Today’s briefing covers 11 security issues reported in the last 24 hours, grouped by type: 6 actively exploited, 3 breaches and data exposure, 1 scams and phishing, 1 arrests and takedowns. Each entry says who is affected and what to do, with links to the original reports.
Actively exploited
Palo Alto Networks PAN-OS management interface RCE flaw CVE-2026-0322 actively exploited
Who is affected: Organisations using Palo Alto Networks PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances running affected PAN-OS versions; Cloud NGFW and Prisma Access are not affected.
Palo Alto Networks disclosed CVE-2026-0322, a high-severity (CVSS 8.6) remote code execution vulnerability in the PAN-OS management interface that lets an authenticated attacker with network access run code as root. The company said it has observed very limited exploitation in the wild and released fixes for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with a patch for 11.2.16 expected on October 15. CISA added the flaw to its Known Exploited Vulnerabilities catalog with a remediation deadline of October 17 for federal agencies.
What to do: Upgrade PAN-OS on affected firewalls and Panorama appliances to a fixed version, restrict management interface access to trusted internal IP addresses, and review logs for connections from the listed IP addresses 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234.
Sources: bleepingcomputer.com, thehackernews.com, securityweek.com, CISA KEV / NVD, CISA KEV / NVD
Ivanti Connect Secure zero-day CVE-2026-104935 exploited in the wild
Who is affected: A limited number of Ivanti Connect Secure (ICS) SSL-VPN and remote-access gateway customers.
Ivanti disclosed that attackers exploited CVE-2026-104935, a chain of a high-severity authentication bypass and an unauthenticated remote code execution flaw in ICS appliances. The vendor said it had originally found part of the issue in July and patched it in ICS 25.1.3.0, then continued working to backport the fix to other supported versions when exploitation began. Researchers tracked the threat actor behind the attacks as UTA0576.
What to do: Apply the latest Ivanti patches for all supported ICS versions, verify that fully patched ICS appliances are running, and review appliances for signs of compromise using Ivanti’s integrity checking tools.
Sources: darkreading.com
Cisco Secure Email Gateway flaw CVE-2026-76519 exploited in attacks
Who is affected: Organisations running Cisco Secure Email Gateway with Advanced Malware Protection (AMP) enabled and a Content Scanner Tools version earlier than 25.3.0.5525 installed.
Cisco warned of active exploitation of CVE-2026-76519, a critical (9.8/10) flaw in the AMP attachment handling feature that lets remote unauthenticated attackers write arbitrary files to the underlying operating system and run commands as root. Fixes were rolled out on September 14 in Secure Email Gateway versions 15.5.5-014 and 16.5.0-780, and Cisco has directly contacted cloud customers showing indicators of compromise. Cisco also noted attackers may try to remove or hide evidence of exploitation.
What to do: Migrate affected appliances to the patched AsyncOS releases, review network and firewall logs outside the device for unexpected transfers to external IPs, and for suspected exploitation on virtual appliances, redeploy from a fixed image, rebuild configuration, and rotate credentials while preserving forensic evidence.
Sources: securityweek.com
AhsayCBS flaws CVE-2026-105133 and CVE-2026-105134 get new fixes after incomplete patches
Who is affected: Organisations using AhsayCBS backup software on affected versions; CISA added the flaws to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by October 17, 2026.
Ahsay released new hotfixes (v10.3.4.45 and v9.15.2.70) after earlier August patches were found not to fully fix two flaws being chained by attackers to bypass authentication and execute arbitrary commands. Huntress said threat actors used the chain to drop web shells and XMRig cryptocurrency miners on exposed systems, and has verified the new 10.3.4.45 hotfix closes the entry point still present in earlier v10 releases.
What to do: Update AhsayCBS to v10.3.4.45 or v9.15.2.70 hotfix as applicable, reboot the server after applying, and audit exposed AhsayCBS installations for unauthorised web shells or cryptominer activity.
Sources: thehackernews.com, CISA KEV / NVD, CISA KEV / NVD
Critical authenticated RCE in Langflow (CVE-2026-105740) under active exploitation
Who is affected: Users of Langflow, an open-source AI workflow platform (a DataStax/IBM project), running versions prior to 1.9.0; a honeypot recorded 1,423 exploit attempts.
CVE-2026-105740 carries a CVSS score of 9.9 and allows any authenticated Langflow user, including non-admin accounts, to execute arbitrary operating system commands on the server. The flaw stems from Langflow accepting a user-supplied command when adding an MCP server with the stdio transport and passing it directly to bash with no validation, allowlist, or sandboxing, while also permitting arbitrary environment variable injection. Successful exploitation can lead to full server compromise, lateral movement, and a persistent backdoor because the malicious MCP configuration is stored in project settings and re-executes each time the server list is loaded.
What to do: Upgrade Langflow to version 1.9.0 or later, audit MCP server configurations in project settings for any unexpected entries, and remove any that were not explicitly added.
Sources: thehackernews.com
Atlassian Multiple Products: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability (CVE-2026-21589)
Who is affected: Organisations running Atlassian Multiple Products. CISA added it to its Known Exploited Vulnerabilities list on 2026-10-15, which means attacks are confirmed.
Multiple Atlassian products (Bitbucket Data Center,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines. US federal agencies must fix it by 2026-10-18.
Sources: CISA KEV / NVD
Breaches and data exposure
UK Legal Aid Agency breach exposes records going back to 1978
Who is affected: Applicants, recipients and providers of legal aid in England and Wales whose data was held by the Legal Aid Agency; the agency reports the vast majority of stolen data covers 2007 to 16 May 2025 and that approximately 250,000 additional records predate 2007.
Attackers who breached the Legal Aid Agency’s systems in April 2025 stole sensitive applicant and recipient data from 2010 onward, including contact details, dates of birth, national ID numbers, criminal history, employment status, and financial details, as well as provider data including contracts, office locations, financial information and LAA Online Portal credentials. Follow-up analysis has now confirmed the stolen records go back to 1978, with the overwhelming majority of older records from the 1990s and 2000s. The agency, which employs around 1,250 staff and works with about 2,000 providers, has said not everyone who interacted with the system before 2007 is affected.
What to do: Anyone who applied for, received, or provided legal aid in England and Wales since 2010 should watch for official LAA notifications, change passwords on any accounts that used LAA Online Portal credentials, and monitor for suspicious activity using the personal data involved.
Sources: bleepingcomputer.com
GhostAction supply chain campaign hits 1,900 GitHub accounts and 30,000 repositories
Who is affected: Developers and organizations using GitHub; the campaign compromised about 1,900 user accounts and targeted more than 30,000 repositories across 3,000 users and organizations.
GhostAction is a supply chain attack in which threat actors use stolen Personal Access Tokens or credentials from infealer logs to push malicious GitHub Actions workflows disguised as security audit files into legitimate repositories. The malicious workflows exfiltrate CI/CD secrets, cloud credentials, package registry tokens (npm, PyPI, DockerHub), and AI provider API keys, with a new wave since August 31, 2026 attempting to extract 3,174 secrets from public repositories’ CI. GitGuardian observed a spike on October 8 and 9, 2026, with payloads evolving to add git history secret-scanning for AWS keys and related tokens.
What to do: Audit GitHub repositories for unexpected workflow files (such as security-audit.yml or github_actions_security.yml), review commit history for suspicious workflow changes, and rotate any CI/CD secrets, cloud keys, package registry tokens, or AI provider API keys that were stored in or accessible from affected repositories.
Sources: thehackernews.com
CenterPoint Energy data breach affects 1,062,060 Texas residents
Who is affected: CenterPoint Energy customers in Texas, with 1,062,060 state residents notified to the Texas Attorney General’s Office; customers in Indiana, Minnesota, and Ohio may also be affected but the total is not yet confirmed.
CenterPoint Energy disclosed to the Texas Attorney General’s Office that names, addresses, Social Security numbers, and driver’s license numbers were compromised in a breach the company learned about after a threat actor posted on a cybercrime forum claiming to hold nearly 7.5 million user records. On September 12 the hacker released a 2.5-gigabyte archive allegedly containing about 3 million phone numbers along with other personal information. Notification letters to affected individuals do not yet appear to have been sent.
What to do: Texas CenterPoint Energy customers should monitor for an official notification letter, watch financial and utility accounts for suspicious activity, consider placing a fraud alert or credit freeze, and follow the guidance on CenterPoint Energy’s breach notification page once it is published.
Sources: securityweek.com
Scams and phishing
Microsoft disrupts YAM Store phishing marketplace behind over a billion scam messages
Who is affected: Organizations in healthcare, financial services, wholesale distribution, and IT across Japan, the United States, Australia, and India; the kits and accounts sold through the marketplace were used to target over 75,000 organizations since January 2026.
Microsoft, working with Resecurity, identified YAM Store (tracked as Storm-3119) as a marketplace that sold three phishing kits, CoGUI/NX/FA, Haozi/Phoenix, and Iron Man System (grouped as Storm-2990), along with access to compromised or fraudulently obtained Microsoft and Google cloud environments, accepting cryptocurrency payments. The kits provided country-specific brand-impersonating templates, and operators used stolen application credentials to take over cloud accounts, reset passwords, assign licenses, and convert SharePoint and OneDrive storage into phishing hosting. Microsoft said the operation has helped facilitate more than one billion phishing emails and SMS messages targeting over 75,000 organizations since January 2026.
What to do: Organizations should review SharePoint, OneDrive, and other cloud tenants for unauthorized apps, license assignments, or password resets; verify that no accounts were fraudulently created using their domains; and remind staff to treat unsolicited emails and SMS messages impersonating known brands with caution.
Sources: helpnetsecurity.com
Arrests and takedowns
North Macedonian police arrest alleged administrator behind OLVX cybercrime market
Who is affected: Cybercriminal marketplace users; the FBI said OLVX had over 1,500 seller accounts and endangered the digital security of thousands of American citizens.
Police in North Macedonia, working with the FBI, arrested the alleged administrator of the OLVX cybercrime marketplace at his home in the village of Golema Rečica. The marketplace, active between 2023 and 2025, sold stolen personal data and login credentials, and the suspect also ran a Telegram group called ONEMILI offering fraud-related tools. Police said evidence was found indicating the suspect had acquired child sexual abuse material via Telegram.
What to do: Businesses and individuals should check whether their personal data or credentials have appeared in breach notifications, reset passwords on accounts that may have been exposed, and monitor accounts for unauthorised activity.
Sources: therecord.media