Intelligence hub.

Nikkei's third breach in a month exposed 1.83 million records.

Attackers used stolen credentials to reach a Nikkei development system on October 7. About 150,000 of the 1.83 million records held personal details, per BleepingComputer.

CISA adds Plex2Shell, Siemens and SiteGuard flaws to KEV.

CISA's October 20 KEV update covers four chained Plex Media Server bugs used to drop miners and proxy malware, plus exploited flaws in Siemens Software Center and SiteGuard Server Edition. Federal deadlines start October 23.

Qilin and Inc are using a PAN-OS GlobalProtect bypass to reach vCenter.

Unit 42 updated its CVE-2026-0257 brief on October 19 with ransomware activity from Qilin and Inc. After the VPN foothold, one intrusion pivoted to vCenter and ESXi to dodge in-guest EDR.

PEERSTITCH: a memory-only implant that bypasses FortiOS VPN checks.

Unit 42 detailed a fileless ARM64 implant on FortiGate firewalls, used after a FortiManager breach exposed configs and credentials for 500+ devices. CISA added the FortiOS flaw it relies on to KEV on October 16.

China-linked actor exploited a BeyondTrust zero-day for six weeks before the patch.

Mandiant says ARMORY CASTLE used CVE-2026-102764 (CVSS 9.3) to reach root on Remote Support appliances from late August. BeyondTrust disclosed it October 15.

Attackers are chaining two AhsayCBS flaws to drop webshells and a miner.

Huntress saw exploitation of CVE-2026-105133 and CVE-2026-105134 from October 7, with five organizations hit by October 8. Patch status is unclear, so restrict access to the console now.

Pwn2Own Ireland opens with 32 zero-days and $388,500 paid.

Researchers burned 32 zero-days on day one, hitting a Samsung Galaxy S26, Oracle's AI database, LiteLLM and OpenAI Codex. Vendors now have 90 days to patch.

Citrix NetScaler has a third zero-day in weeks, and it may be more than a DoS.

On October 4, Citrix patched CVE-2026-88779, a memory buffer overflow in NetScaler SAML authentication. BleepingComputer reports it is already exploited, and the first DoS label may understate it.

FortiMail Compromise: Unauthenticated Arbitrary File Write Vulnerability Under Active Exploitation

A critical zero-day vulnerability in FortiMail, CVE-2026-104286, is actively being exploited, allowing unauthenticated attackers arbitrary file write access. CISA has added this to its KEV catalog, signaling immediate threat.

GitLab patches a CVSS 9.9 sandbox escape in its AI Gateway.

A crafted flow configuration can break out of the prompt template sandbox and run commands on self-hosted GitLab AI Gateways. Patches are out in 19.2.4, 19.3.2 and 19.4.1.

A critical FortiMail flaw is being exploited to write arbitrary files.

CVE-2026-104286 (CVSS 9.8) lets unauthenticated attackers write files to FortiMail appliances. CISA added it to KEV on October 1; federal deadline is October 4.

Apple patched a CoreGraphics zero-day used against targeted individuals.

Apple fixed CVE-2026-86950, an out-of-bounds write in CoreGraphics reported by Meta, after an "extremely sophisticated" targeted attack. Updates 26.7.1 and 15.8.1 are out.

Blue team tactics

Citrix NetScaler Under Fire: Two RCE Zero-Days Actively Exploited

Critical unpatched vulnerabilities in Citrix NetScaler ADC and Gateway are being actively exploited in the wild. Immediate patching is paramount to mitigate significant risk.

Dark, low-key rows of server hardware in a data center rack, evoking the network edge infrastructure at the center of the Citrix NetScaler zero-day story

Two unpatched NetScaler zero-days were already being exploited when researchers found them.

Security firm watchTowr uncovered CVE-2026-88771 and CVE-2026-88772 in Citrix NetScaler ADC and Gateway while investigating already-compromised customer environments. Citrix shipped patches on September 27, but one flaw affects every default deployment and carries a CVSS 4.0 score of 9.5.

Server rack in a data center, representing on-premises SharePoint infrastructure

A SharePoint bug patched quietly in August is now an active RCE.

CISA has confirmed active exploitation of CVE-2026-65660, a SharePoint Server code injection flaw Microsoft first described as a low-severity spoofing bug. It's now rated 8.8 and lets authenticated attackers execute code on-premises.

Rapid Exploitation: LiteLLM SQL Injection Urgency Post-Disclosure

Critical CVE-2026-42208 in LiteLLM is already being actively exploited, demanding immediate attention for developers and organizations utilizing this LLM orchestration tool. Swift action is paramount to mitigate potential data breaches and system compromises.

Cyber Operations Weekly Brief: Resurgence of Old Threats, New AI Exploits, and Supply Chain Vulnerabilities

This week's cyber landscape reveals a concerning resurgence of aged attack vectors, coupled with novel exploitation of AI and pervasive supply chain compromises. Stay ahead of evolving threats with our tactical breakdown.

Operation ASP.NET Breach: Microsoft Neutralizes High-Impact Privilege Escalation Threat (CVE-2026-40372)

Microsoft has deployed critical out-of-band patches to neutralize CVE-2026-40372, a severe privilege escalation vulnerability within ASP.NET Core. This critical threat necessitates immediate action for all affected deployments.

ThreatsDay Digest: Multi-Million DeFi Heist, Evasive macOS Malware, and Pervasive Proxy Exploits

The digital landscape is rife with recurring vulnerabilities, as evidenced by a colossal DeFi hack and novel threats targeting macOS and mobile infrastructure. A deeper dive into recent threat intelligence reveals persistent supply chain compromises and sophisticated attack vectors.

The Unseen Breach: Identity Exploitation - The Human Element of Cyber Warfare

While the spotlight often shines on sophisticated exploits, the most effective entry point for adversaries remains alarmingly simple: compromised credentials. This tactical analysis delves into the pervasive threat of identity-based attacks and how organizations can fortify their digital perimeters against them.

ShowDoc RCE Exploit: CVE-2025-0520 Threatens Unpatched Infrastructure

A critical Remote Code Execution vulnerability, CVE-2025-0520, is currently being actively exploited in the wild targeting ShowDoc instances. Organizations running unpatched systems face significant data breach and compromise risks.

Microsoft Defender Exploited: Urgent Threat Analysis of Unpatched Zero-Days

Threat actors are actively weaponizing three critical zero-day vulnerabilities within Microsoft Defender, two of which remain unpatched. This coordinated exploitation grants elevated privileges, posing a significant risk to enterprise security.

Code Red: CVE-2026-33032 Unleashes Nginx Control Chaos

A critical authentication bypass in nginx-ui (CVE-2026-33032) is actively exploited, granting attackers full control over Nginx servers. This vulnerability poses an immediate and severe threat to web infrastructure.

CYPEIRA Weekly Briefing: The Evolving Threat Landscape — From Fiber Optics to AI Vulnerabilities

This week's intelligence briefing highlights state-sponsored attacks on critical infrastructure and sophisticated new exploits targeting common file formats. Stay ahead of emerging cyber threats with our tactical analysis.

Fortinet FortiClient EMS Vulnerability: Pre-Authentication Bypass Threat Patched

Fortinet has deployed critical out-of-band patches for a severe FortiClient EMS vulnerability (CVE-2026-35616) that has already seen active exploitation in the wild. This pre-authentication API access bypass poses a significant risk to unsecured systems.

Operation PDF Ghost: Exploitation of Adobe Reader Zero-Day Uncovered Since Late 2025

Advanced persistent threats have leveraged a sophisticated zero-day vulnerability in Adobe Reader, actively exploiting malicious PDFs since December 2025. This high-stakes cyber operation demands immediate attention and robust defensive postures.

The Art of Obfuscation: Unpacking the Latest Evolving Threats to Digital Assets

Advanced techniques are being employed to conceal malicious activities, demanding heightened vigilance from all digital stakeholders. Understanding these evolving obfuscation methods is paramount for robust cybersecurity defenses.

CyPeira Ops

Critical Zero-Day Analysis: Advanced Persistence in IoT Nodes

A Zero-Day is the breach, but Advanced Persistence is the occupation. In modern IoT nodes, attackers are moving beyond RAM-resident malware to Flash-layer implants. By subverting the U-Boot or UEFI sequence, they ensure that even a factory reset fails to clear the infection. The device doesn't just run malicious code; it becomes a permanent, invisible gateway within your internal network.

CYPEIRA_CORE_INTEL

CISA and FBI: SafePay ransomware has hit at least 600 organizations.

A joint advisory says SafePay has compromised at least 600 organizations since August 2024, mostly through stolen credentials, VPN access and known edge-device flaws.

PHP warns of two critical RCE flaws, with emergency patches due today.

PHP will ship emergency fixes on October 21 at 14:00 UTC for CVE-2026-109618 and CVE-2026-109619 after an early leak. Scores are 9.2 per PHP and 10.0 per watchTowr.

A Nextcloud CODE server flaw is giving attackers web shells.

CVE-2026-110447 (CVSS v4 9.2) is an unauthenticated command injection in Nextcloud's built-in Collabora CODE app, exploited since about September 10 per BleepingComputer.

Palo Alto warns of a PAN-OS root RCE flaw already exploited.

CVE-2026-0322 (CVSS 8.6) lets an authenticated attacker run code as root via the PAN-OS management interface. CISA added it to the KEV catalog with a October 17 federal deadline.

Microsoft's record Patch Tuesday fixes 1,411 flaws and one exploited Windows Shell zero-day.

The October 2026 update closes an exploited Mark of the Web bypass, CVE-2026-96951, plus two publicly disclosed flaws. BleepingComputer counts 1,411 fixes.

Cisco patches three CVSS 9.8 root-RCE flaws in Nexus 3000 and 9000 switches.

Cisco's NGOAM advisory covers three stack-based buffer overflows that let an unauthenticated attacker run code as root or crash a switch. Cisco's PSIRT reports no known exploitation.

Atlassian patches a 9.3 file-access flaw across Jira, Confluence and Bitbucket.

CVE-2026-21589 lets unauthenticated attackers read specific files in the web root of Atlassian Data Center products. Patch, or pull exposed instances off the internet.

An AI agent chained two Zammad zero-days to root a vulnerability-disclosure nonprofit.

DIVD says an AI agent went from a hijacked session to root on its Zammad server in seconds on September 21. No patches existed at the time of reporting.

Warlock ransomware is still walking in through SharePoint.

Symantec reports Warlock (Storm-2603) hit at least four organizations in two months, including a water utility and a telecom provider. One intrusion disabled security tools on 40+ hosts in about two hours and deployed ransomware via SYSVOL.

Dell patches two CVSS 10 flaws in Container Storage Modules.

Dell fixed CVE-2026-63688 and CVE-2026-63692, both rated CVSS 10.0, plus CVE-2026-67269 (9.9) in Container Storage Modules. Unauthenticated attackers could gain admin control of the authorization service; no exploitation has been reported in the sources reviewed.

A CVSS 10 MediaWiki extension flaw is being exploited, and wikis are hosting web shells.

CVE-2026-100382 in the ExternalData extension gives unauthenticated attackers OS command execution. Public proof-of-concept code exists and compromised wikis are already serving web shells.

Bitget lost $351.6 million after attackers spoofed what its approval system saw.

Bitget says suspected North Korean hackers drained about $351.6 million from hot and warm wallets by manipulating transaction data shown to its authorization process. Private keys were not stolen.

A chained SSH flaw gave attackers full admin on MikroTik routers, no password needed.

CERT Polska traced a two-bug SSH exploit chain, nicknamed MikroTrick, against internet-exposed MikroTik RouterOS devices back to September 2. CISA added the lead flaw, CVE-2026-67279, to its Known Exploited Vulnerabilities catalog and gave federal agencies until September 28 to patch.

A WordPress core flaw went from patch to active exploitation in under a day.

CISA has added CVE-2026-87902, a critical unauthenticated file-inclusion flaw in WordPress core, to its Known Exploited Vulnerabilities catalog after attackers began weaponizing it within hours of the fix shipping.

Server corridor inside node sector 09, racks lit by red status strips

Inside the Osiris-IX protocol.

An advanced persistent threat against hardened financial infrastructure across the APAC region, and the payload that carried it.

LeRobot Breach: Critical RCE Vulnerability Exposes Hugging Face Platform

A severe remote code execution flaw has been identified in Hugging Face's popular LeRobot platform. This unpatched vulnerability, rated critical, poses a significant risk to systems utilizing this open-source robotics framework.

Fortifying the Core: Microsoft Deploys Patch for Critical ASP.NET Privilege Escalation Vulnerability

Microsoft has issued urgent out-of-band updates to neutralize a critical privilege escalation flaw within ASP.NET Core. This vulnerability, CVE-2026-40372, poses a significant threat and demands immediate attention from all system administrators.

FIRESTARTER Backdoor Infiltration: Unpacking the Cisco Firepower Breach

A sophisticated backdoor, dubbed FIRESTARTER, has successfully compromised a U.S. federal Cisco Firepower device, bypassing security patches. This incident highlights the persistent threat and advanced tactics employed by threat actors.

ASP.NET Core Exploit: Critical Privilege Escalation Vulnerability Patched

Microsoft has issued urgent patches for a high-severity flaw in ASP.NET Core, CVE-2026-40372, enabling attackers to elevate privileges. This out-of-band update is crucial for securing web applications.

SGLang Exploitation: CVE-2026-5760 Unleashes Critical RCE via Unsanitized GGUF Models

A critical command injection vulnerability (CVE-2026-5760) in SGLang, rated CVSS 9.8, allows remote code execution through malicious GGUF model files. This threat demands immediate attention for all SGLang users.

Nexcorium Emerges: Mirai Variant Leverages CVE-2024-3721 to Compromise TBK DVRs for DDoS Dominance

A potent new Mirai variant, dubbed Nexcorium, is actively exploiting CVE-2024-3721 to hijack TBK DVRs and end-of-life TP-Link routers, expanding the reach of sophisticated DDoS botnets. This exploitation presents a significant threat to network infrastructure and data integrity.

CYPEIRA Ops Brief: Critical Cisco Flaws Unlocked by Malicious Actors, Threatening Identity Integrity and Communications

Four critical vulnerabilities in Cisco's Identity Services and Webex Services have been patched, but the potential for attackers to execute arbitrary code and impersonate users demands immediate attention from all organizations relying on these platforms.

ShowDoc Vulnerability Exploited: Critical RCE Flaw CVE-2025-0520 Poses Immediate Threat

A critical remote code execution vulnerability, CVE-2025-0520, within the popular ShowDoc collaboration platform is currently being actively exploited in the wild, posing a significant threat to unpatched systems.

Urgent Patch Deployed: Exploited Adobe Acrobat Reader Vulnerability (CVE-2026-34621) Threatens Digital Fortifications

A critical zero-day flaw in Adobe Acrobat Reader, now designated CVE-2026-34621, is under active exploitation in the wild. Immediate patching is imperative to secure your digital perimeter.

Marimo's Midnight RCE: Critical Flaw Exploited Within Hours of Revelation

A critical Remote Code Execution (RCE) vulnerability in the Marimo data science notebook was weaponized less than ten hours after its public disclosure. This rapid exploitation highlights the immediate threat posed by unpatched critical vulnerabilities in widely used open-source tools.

Adobe Reader Exploited: Sophisticated PDF Zero-Day Undetected Since Late 2025

A sophisticated zero-day vulnerability in Adobe Reader has been actively exploited through malicious PDF documents since at least December 2025. This advanced threat bypasses conventional defenses, demanding immediate attention.