Verdict cards

AI-generated, unreviewed. A DLL sideloading flaw in Siemens Software Center is reported exploited through ClickFix lures to deliver a remote access trojan. Today, find any installs, update them to 4.0.9.8 or later, and hunt for SiemensSoftwareCenter.exe launched by msiexec.exe.

AI-generated, unreviewed. Reported in-the-wild exploitation of chained Plex Media Server flaws days after an October 16 public PoC, dropping XMRig and a Linux reverse-proxy backdoor. Today: find any Plex Media Server in the estate, update to 1.43.3.10861 or later, take it off the internet and hunt for shells or miners spawned by Plex.

AI-generated, unreviewed. Attackers are reported to be taking over Dahua IP cameras, NVRs and DVRs through the Easy4IP P2P relay, weak passwords and two 2021 authentication bypasses, then planting a backdoor account. Today: find every Dahua device, disable P2P, block TCP 37777 from the internet, and check device accounts for p2pwn or unknown users.

ARTEX, PentAGI, Cairn, CyberStrikeAI and Hexstrike are interchangeable open-source wrappers around one LLM-driven loop, now run by PRC-nexus UNC7228, VAPOR PANDA, Storm-0940, DPRK operators and CERT-In's "Crafty Falcon" (GTIG Nov 2; CrowdStrike Oct 22/30). Name-based IoCs age out with the next fork, so this pack hunts the six loop properties no fork removes — burst/pause tempo, permission probing, retry-with-variation, kill-chain compression, the commodity tool chain, supplied credentials — plus a canary tripwire. Re-issued Nov 9 with Check Point's panel census (1,608 live, runs autonomous after goal entry) and Microsoft's Storm-3358 financial-sector report: thirteen Splunk/ES|QL hunts, a step-by-step deception runbook with a fake-win decoy, lab baselines scoped to reset the thresholds from recordings.

CISA lists CVE-2026-119977 as known exploited. It is a WordPress Core TOCTOU race during full-package core upgrades that could allow unauthenticated code execution, and the federal due date is 2026-11-06. Today: inventory WordPress sites, patch to the fixed release, and hunt web logs for requests into upgrade staging paths.

A remotely triggerable use-after-free in the Linux kernel's IPv4 TCP code. It is reached by SYNs carrying IP Record Route or Timestamp options to any listening port, and Anthropic reported a root exploit for it. Today, patch RHEL 8/9/10 to the fixed kernels, apply Red Hat's nftables drop rule where you cannot patch, and inventory kernel versions.

Attackers used an authentication bypass in internet-exposed Copeland XWEB controllers (firmware 1.12.1 and earlier) to change refrigeration settings across Europe, spoiling stock in some cases. Today, find out whether you or your facilities providers run XWEB. If any are internet-facing, take them off the internet and update the firmware.

Two separate actors are reported using WinRAR CVE-2025-8088 RAR lures that plant Startup-folder persistence. Gorbag targets Ukraine and Silent Lynx targets CIS governments. Today, confirm WinRAR is patched fleet-wide and run the Startup-folder and Telegram exfiltration hunts.

A fake cPGuard update reached customer servers for about 70 minutes, ran a root script, planted a hidden root shell and temp files, and sent data out. Today, find every cPGuard host and every hosting provider that runs cPGuard. Image any host that ran 5.88.12–5.88.19 before moving it to 5.88.25 or later.

VulnCheck observed attackers exploiting an unauthenticated Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices to deploy flows that fetch a Linux bot and plant /cmd-style webshells. Today, find any Node-RED without adminAuth or reachable from untrusted networks, lock it down or update IoT2050 to 4.3.4.1, and hunt for the reported IPs and drop paths.

Attackers are attempting to exploit an unauthenticated authorization bypass in CryptoPayment Gateway plugin 1.2.1–1.2.2, and no fix exists. Today, find out whether any WordPress site runs this plugin. If one does, remove it and rotate the wallet credentials it stores.

Synology reports C3RB3R ransomware actors exploiting a patched flaw in outdated DSM to encrypt data and extort ransom, and customers report infections. Today, confirm every Synology NAS runs a fixed DSM build, take DSM management interfaces off the internet, and hunt for .L0CK3D files and read-me3.txt notes.

Unit 42 reports an espionage cluster that targeted government-linked Linux web and database servers from Oct 2025 to Apr 2026, using PHP web shells, three credential-harvesting methods and a Go RAT over WebSocket. Today, hunt Linux PHP hosts for the listed behaviours and IoCs, check PHP login pages and .bashrc files for tampering, patch CVE-2021-4034 and restrict outbound traffic from servers.

Microsoft reports two unattributed intrusions that went from a Teams 'IT support' chat and a Quick Assist session to domain-level credentials through misconfigured AD CS. There is no patch. Today, hunt for external Teams contact followed by Quick Assist, and audit AD CS templates (ESC1) and Web Enrollment EPA/NTLM settings (ESC8).

A race condition in WordPress Core's full-package update process can allow unauthenticated RCE through predictable, web-accessible staging directories. Confirm every WordPress site is on 7.1.4 or a backported fixed release today, and hunt web logs for requests to staged setup-config.php paths.

Unit 42 says CL-STA-0954 (UNC5820) breached a telecom MSP's FortiManager via CVE-2024-47575, then used CVE-2025-61624 to inject PEERSTITCH into miglogd and iked on managed FortiGates [S1][S5]. CISA lists CVE-2025-61624 as exploited [S3][S4]. Today: capture evidence before rebooting, run the four hunts, rotate secrets held in device configs, and apply FG-IR-26-122 or its virtual patch [S6].

Reporting says attackers have exploited an unauthenticated command injection in Nextcloud's built-in CODE server app (richdocumentscode) before 26.4.303 since September 10. They dropped PHP web shells and searched for credentials and wallets. Today, find every Nextcloud with richdocumentscode, upgrade or remove the app (disabling is reported as insufficient), and hunt access logs back to September 10.

A malicious build (2.1.313) of the Claude Code extension was distributed through the Cursor Marketplace for about 11 hours on Oct 29, 2026, reaching at most 5,000 users [S1]. Today, find any developer host that received it, then hunt for the 'svc-telemetry' SSH key, IDE-spawned persistence and traffic to 134.209.82.225.

Fake AUR packages posing as the yay and paru helpers reportedly ran a remote shell script with root privileges at install time. Today, find any Arch Linux hosts, hunt for the package name 'yyay' and for install-time fetches from the Wayback Machine or GitFlic, and rebuild any host that hits.

One trade report says a campaign used stolen GitHub credentials to add fake 'security audit' workflows that try to pull CI/CD, cloud, registry and AI secrets. Today, search your GitHub organisations for the two named workflow files. Rotate any secret reachable from a repository where they appear.

Citizen Lab reports that an Israeli ad firm's targeted ad placements delivered Candiru (DevilsTongue) spyware with no click to at least 45 Al Jazeera devices in 2024-2025. Today, pull Citizen Lab's indicators, hunt proxy and DNS logs from high-risk staff devices for the ad-to-validation-to-C2 sequence, and consider ad-blocking for those users.

One secondary report says an authentication-bypass zero-day in Ivanti Connect Secure has been exploited since October 1, that honeypots logged 105 exploit attempts, and that a July fix only partly addressed it. Today, inventory every Connect Secure appliance, check Ivanti's own advisory for fixed builds and mitigations, and preserve appliance logs from October 1.

Two chained AhsayCBS flaws give unauthenticated remote code execution and have been exploited to drop web shells and XMRig miners. Earlier patches were incomplete. Apply hotfix v10.3.4.45 or v9.15.2.70 and reboot today, then hunt exposed servers for web shells and miners.

Cisco reports active exploitation of an unauthenticated file-write flaw in Secure Email Gateway that can lead to root command execution. Today, check each gateway's Content Scanner Tools version and File Reputation setting, then run Cisco's 'System Security' log check.

Any authenticated Langflow user before 1.9.0 can run shell commands by adding an MCP server with Stdio transport. Honeypots show attempts to exploit it. Today, find every Langflow instance, upgrade to 1.9.0, disable auto-login and hunt the MCP server endpoint.

Cisco Talos reports that UAT-11473 exploited a CVSS 10 authentication bypass in Cisco Catalyst SD-WAN Controllers and installed KeyDrift, which steals keying material [S4]. Today, confirm every SD-WAN controller runs Cisco's February 2026 update or later, apply Cisco's SD-WAN hardening guide [S1], and hunt each controller for on-box artifacts. Patching does not remove a prior compromise.

An authenticated attacker who can reach the PAN-OS management interface can run code as root on PA-Series, VM-Series and Panorama. Palo Alto Networks reports limited exploitation. Today, restrict management access to trusted internal IPs, enable Threat Prevention signatures and search logs for the three published IPs.

CrowdStrike reports a China-nexus espionage campaign that used the ARTEX agentic AI framework, with post-exploitation confirmed at nine organizations, including US financial-sector targets. Today: run the ARTEX, sideloading and IOC hunts, and confirm SAML signature validation, IMDSv2 and cloud command-execution permissions.

A malicious script served from DebugBear's RUM CDN was designed to hijack logged-in Polymarket sessions and move funds to an attacker wallet. Today, check whether any of your websites embed DebugBear RUM and remove the embed if so, then hunt proxy and DNS logs for the script path and data.debugbear.com.

A roundup report citing VulnCheck says attackers are exploiting a CVSS 9.8 RCE in Gotenberg, patched in May 2026, to deliver a Go reverse shell. Today: find every Gotenberg instance, patch it, restrict its exposure, and hunt for unexpected child processes and 'cache_base'.

A low-severity ESXi logging flaw (CVSS 2.7) was reportedly used by the China-nexus actor Warp Panda to perform admin operations without being logged. Patch ESXi today, then hunt for audit-log gaps on ESXi/vCenter and for new MFA device registrations in M365.

A missing-authorization flaw in the Drupal Commerce Core module is reported as actively exploited. Today, find Drupal sites running Commerce Core, upgrade to a fixed release, then audit orders for inconsistencies.

Researchers report that Volt Typhoon routes operations through chained SSH hops on compromised SOHO, IoT and enterprise devices, and exploited at least four zero-days in SD-WAN and IT-management products. Today, inventory the named products, take their admin interfaces off the internet, and hunt for unusual SSH and admin activity on them.

Unauthenticated remote DoS in Cisco ASA and FTD SSL VPN when secondary authentication is configured, reported exploited in the wild. Today: find ASA/FTD devices with SSL VPN and secondary auth, apply Cisco's fixed release, and review recent unexpected reloads.

An unauthenticated SQL injection in Oracle E-Business Suite (CVSS 9.8) that reportedly chains to remote code execution is being probed, with exploratory attempts seen on decoys. Apply the October 2026 CPU to EBS today, internet-facing instances first, and hunt web logs for injection attempts against EBS.

CVE-2026-41709 is a low-severity ESXi flaw. It lets someone who already has admin access perform some operations without being logged. CrowdStrike, as reported by The Hacker News, says Warp Panda used it as a zero-day in early 2026, and CISA has listed it in KEV. Today: confirm ESXi builds against Broadcom's July 2026 fixed versions, patch, and review ESXi and vCenter audit logs for gaps.

Two unauthenticated RCEs in PHP core (CVE-2026-109618/109619, CVSS 9.2), leaked pre-disclosure, patched Oct 21 (8.5.12/8.4.27/8.3.36/8.2.35; EOL ≤8.1 gets no fix). Exploited in the wild (watchTowr); mass probing (Cloudflare: millions), Potassium botnet delivery attempts. CISA KEV Oct 26, federal due Oct 29; OT/ICS vendors confirm affected products Oct 27. Concrete hunt behaviors published.

Stolen vendor app credentials minted Graph tokens across ~2,250 M365 tenants from Oct 15; Storm-0940 (China-aligned) via ARTEX agentic AI per Microsoft. No CVE — identity abuse: hunt the seven appIds (ex-customers too, per Sophos), review Entra audit since Oct 13. Microsoft + Huntress hunting content published.

Hijacked release workflow published a backdoored 1.107.0 to PyPI/Docker/GHCR on Oct 21 (~2h window): privcollect credential stealer runs at every Python start plus an hourly remote-code loader; stolen AWS creds confirmed abused (Bedrock/LLMjacking). If installed: isolate, rebuild, rotate everything. Socket flagged in ~50 min; OSV MAL-2026-2144 — SCA is the detection here.

Ten weeks of AiTM/device-code phishing capturing post-MFA sessions, replayed from 1337 Services /24: 497 successful sign-ins at 79 orgs, rogue Entra devices, MFA wipe-and-replace, hidden inbox rules for BEC/payroll fraud. Nothing to patch — properly scoped Conditional Access blocked it cold in four orgs; hunt the four behavior families and close CA gaps.

CVE-2026-102764 (BT26-05, CVSS 9.3) auth bypass exploited as a zero-day since late August by China-nexus ARMORY CASTLE (UNC5221): SAWFLY webshell, root via SUID, vault dump, reboot-surviving persistence. KEV Oct 16, federal deadline Oct 19. Assume-compromise for internet-facing appliances: hunt back to August, rotate the vault on any hit.

CVSS 10.0 unauthenticated RCE (CVE-2026-110264) in the bundled Onigmo regex engine, reaching every self-managed release since 7.0. Patch trap: Oct 12 patches do not cover it. Public PoC circulating; no exploitation reported; GitLab shipped two Sigma detections; scanners had nothing published as of Oct 23.

10 CVEs fixed 2026-10-21 (4 high). Brotli decoder OOB write (CVE-2026-111497) demonstrated as code execution — no ITW exploitation, not in KEV, no vendor workarounds. Detection coverage: Qualys QID 389117 only; Tenable/Rapid7/EDR/WAF/container scanners had published nothing as of Oct 23.

Eight eMudhra intermediate CA certs with trivially recoverable keys (one key was the number 4); browsers blocked Oct 17–20, Chrome removes the emSign G3 root Oct 27 — expect PKIX breakage. No malicious use observed: certificate inventory and replacement, not hunting. Talos Snort SIDs 67363–67374.