Cisco ASA VPN Zero-Day and GitLab CVSS-10 RCE Added to KEV; PHP2Shell–Fragnesia Chain Roots Palo Alto Firewalls; Binance Halts Withdrawals After Suspected Hack

Posted on by

This brief covers the trailing ~48 hours (October 28–30, 2026). Every item below was traced to a primary source — vendor advisory, CISA KEV entry, or the original research — and the dates were confirmed on those pages.

Cisco patches actively exploited ASA/FTD SSL VPN zero-day (CVE-2026-76418); CISA adds it to KEV

Cisco PSIRT · October 28, 2026

Cisco published advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 for CVE-2026-76418 (CVSS 8.6, High), a denial-of-service flaw in the Remote Access SSL VPN service of Secure Firewall ASA and FTD software. An unauthenticated remote attacker can send a crafted request during an SSL VPN connection to force the device to reload; the bug is triggered only when SSL remote access VPN is enabled and secondary authentication is configured on a tunnel group (including DefaultWEBVPNGroup). Fixed releases span ASA 9.16.4.104 through 9.24.10.1 and FTD 7.0.11 through 10.1.1; there is no workaround, though disabling secondary authentication on affected tunnel groups is listed as a mitigation. CISA added the CVE to the Known Exploited Vulnerabilities catalog on October 29.

“In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco Security Advisory

Source: Cisco advisory · CISA KEV alert (Oct 29) · The Hacker News

GitLab CVSS 10.0 RCE (CVE-2026-97229) lands in KEV after attacker targets Alpine Linux’s GitLab

CISA / Alpine Linux · October 29, 2026

CISA’s October 29 KEV update also added CVE-2026-97229 (CVSS 10.0, Critical), a GitLab CE/EE flaw in which insufficient regular-expression validation in CI/CD configuration lets an unauthenticated user execute arbitrary code on the server. GitLab patched it on October 13 in 19.4.2, 19.3.5 and 19.2.8; self-compiled installs must also move to Ruby 3.3.13, 3.4.12 or 4.0.9+, and Ruby 3.2 will not be fixed. Alpine Linux disclosed on October 28 that an attacker began probing gitlab.alpinelinux.org on October 20, crashing worker processes repeatedly, and that its October 22 upgrade to 19.3.6 did not close the hole because the image used standard Ruby. Alpine rebuilt the server, rotated all passwords and secret keys, and is treating the system as compromised even though it found no proof the exploit succeeded.

“A successful exploit would leave no crash and no trace in the web logs.” — Alpine Linux incident post

Source: GitLab patch release · Alpine Linux incident post · CISA KEV alert (Oct 29) · The Hacker News

CISA adds Fragnesia Linux kernel LPE (CVE-2026-46300) to KEV; Palo Alto confirms PHP2Shell exploitation against exposed PAN-OS management interfaces

CISA / Palo Alto Networks / Dream · October 28–29, 2026

CISA added CVE-2026-46300 “Fragnesia” (CVSS 7.8, High), a Linux kernel local privilege-escalation bug in the IPsec ESP modules disclosed in May 2026, to the KEV catalog on October 28 with an unusually short federal remediation deadline of October 31. CISA notes it is being chained with the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2, patched October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) to drop PHP web shells and run commands as root. Palo Alto Networks updated its advisory on October 29 to confirm active exploitation against internet-exposed PAN-OS management interfaces, with fixes across the 10.2, 11.1, 11.2, 12.1 and 12.2 branches (some hotfixes still pending). Israeli firm Dream, whose findings Unit 42 independently verified, reported that a suspected China-nexus actor used a custom PHP2Shell exploit plus Fragnesia to root 25 systems across the US, Japan, Taiwan and South Korea, including firewalls tied to a US government-affiliated organization, then tunneled toward its Active Directory.

“Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet.” — Palo Alto Networks security advisory

Source: Palo Alto Networks advisory · CISA KEV alert (Oct 28) · Ubuntu on Fragnesia · Dream research · The Hacker News

CrowdStrike: China-nexus Warp Panda used low-severity VMware ESXi logging bypass (CVE-2026-41709) as a zero-day; CISA adds it to KEV

CrowdStrike / CISA · October 28, 2026

CrowdStrike’s 2026 Legal Threat Landscape Report, published October 28, disclosed that Warp Panda (also tracked as Clay Typhoon) exploited CVE-2026-41709 as a zero-day in intrusions against US law firms and other organizations as late as early 2026, using it to run ESXi operations without leaving audit-log entries. Broadcom scores the insufficient-logging flaw just 2.7 (Low) and fixed it in July 2026 under VMSA-2026-0006 (ESXi 8.0 U3j, ESXi 9.0.2.0100, ESXi 9.1.0.0, VCF 5.2.4). Despite the low score, CISA added it to the KEV catalog on October 28 with a November 11 federal due date — a reminder that an attacker who already holds admin access values anti-forensics bugs highly.

“the adversary exploited ESXi command logging bypass vulnerability CVE-2026-41709 as a zero-day” — CrowdStrike, 2026 Legal Threat Landscape Report

Source: Broadcom VMSA-2026-0006 · CrowdStrike report · CISA KEV alert (Oct 28) · SecurityWeek

Cisco Talos details KeyDrift, a key-stealing implant planted on SD-WAN controllers via CVE-2026-20127, tied to Volt Typhoon’s “Silent Train” network

Cisco Talos / Lumen Black Lotus Labs · October 28, 2026

Talos published an analysis of KeyDrift, a malware framework deployed by the APT it tracks as UAT-11473 after exploiting CVE-2026-20127 (CVSS 10.0), the Catalyst SD-WAN Controller/Manager/Validator authentication bypass Cisco patched earlier this year and that CISA covered under Emergency Directive 26-03. KeyDrift runs inside control-plane processes, hooks SSL_read to harvest keying material and session metadata, and stages the data encrypted for exfiltration; victims include satellite and space operators, military-aerospace firms and policy research organizations. Talos assesses with high confidence that the infrastructure overlaps with Volt Typhoon’s Silent Train covert access network, which Lumen’s Black Lotus Labs described the same day as a rotating chain of compromised SOHO, IoT and enterprise devices used in at least four zero-day exploitation campaigns. Cisco warns that upgrading does not remove implants already in place.

“Talos assesses with high confidence that the framework is designed to provide long-term persistent access.” — Cisco Talos

Source: Cisco Talos research · Cisco advisory (CVE-2026-20127) · Lumen Black Lotus Labs · The Hacker News

Binance suspends withdrawals after security incident; on-chain estimates of outflows run into the billions

Binance (via TechCrunch) · October 29, 2026

Binance confirmed a security incident on October 29 and temporarily suspended withdrawals on multiple networks after users reported funds draining from its hot wallets. The exchange has not confirmed a hack or a loss figure. Independent on-chain trackers put the outflows at a minimum of roughly $2 billion, with some estimates as high as $5.7–5.8 billion, which would make it the largest crypto theft on record (the 2025 Bybit hack was $1.4 billion). Tether reported freezing about $1.56 billion and Circle about $800 million of funds connected to the movement. The attacker is unidentified and the incident may still be developing.

Binance “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.” — Binance spokesperson Ross O’Leary, to TechCrunch

Source: TechCrunch · BleepingComputer

Still developing

Linux kernel MPTCP use-after-free (CVE-2026-98432, CVSS 9.8) — remote root exploit demonstrated, distro patches uneven

Anthropic / kernel.org · October 27, 2026

Anthropic disclosed CVE-2026-98432, a race-condition use-after-free in the Linux kernel’s multipath TCP handling that an unauthenticated remote attacker can use to leak kernel addresses and ultimately run commands as root on hosts with an MPTCP listener. The kernel CNA scores it 9.8; Red Hat, SUSE and Oracle rate it 8.1 and Amazon 7.0. The bug dates to Linux 4.4 and is fixed upstream in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Oracle Linux, Debian and parts of SUSE and Amazon Linux have shipped fixes; several Ubuntu releases were still in progress and Red Hat had deferred as of October 29. No in-the-wild exploitation has been reported, exploit code has not been published, and the CVE is not in KEV.

“The underlying vulnerability is a race condition-induced UAF bug in the kernel networking stack.” — Anthropic

Source: Anthropic disclosure · CVE record · Ubuntu · Red Hat · The Hacker News

Sony’s So-net ISP discloses breach of ~2.58 million member records, including email passwords and some bank details

Sony Network Communications · October 27, 2026

Sony Network Communications reported that an outside party accessed the So-net membership database starting October 19; the intrusion was detected October 23 and the server was shut down. Exposed data covers 2,141,986 So-net and 443,495 plala (S Course) members — names, phone numbers, email addresses, user IDs, dates of birth, gender and connection IDs — plus 54,401 email-service passwords and 16 bank account records. Sony says membership passwords and credit card data were not involved.

Source: Sony Network Communications notice (PDF) · SecurityWeek

This brief covers the trailing ~48 hours (October 28–30, 2026).

Primary sources:

Leave a Reply