Palo Alto Networks has addressed a high-severity PAN-OS zero-day vulnerability (CVE-2026-0322) said to have been exploited in limited attacks. The flaw affects the management interface and allows authenticated attackers with network access to execute code as root. Affected products include PA-Series and VM-Series firewalls, and Panorama appliances. Cloud NGFW and Prisma Access are not affected.
Cisco has warned that threat actors are exploiting CVE-2026-76519, a critical vulnerability in Cisco Secure Email Gateway that allows unauthenticated attackers to write files to the system through a crafted email attachment and potentially execute commands with root privileges. The vulnerability affects systems with File Reputation enabled and Content Scanner Tools versions older than 25.3.0.5525. Cisco recommends updating Content Scanner Tools to version 25.3.0.5525 or later, or installing the fixed AsyncOS releases.
Singapore-based Ahsay Backup has released security updates for two AhsayCBS vulnerabilities (CVE-2026-105133 and CVE-2026-105134) that attackers have exploited to bypass authentication and execute commands remotely. According to Huntress, attackers chained the flaws to deploy web shells and XMRig cryptocurrency miners. The vendor has warned that previous patches in versions 9.15.2.59 and 10.3.4.0 were incomplete and did not fully fix vulnerabilities.
Japanese vendor EG Secure Solutions has patched an exploited OS command injection issue (CVE-2026-106931) in its host-based web application firewall (WAF) SiteGuard Server Edition that allows a remote user to execute arbitrary shell commands on the target system.
Threat actors are reportedly exploiting a vulnerability (CVE-2026-105740) in Langflow that allows authenticated attackers to execute code remotely. Versions earlier than 1.9.0 are affected.
Drupal has fixed multiple security issues, one of which (CVE-2026-108097) affects Drupal’s Field UI module and could allow attackers to execute code on the server through certain exploit paths, including one that requires no login.
NGINX released versions 1.30.6 and 1.31.7 to fix five security vulnerabilities that could cause worker crashes, potentially enable code execution, bypass client-certificate checks, or allow malicious HTTP/3 requests to pass extra bytes to backend servers.
Attackers exploited a security flaw (CVE-2026-110447) in Nextcloud’s Collabora Online app to install web shells and run commands on servers without logging in. Collabora fixed the issue in version 26.4.303 on September 11 and published a security advisory. Users must update or remove the app, as simply disabling it is not enough.
Microsoft released its October 2026 Patch Tuesday security updates that address over 1,000 security flaws, including one actively exploited zero-day vulnerability. The zero-day vulnerability is CVE-2026-96951, a Windows Shell security feature bypass that allows attackers to circumvent the Mark of the Web security feature, which helps Windows identify files downloaded from the internet.
Fortinet released security advisories addressing over a dozen security vulnerabilities, including a high-severity flaw in FortiSIEM. Tracked as CVE-2026-106173, the vulnerability is a path traversal issue that allows a remote non-authenticated attacker to execute arbitrary code.
Also, Ivanti has disclosed an actively exploited zero-day vulnerability in its Connect Secure (ICS) remote access gateway that could allow attackers to run commands on affected systems. Tracked as CVE-2026-104935, the flaw allows remote attackers to bypass authentication without needing user interaction or special access. It affects several ICS versions, including 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier.
Attackers have attempted to exploit a high-severity vulnerability in SonicWall SMA1000 appliances just a few days after the company released a security patch. Tracked as CVE-2026-102255, the flaw affects the WorkPlace interface on SMA1000 6210, 7210, and 8200v models. It does not affect the SMA 100 Series or SSL-VPN running on SonicWall firewalls.
A proxyjacking campaign has compromised at least 143 devices across 34 countries, using the legitimate Pawns.app to monetize victims’ internet connections without their consent. According to GreyNoise, attackers exploited vulnerabilities in D-Link ShareCenter NAS, Ubiquiti UniFi Video NVR, and SAP NetWeaver Visual Composer (CVE-2024-3272, CVE-2024-3273, CVE-2021-44228, CVE-2025-31324) to breach vulnerable devices and install the application. Hikvision and Dahua DVR/NVR devices were also targeted, although GreyNoise didn’t reveal what flaws were exploited.
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated the popular Arch Linux 'yay' and 'paru' helper tools. The attack is part of a series of security incidents targeting AUR, including previous campaigns that distributed malware to steal credentials and gain rootkit capabilities.
Cybersecurity researchers have uncovered an ongoing campaign that uses artificial intelligence to target WordPress websites, e-commerce platforms, and critical infrastructure in Ukraine. The operation combines common hacking tools, known software vulnerabilities, and AI agents to automate attacks and gain access to compromised systems.
North Korean hackers have targeted Ukrainian experts in diplomacy, security and international policy in an effort to gather information about Russia’s war against Ukraine. The hacking group, tracked as Kimsuky, used fake conference invitations, research requests and malicious files to steal information, though most of the observed attacks were unsuccessful.
Threat actors linked to a Chinese cybersecurity company stole emails from government agencies, law enforcement, healthcare systems, and religious organizations across Southeast Asia. The threat actors have been targeting networks since at least January 2021. They scan websites for security flaws, exploit known vulnerabilities, and guess passwords to gain access to Microsoft 365 and Exchange accounts.
Some of the Ledger hardware wallets sold through Southeast Asian reseller CryptoBilis were modified with hidden hardware implants that stole cryptocurrency from users. Researchers found that the implants were hidden inside Ledger X devices and could capture information from the screen and button presses. According to researchers, the devices could use the information to steal users’ recovery phrases and send them to attackers through a mobile network connection.
Cisco Talos has observed a Kazakhstan-linked threat actor, tracked as UAT-6275, targeting government organizations across the CIS, with additional interest in water and energy sectors. Between June 2025 and August 2026, the group used several infection methods and custom tools to gain remote access to targeted systems. Exposed infrastructure revealed its tools, payloads, and command-and-control changes, suggesting preparations for further operations, including potential attacks on Linux systems and internet-facing devices.
Hackers remotely defrosted refrigerators at several French supermarket chains by exploiting outdated Danfoss refrigeration controllers. The attack raised refrigerator temperatures, potentially causing food losses and fires. French prosecutors have launched an investigation to identify the victims and determine the damage.
Citizen Lab published a report on AdFection, a zero-click spyware campaign where an Israeli ad company routed targets to spyware servers and infected dozens of devices. The technique was used to infect devices at Al Jazeera with Candiru’s spyware.
A 36-year-old hacker, Jonathan Spalletta, was found guilty of stealing over $53 million from the Uranium Finance crypto exchange in 2021 by exploiting smart contract vulnerabilities. Authorities seized expensive collectibles and recovered about $31 million in cryptocurrency. He faces up to 30 years in prison for computer fraud and money laundering.
An international law enforcement operation targeted online scam networks in West Africa, leading to multiple arrests and the seizure of electronic devices. Authorities identified scam and human trafficking victims and disrupted schemes involving fake law enforcement officers and fraudulent cryptocurrency investments.
Two US nationals were arrested for allegedly helping North Korean IT workers obtain remote jobs at more than 70 American companies using fake identities. The scheme reportedly generated over $3 million. The FBI searched 40 suspected laptop farm locations in Texas and seized 187 devices.
Microsoft and Health-ISAC disrupted three cybercrime services (CoGUI, Haozi and Iron Man) used to sell stolen accounts, phishing kits, and fraud tools. The services reportedly helped send over one billion malicious messages worldwide since January 2026. Microsoft disabled more than 20,000 related accounts and began blocking over 100,000 fraudulent domains.
Authorities in North Macedonia arrested the alleged administrator of OLVX, a marketplace selling stolen login credentials and cybercrime tools. Meanwhile, French authorities shut down websites suspected of selling stolen personal data and arrested three teenagers allegedly linked to the operation.
OpenAI discovered a hidden recording device in an executive conference room at its San Francisco office and alerted the FBI. An employee, identified as Abdulrahman Alfozan, was fired and arrested on October 9 and charged with secretly intercepting conversations. OpenAI said it used its AI models to analyze the device, which reportedly had advanced encryption and audio-monitoring features.
The Security Service of Ukraine (SBU) and the National Police uncovered a scam call center in Lviv region and arrested three people allegedly behind the scheme. The criminals used fake female profiles on social media and dating platforms to trick victims into opening malicious files, allowing them to access online banking accounts and steal money from Ukrainian and EU citizens. The stolen funds were converted into cryptocurrency and cash. This is the first case in Ukraine prosecuted under a new law that took effect in September 2026, increasing criminal liability for scam call centers.
The UAE law enforcement said it dismantled four interconnected international criminal networks in an operation called “End of Battle,” arresting 33 suspects from 12 nationalities, including key leaders. The networks were involved in cybercrime, money laundering, digital wallet theft, fraud, extortion, data trafficking, and violent assaults. As part of the operation, assets exceeding 65 billion dirhams ($17.7 billion) were secured, over 200 million dirhams ($54.5 million) were seized, over 3,000 digital wallets were investigated.
Law enforcement agencies from 17 countries in Latin America and Europe arrested 95 suspects in an Interpol-coordinated operation targeting the online sharing of child sexual abuse material. Between March and September 2026, authorities carried out 127 searches and rescued a five-year-old victim. Law enforcement officers also uncovered large online groups sharing abusive material and suspects accused of sextortion involving minors.