Our weekly round-up of significant threats and actively exploited vulnerabilities. It is awareness content, not a monitored threat intelligence service: always check vendor advisories against your own environment.
This week at a glance
Remote access and edge products were again the main target, with zero-days in Ivanti Connect Secure, Cisco Secure Email Gateway, BeyondTrust Remote Support, and PAN-OS, and an exploited Windows flaw fixed in a record Patch Tuesday. Stolen ConnectWise app credentials were used to break into Microsoft 365 tenants, and attackers took over refrigeration controllers in hundreds of European supermarkets.
Actively exploited vulnerabilities
Ivanti Connect Secure (CVE-2026-104935)
This authentication bypass in Ivanti’s VPN appliances was exploited as a zero-day from early October. Volexity attributes it to a new, apparently criminal group (UTA0576) that chained it with an unfixed privilege escalation flaw to steal Active Directory credentials and BitLocker keys. Fix: upgrade to 22.8R2.5, 25.1.1.2, or 25.1.3.x, then look for signs of compromise using Volexity’s indicators.
Source: Ivanti security advisory
Cisco Secure Email Gateway (CVE-2026-76519)
A crafted email attachment can make the gateway write arbitrary files and run commands as root where File Reputation is enabled. Cisco has confirmed exploitation and warns that attackers may hide their tracks. Fix: upgrade to AsyncOS 15.5.5-014 or 16.5.0-780, or update Content Scanner Tools to 25.3.0.5525 or later, then run Cisco’s compromise checks.
Source: Cisco security advisory
BeyondTrust Remote Support (CVE-2026-102764)
Google Threat Intelligence Group attributes zero-day exploitation since 29 August to ARMORY CASTLE (formerly UNC5221), a suspected China-nexus espionage group that installed the SAWFLY web shell. SaaS instances were patched by 9 October. Fix: make sure self-hosted appliances have the BT26-05-RS patch (upgrade to 24.3.1 first if needed), patch Privileged Remote Access as a precaution, and check for web shells.
Source: BeyondTrust advisory BT26-05
Palo Alto Networks PAN-OS (CVE-2026-0322)
An authenticated attacker who can reach the PAN-OS or Panorama management interface can run code as root. Palo Alto Networks reports very limited exploitation. Fix: upgrade to the fixed hotfix for your PAN-OS branch and restrict management access to trusted internal addresses.
Source: Palo Alto Networks advisory
Microsoft Windows Shell (CVE-2026-96951)
A crafted file can bypass Mark of the Web, so Windows shows no security warning when a downloaded or emailed file is opened. Microsoft confirmed exploitation before the patch. Fix: install the October 2026 Windows cumulative updates.
Source: Microsoft Security Response Center
Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager (CVE-2025-61624)
Unit 42 reports that a threat cluster tracked as CL-STA-0954 (UNC5820) used this April 2026 flaw to gain root on FortiGate firewalls and install the memory-only PEERSTITCH implant, after compromising a telecoms managed service provider’s FortiManager. Data on more than 500 managed firewalls was taken. Fix: upgrade FortiOS to 7.4.10 or 7.6.5 or later (and the other products to their fixed releases), patch FortiManager, and rotate credentials.
Source: Fortinet PSIRT advisory
Nextcloud built-in Collabora CODE server (CVE-2026-110447)
Attackers have exploited this unauthenticated command injection flaw in Nextcloud’s built-in CODE server app since mid-September, a month before the advisory, to plant PHP web shells. Fix: upgrade richdocumentscode to 26.4.303 or later, or remove the app (disabling it is not enough), and check servers for web shells.
Source: BleepingComputer
Notable threats and campaigns
ConnectWise Cloud Backup credentials used to break into Microsoft 365 tenants
Attackers used stolen credentials for ConnectWise’s Cloud Backup (formerly SkyKick) apps to sign in to Microsoft 365 tenants as the trusted backup app, in some cases granting themselves administrator rights. Huntress saw attempts against almost 1,000 tenants worldwide, about 300 of them successful. ConnectWise has suspended the affected services; managed service providers and their customers should review Entra ID service principal sign-ins, role changes, and new app credentials from 13 October.
Source: BleepingComputer
Supermarket refrigeration controllers hijacked across Europe
CERT-FR warned that attackers had taken over internet-exposed Danfoss, Copeland, and Dixell refrigeration controllers, affecting around 700 stores in France; Sekoia also reported stores hit in Spain, Portugal, Poland, Germany, and Belgium. No one has claimed the attack. Take building and refrigeration controllers off the internet and allow remote access only through a VPN.
Source: SecurityWeek
AOMEI Backupper update servers used to deliver backdoors
Google Threat Intelligence Group and ManageEngine found that a group tracked as UNC7017 tampered with AOMEI Backupper’s update servers between May and July 2026 to install the CROSSROAD and SHINYROAD backdoors. Victims were in IT services, telecoms, and higher education in countries including Spain, Portugal, Switzerland, Türkiye, Brazil, the United States, Australia, India, and South Africa. Look for unexpected RadminComponentRuntime or NitroRuntime scheduled tasks.
Source: The Hacker News
Also reported this week
- Phishing kit takedown: Microsoft and partners disrupted the CoGUI, Haozi, and Iron Man phishing kits behind more than a billion phishing messages, with victims in Japan, the United States, Australia, and India. (The Hacker News)
- NCA-led scam crackdown: an NCA-hosted operation with the FBI, Meta, and police in Nigeria and Ghana led to 28 arrests and the removal of 3.7 million accounts used in scams aimed at people in the UK and the United States. (Meta)
- Candiru spyware via online ads: Citizen Lab found Candiru spyware delivered without a click through targeted ads on mainstream ad exchanges, with journalists among the targets. (BleepingComputer)
- CL-UNK-1211 Linux espionage: Unit 42 described espionage against government Linux and mail servers using web shells and apparently AI-written scripts. (Unit 42)
- Help TDS tech support scams: Infoblox linked a network creating around 300 Cloudflare Pages sites a day for fake Microsoft lock screens to the Hotejka affiliate programme. (The Hacker News)
- MALFEX npm packages: SafeDep reported npm packages, including imgdecode, that install a stealer and remote access tool on developers’ Windows machines. (The Hacker News)
- Fake Arch Linux packages: typosquatted copies of the yay and paru helpers ran a remote script as root. (BleepingComputer)
- Edge device proxyjacking: GreyNoise found old flaws in NAS devices, video recorders, and SAP NetWeaver exploited to install bandwidth-reselling software. (BleepingComputer)
- OLVX market arrest: police in North Macedonia and the FBI arrested the suspected administrator of a marketplace selling stolen data and credentials, mainly of Americans. (The Record)
Other patches worth knowing
- Microsoft’s October Patch Tuesday (13 October) fixed a record of more than 1,400 CVEs, including a publicly disclosed .NET Framework WDAC bypass (CVE-2026-108398) and a critical SharePoint account takeover flaw (CVE-2026-102866) (Malwarebytes).
- Adobe fixed 174 flaws across 11 products, including CVSS 10.0 bugs in Experience Manager, ColdFusion, and Commerce, with no known exploitation.
- Ahsay released new AhsayCBS hotfixes (10.3.4.45 and 9.15.2.70) after its August patches proved incomplete; apply them and reboot (The Hacker News).
- Oracle’s October Critical Patch Update is due on Tuesday 20 October with about 1,283 fixes, including CVSS 10.0 flaws in E-Business Suite, Fusion Middleware, and JD Edwards (Oracle).
Practical steps to consider
- Patch edge and remote access systems first: list every internet-facing VPN, email gateway, remote support tool, and firewall management interface, patch them within days, and check for compromise after patching (ISO/IEC 27001 control A.8.8; Cyber Essentials expects critical and high-risk updates within 14 days).
- Review third-party app access to Microsoft 365: remove vendor apps you no longer use, limit their permissions, and alert on new app credentials and role changes (controls A.5.19 and A.5.21).
- Take operational technology off the internet: keep building, refrigeration, and other controllers behind a VPN, segment them from office networks, and replace end-of-life devices (controls A.8.20 and A.8.22).
This round-up is for general awareness only and is not a monitored threat intelligence service. If you would like help reviewing your vulnerability management or incident readiness, contact us.
