THE CYBERSECURITY BRIEFING
Daily reporting. Deeper analysis. Follow the evidence behind the headlines.
HIGHLIGHT OF THE DAY
Cybersecurity · In depth· 4 min read
Cisco has confirmed active exploitation of an email-gateway flaw that can give unauthenticated attackers root access. A fix shipped in September, but the new warning and October 17 federal deadline make compromise assessment as important as checking installed updates.
Cybersecurity
AT A GLANCE
Volexity reported that an unknown actor, tracked as UTA0576, exploited a three-vulnerability zero-day chain to compromise Ivanti Connect Secure appliances, including a fully patched appliance running version 22.8R2.4. The campaign reportedly enabled credential collection, configuration-data exfiltration and network reconnaissance.
Why it matters For ICS administrators investigating possible intrusion, being fully patched was not sufficient to exclude compromise in this case.
HelpNet Security ↗Cyble says its global honeypot sensors recorded attempts against about 20 vulnerabilities, including newly disclosed flaws in WordPress, Apache Solr and Langflow, as well as older embedded-device vulnerabilities. Its report also notes that CISA issued 14 industrial-control-system advisories covering 54 vulnerabilities, 13 rated critical; the listed affected products include Toptech Systems TMS7 and TopHAT, Lantronix gateways and MikroTik RouterOS.
Why it matters For operators running the affected Langflow releases, the reported flaw can turn unauthenticated API access into privileged code execution; the sensor findings make this more than a disclosure-only concern.
Cyble ↗The U.S. Justice Department alleges that two arrested men and co-conspirators helped North Korean IT workers use stolen or fabricated identities to obtain jobs at more than 70 U.S. companies, generating about $3 million from 2019 to mid-2025. The FBI searched more than 40 suspected laptop farms in Texas and seized about 187 laptops and KVM devices; authorities say some workers accessed sensitive personal data and used threats or extortion.
Why it matters For employers and people whose records these workers could access, the exposure extended beyond fraudulent payroll: the FBI reports data exfiltration and isolated attempts to extort information owners.
HelpNet Security ↗LESS NOISE. MORE CONTEXT.
Rapid7 disclosed CVE-2026-108065, a SQL injection flaw in Channel Software WebAlliance eCommerce that it rates CVSS 9.8. The researcher says an unauthenticated attacker can read database information, including personal data and passwords, and may run system commands if the database account has high privileges. Rapid7 recommends blocking access to /preapproval.asmx and says it received no response from the vendor before publication.
What changed Private vendor outreach beginning August 28 gave way to public disclosure on October 14, with Rapid7 reporting no vendor response.
Why it matters For distributors and manufacturers using WebAlliance, database permissions help determine the potential damage: customer information and passwords are exposed, while administrative database access can extend the attack to server commands.
What to watch next Whether Channel Software will provide a fix or vendor guidance remains an open question; no response was reported before publication.
Rapid7 ↗CISA added CVE-2026-0322 in Palo Alto Networks PAN-OS, CVE-2026-76519 in Cisco Secure Email Gateway, and CVE-2026-105133 and CVE-2026-105134 in AhsayCBS to its KEV catalog, citing evidence of active exploitation. The agency urges organizations to prioritize remediation and says federal civilian agencies must follow the requirements in Binding Operational Directive 26-04.
Why it matters For federal civilian agencies, the alert has operational consequences beyond patch prioritization: the cited directive also sets expectations for checking whether attackers compromised systems before patching.
US Certs Alerts ↗Cyble says its investigation of mParivahan- and eChallan-themed malicious apps revealed GhostX, an operator-managed ecosystem linking phishing, backend services, device management and GhostBat RAT distribution in India. The latest GhostBat variant uses Android Accessibility Service overlays to capture PIN entry in legitimate Google Pay and MobiKwik apps, and Cyble says it targets 60 banking, payment and financial apps. The report also describes changing SMS lures and phishing URLs, multiple loader methods and Firebase-based configuration that can alter command-and-control settings and selected capabilities.
What changed Earlier samples used native AES-CBC loaders; subsequent variants added custom containers, split-APK delivery and in-memory loading, broadening the delivery mechanisms defenders must recognize.
Why it matters For infected Android users in India, a genuine Google Pay or MobiKwik PIN screen is not assurance that input remains private: GhostBat captures touches while passing them through to the real app.
Cyble ↗A report cited by the Schneier Blog says hackers took control of software regulating supermarket refrigeration units in France and ordered some units to heat overnight; one affected chain reportedly said temperatures reached 50°C. Danfoss did not confirm reports of the units reaching that temperature and said the affected cold units were older models whose security software could not be updated.
Why it matters For supermarkets operating the affected older units, a routine security update is not an available remedy, making this a legacy-equipment exposure rather than simply an overdue-patching problem.
Schneier Blog ↗