Ivanti Connect Secure Zero-Day Chain Actively Exploited for Remote Code Execution

Threat actors are actively exploiting CVE-2026-104935 and chaining vulnerabilities against Ivanti Connect Secure appliances to achieve unauthenticated remote code execution. CISA warned that the zero-day has been used for credential theft and data exfiltration, while incident investigations identified attackers gaining root-level access to affected VPN devices.

Source: Volexity

Cisco Secure Email Gateway Vulnerability Exploited in Active Attacks

Cisco warned that attackers are exploiting a critical vulnerability in Secure Email Gateway appliances that allows an unauthenticated sender to write files to the operating system through a crafted email attachment. Successful exploitation can potentially lead to command execution with root privileges on vulnerable gateways.

Source: The Hacker News

Microsoft Patch Tuesday Fixes Record 1,411 Vulnerabilities and Three Zero-Days

Microsoft’s October 2026 Patch Tuesday addressed a record 1,411 vulnerabilities, including 70 rated Critical. Three zero-day vulnerabilities were included in the release, with one already being actively exploited and two publicly disclosed before patches became available.

Source: BleepingComputer

Maximum-Severity SonicWall SMA1000 Vulnerability Now Exploited in Attacks

Attackers are now exploiting CVE-2026-102255, the CVSS 10 vulnerability recently patched in SonicWall SMA1000 appliances. The pre-authentication SSRF flaw allows a remote unauthenticated attacker to make the appliance access internal functionality and perform unauthorized operations.

Source: BleepingComputer

Critical AhsayCBS Vulnerabilities Exploited to Deploy Web Shells and Cryptominers

Attackers began exploiting CVE-2026-105133 and CVE-2026-105134 shortly after their disclosure to achieve remote code execution against AhsayCBS backup servers. Observed post-exploitation activity included reconnaissance, web shells, XMRig cryptominers and PowerShell tooling designed to interfere with system monitoring.

Source: Huntress

Critical Langflow RCE Targeted in More Than 1,400 Exploit Attempts

Threat actors are actively targeting CVE-2026-105740, a critical authenticated remote code execution vulnerability affecting Langflow versions before 1.9.0. Researchers recorded 1,423 exploitation attempts against honeypot infrastructure, indicating substantial interest in the flaw shortly after disclosure.

Source: The Hacker News

Flax Typhoon Exploited Five Vulnerabilities Added to CISA KEV Catalog

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog following confirmed abuse by China-linked Flax Typhoon. The action accompanied a joint international advisory warning about operations enabled by China’s Integrity Technology Group against networks in multiple countries.

Source: The Hacker News

GhostAction Supply Chain Campaign Targets More Than 30,000 GitHub Repositories

A renewed GhostAction campaign targeted more than 30,000 repositories belonging to roughly 3,000 users and organizations after attackers compromised about 1,900 GitHub accounts. The campaign attempted to extract 3,174 secrets from public repository CI environments and added Git history secret scanning to its credential-stealing workflows.

Source: GitGuardian

Ledger Halts Wallet Sales After Hardware Supply Chain Attack

Ledger asked distributors and resellers in Southeast Asia and Hong Kong to halt sales after confirming that cryptocurrency wallets sold through a reseller had been physically modified. Hardware implants inside affected devices were designed to capture wallet seed phrases and transmit them to an unauthorized party over an LTE connection.

Source: BleepingComputer

Targeted Ads Used to Deliver Zero-Click Mercenary Spyware

Citizen Lab documented what it describes as the first public confirmation of zero-click mercenary spyware delivered through targeted online advertising. The technique, dubbed AdFection, was used to compromise devices at Al Jazeera with Candiru spyware and demonstrates how advertising infrastructure can be repurposed as a surveillance delivery channel.

Source: Citizen Lab

Cyberattack Manipulates Refrigeration Systems at Hundreds of French Supermarkets

Cyberattacks against commercial refrigeration controllers disrupted hundreds of French grocery stores, with compromised systems reportedly commanded to raise temperatures high enough to destroy stored food and, in some cases, contribute to small fires. French authorities later expanded their warning to include Danfoss, Copeland and Dixell controller families.

Source: SecurityWeek

Microsoft and Health-ISAC Disrupt Phishing Market Behind More Than One Billion Messages

Microsoft and Health-ISAC seized and redirected infrastructure associated with YAM Store, CoGUI and Iron Man, components of a Chinese-language cybercrime marketplace. Microsoft says the services were used to send more than one billion malicious messages since January, targeting over 75,000 organizations in more than 150 countries.

Source: SecurityWeek

Next.js Releases Emergency Fixes for Two Critical Unauthenticated RCE Flaws

Next.js issued an out-of-band security update for two critical vulnerabilities that can allow unauthenticated remote code execution. The flaws affect React Server Components and SVG processing through librsvg, with fixes released in Next.js 16.4.1 and 15.5.28.

Source: The Hacker News

Linux vhost Vulnerability Enables Root Privilege Escalation and Potential VM Escape

CVE-2026-74580 affects Linux’s vhost virtualization acceleration subsystem across nearly a decade of kernel releases. Researchers demonstrated both local privilege escalation to root and a virtual-machine escape path in environments using a virtual IOMMU, potentially allowing an untrusted guest to corrupt memory in the host QEMU process.

Source: Tencent Security

CenterPoint Energy Data Breach Impacts More Than One Million People

CenterPoint Energy notified authorities that personal information belonging to more than one million Texans was compromised in a data breach. The utility had previously confirmed that customer information was stolen from its systems, while a threat actor claimed possession of millions of records.

Source: SecurityWeek