.9 and earlier, fixed in 3.1.8.10. Patchstack first saw exploitation October 7 and recorded 63 unique source IPs, with attackers uploading GIF/PHP polyglots.

“Bricksforge validates a file’s MIME type when it is first uploaded.” — Patchstack

Source: Patchstack; The Hacker News.

This brief covers the trailing ~48 hours (October 11–13, 2026).

Primary sources:

• GitLab patch release 19.4.2
• CERT-FR CERTFR-2026-ALE-012
• Ledger statement
• Previdian CVE-2026-102255
• Patchstack Bricksforge

This brief covers the trailing ~48 hours ending October 12, 2026. It was a quieter window for new advisories, so the items below are drawn from vendor, researcher and company disclosures and checked against primary pages. Active campaigns that began slightly earlier are listed at the end.

Ledger confirms hardware implant in wallets sold by reseller CryptoBilis

Ledger · October 11, 2026

Ledger said an affected device contained an unauthorized hardware implant, and that the incident involves a “limited” number of devices, all sold through the reseller CryptoBilis in Southeast Asia. CryptoBilis has paused sales of its hardware wallet inventory while the investigation continues. Ledger told buyers from this reseller in the last 90 days not to begin setup, and advised anyone who already set up a device to move assets to a new signer with a new seed. Blockchain investigator Specter estimated losses above $86 million (an estimate, not a Ledger figure). No CVE applies; this is a supply-chain tampering case.

“Also, we strongly advise users not to purchase from unauthorized resellers” — Ledger, October 11 update

Source: Ledger update, Oct 11 · Ledger implant disclosure · The Hacker News

Daiichi Kosho: malware at contractor Nippon Columbia exposes about 8.7 million records

Daiichi Kosho / BleepingComputer · October 11, 2026

Japan’s largest karaoke operator, Daiichi Kosho, disclosed that malware on an employee’s computer at its contractor, Nippon Columbia Group, exposed 8,631,000 customer records and 93,000 employee records. Exposed fields include names, genders, dates of birth, email addresses and phone numbers; the company says passwords are not included. NCG reported the infection on October 5 and isolated the system the next day. Data theft has not been confirmed. No CVE or KEV entry applies.

Daiichi Kosho “has not confirmed any data theft or leaks” — as reported by BleepingComputer

Source: BleepingComputer, citing Daiichi Kosho’s website notices

CrowdStrike: attacker used ARTEX AI and Claude agents against South Korean banks

CrowdStrike / BleepingComputer · October 10, 2026

CrowdStrike confirmed that a Chinese-speaking actor used the ARTEX AI penetration-testing suite together with Claude agents in attacks on South Korean financial institutions, including Shinhan Bank, KB Kookmin Bank and Hana Bank. The intrusions exposed client personal and credit card data and caused outages in some cases. CrowdStrike found open directories holding Claude Code session histories and ARTEX configuration files, and saw no clear plan to monetize the stolen data. The ARTEX developer has since closed the source and stopped updates, though derivatives exist. No CVE is involved.

“The threat actor likely accessed DeepSeek via the likely LLM API proxy/reseller xcai[.]pro,” — CrowdStrike, as reported by BleepingComputer

Source: BleepingComputer

Still developing

SonicWall SMA 1000 SSRF (CVE-2026-102255) draws exploitation attempts

SonicWall / Help Net Security · patched October 6–7, 2026; exploitation attempts reported October 8–12

A pre-authentication server-side request forgery in the Appliance Work Place interface affects SMA 1000 models 6210, 7210 and 8200v. It is fixed in hotfixes 12.4.3-03670 and later, and 12.5.0-03082 and later. The Hacker News reports a CVSS of 10.0 and 135 exploitation attempts seen by Previdian; Defused Cyber also reported attempts beginning October 8. It is unknown whether any succeeded, and no KEV listing has been confirmed. SMA 100 Series and SonicWall firewalls are not affected.

Unauthenticated attackers could “direct the appliance to issue requests on their behalf” — SonicWall, via Help Net Security

Source: SonicWall PSIRT SNWLID-2026-0017 · Help Net Security · BleepingComputer · The Hacker News

Bricksforge WordPress plugin file upload (CVE-2026-85097, CVSS 10.0) exploited

Patchstack · October 8, 2026

An unauthenticated arbitrary file upload in Bricksforge versions 3.1.8.9 and earlier allows remote code execution. Patchstack first saw exploitation on October 7 at 21:47 UTC; the fix is version 3.1.8.10. No KEV listing has been confirmed.

“Our telemetry shows active exploitation attempts targeting Bricksforge installations” — Patchstack

Source: Patchstack · The Hacker News

P7 DarkSword: new iOS spyware variant steals crypto-wallet data

iVerify · October 8, 2026

iVerify identified P7 DarkSword during an August investigation of an infected customer device. It leaves a smaller on-device footprint, extracts keychain data, steals crypto-wallet data (including from imToken), and supports two-way command-and-control with a configurable beacon. The iVerify post names no CVEs; module names reference iOS 18.4 through 18.7.

“P7 DarkSword improves on earlier variants in three areas:” — iVerify

Source: iVerify · The Hacker News

This brief covers the trailing ~48 hours (October 10–12, 2026).

Primary sources:

• Ledger (X)
• Daiichi Kosho disclosure via BleepingComputer
• CrowdStrike findings via BleepingComputer
• SonicWall PSIRT
• Patchstack
• iVerify

This brief covers security developments disclosed between October 1 and October 3, 2026. Every item below was checked against its primary source: the vendor advisory, the CISA KEV alert, or the original research.

Fortinet FortiMail zero-day lets unauthenticated attackers write arbitrary files (CVE-2026-104286)

Fortinet PSIRT · October 1, 2026

Fortinet disclosed CVE-2026-104286 (CVSS 9.8), a path traversal and NULL-byte handling flaw in FortiMail. An unauthenticated attacker can use crafted HTTP/HTTPS requests to write arbitrary files on the system, which can lead to code execution. FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9 are affected. The bug is actively exploited and the fixed releases (8.0.2, 7.6.7, 7.4.9) are still listed as “upcoming.” Until they ship, Fortinet’s workaround is to disable IBE or keep the webmail interface off the internet. CISA added it to KEV on October 1 with an October 4 deadline for federal agencies. Fortinet also published IOCs, including the IPs 79.141.169[.]187 and 45.129.0[.]192.

“This has been reported to be exploited in the wild, customers are urged to apply the workaround below.” — Fortinet, FG-IR-26-175

Source: Fortinet FG-IR-26-175 · CISA KEV alert · The Hacker News

Zammad zero-days used in AI-agent breach of DIVD added to KEV (CVE-2026-102489, CVE-2026-102490)

DIVD CSIRT / CISA · October 2, 2026

CISA added two Zammad helpdesk flaws to KEV on October 2. Both were exploited as zero-days in the September 21 breach of the Dutch Institute for Vulnerability Disclosure (DIVD), which DIVD describes as an agentic-AI-driven attack. CVE-2026-102489 (CVSS 9.4) is a session fixation/hijack bug that leads to RCE as the zammad user. It affects Zammad 6.3.0–6.5.4. Versions 7.0.0–7.1.3 contain the bug, but it isn’t exploitable there because of environment conditions. CVE-2026-102490 (CVSS 9.4) is a local privilege escalation to root that affects all versions. Neither flaw had a fix at disclosure. DIVD has published an IOC log-check script.

“We advise all users of Zammad to upgrade to version 7 of Zammad or to take it offline.” — DIVD CSIRT

Source: DIVD-2026-00015 · CISA KEV alert · SecurityWeek

Fortra patches three critical BoKS flaws, including AD service-account auth bypass

Fortra · October 1, 2026

Fortra fixed eight vulnerabilities in Core Privileged Access Manager (BoKS). Three of them are critical:

• CVE-2026-79901 (CVSS 9.9): AD service-account passwords are generated from a predictable sequence seeded with the Unix timestamp, which allows an authentication bypass.
• CVE-2026-79898 (CVSS 9.1): command injection in crlserver that runs as root on the BoKS Master.
• CVE-2026-12627 (CVSS 9.8): a stack overflow in autoregistration.

Patches are available. Fortra has not reported in-the-wild exploitation, and none of the three is in KEV.

“An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.” — Fortra

Source: Fortra product security advisories · SecurityWeek

Still developing

Cisco Catalyst SD-WAN Manager auth bypass exploited as zero-day (CVE-2026-76504)

Cisco PSIRT · September 30, 2026

CVE-2026-76504 (CVSS 9.8) is an API authentication bypass caused by improper URI-encoding handling. It gives unauthenticated attackers admin-level API access to Catalyst SD-WAN Manager. All deployments are affected regardless of configuration, and there is no workaround. Fixes are in 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2 and 20.9.10.1. CVE-2026-76504 is actively exploited and in KEV, with a federal deadline of October 3. Cisco published IOCs for serviceproxy-access.log and vmanage-server.log.

“In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco

Source: Cisco advisory · CISA KEV alert · SecurityWeek

Citrix NetScaler exploitation: post-exploitation payloads create superuser and hide web shells (CVE-2026-88771)

LevelBlue SpiderLabs · October 1, 2026

LevelBlue documented exploitation of CVE-2026-88771 (CVSS 9.5), a pre-auth command injection in NetScaler ADC and Gateway that is already in KEV, across multiple customer environments. In some cases a Perl payload added a “sec_monitor” superuser and exfiltrated /flash/nsconfig. Attackers also planted PHP web shells mapped to URLs that look like CSS resources. Separately, Mandiant/GTIG reported dozens of victims of the companion bug, CVE-2026-88772.

“Taken together, the observed commands demonstrate activity extending beyond basic vulnerability validation.” — LevelBlue

Source: LevelBlue · CISA alert · The Hacker News

Microsoft: Zimbra SNMP command injection was probed before public disclosure (CVE-2026-73570)

Microsoft Threat Intelligence · September 30, 2026

CVE-2026-73570 (CVSS 8.9) is an unauthenticated OS command injection in Zimbra Collaboration Suite. It can be triggered through crafted SMTP traffic when zimbra-snmp is installed and SNMP notifications are enabled. Microsoft says scanning of the vulnerable code path started between the July 20 patch (ZCS 10.1.20) and the August 13 public disclosure. Later attacks deployed JSP web shells, escalated to root and stole credentials. The fix is ZCS 10.1.20 or later.

Source: Microsoft Security Blog · SecurityWeek

This brief covers the trailing ~48 hours (October 1–3, 2026).

Primary sources:

• Fortinet PSIRT FG-IR-26-175
• CISA: Adds One KEV (Oct 1, 2026)
• CISA: Adds Two KEVs (Oct 2, 2026)
• DIVD CSIRT case DIVD-2026-00015
• Fortra product security advisories
• Cisco advisory cisco-sa-sdwan-webauth-xr8beuuU
• LevelBlue SpiderLabs: NetScaler CVE-2026-88771
• Microsoft Security Blog: CVE-2026-73570