Cisco gab am Abend des 14. Oktober bekannt, dass derzeit Angriffe auf sein Secure Email Gateway beobachtet werden. Demnach ermöglicht CVE-2026-76519 das Schreiben beliebiger Dateien sowie die Ausführung von Befehlen mit Root-Rechten auf dem zugrunde liegenden Betriebssystem (AsyncOS) - sofern bestimmte Konfigurationen vorliegen. Die Schwachstelle wird mit 9.8 von 10 als „kritisch“ bewertet.

IT-Sicherheitsverantwortliche sollten schnellstmöglich aktiv werden:
https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297701-1032

Nutzt wer #Cisco Secure Email Gateway (SEG)? Patchen

https://borncity.com/blog/2026/10/15/angriffe-auf-kritische-schwachstelle-cve-2026-76519-in-cisco-secure-email-gateway/

‼️ WARNING - Cisco confirms active, in-the-wild exploitation of a new critical flaw (CVE-2026-76519 // CVSS 9.8) in Cisco Secure Email Gateway.

Unauthenticated attackers can achieve full root command execution simply by sending an email with a crafted attachment.

Details >> https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html

🚨 NEW on CISA KEV — exploited in the wild

🛡 Cisco Secure Email Gateway
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
CVE: CVE-2026-76519 · patch by 2026-10-17

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.

🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-76519
#cybersecurity #KEV #CVE #infosec

Attackers are exploiting CVE-2026-76519 (CVSS 9.8), a critical Cisco Secure Email Gateway vulnerability allowing root RCE via attachments. Patch right now.

#CVE202676519 #Cisco #EmailSecurity #AsyncOS #RCE #ZeroDay #Cybersecurity

https://securityonline.info/cisco-secure-email-gateway-cve-2026-76519-exploited/?utm_source=mastodon&utm_medium=jetpack_social

Cisco Secure Email Gateway: CVE-2026-76519 (CVSS 9.8) sfruttata attivamente. Email con allegato crafted → file write e comandi come root, senza auth. Solo con File Reputation attivo e Content Scanner Tools < 25.3.0.5525.

Nessun workaround. Fix: Content Scanner Tools 25.3.0.5525 (no restart) o AsyncOS 15.5.5-014 / 16.5.0-780. Check: grep "System Security" system_logs su ogni nodo, poi log rete/firewall.

#cybersecurity #infosec https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

Neu Warnung:
Kritische Sicherheitslücke in Cisco Secure Email Gateway - aktiv ausgenutzt - Updates verfügbar - CVE-2026-76519 https://www.cert.at/de/warnungen/2026/10/kritische-sicherheitslucke-in-cisco-secure-email-gateway-aktiv-ausgenutzt-updates-verfugbar-cve-2026-76519

Tracked as CVE-2026-76519, this vulnerability stems from a relative path traversal weakness in SEG's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/

I forgot to mention that Palo Alto listed these IOC for CVE-2026-0322 exploitation:

• 66.42.72.14
• 208.83.239.114
• 149.248.47.234

Fanged for your pleasure. No open source information on them Vultr IPs outside of today's disclosure.

#threatintel #paloaltonetworks #zeroday #IOC #KEV

And a Palo Alto Networks zero-day too

https://security.paloaltonetworks.com/CVE-2026-0322

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

Palo Alto Networks has released security updates for a high-severity PAN-OS remote code execution zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. Customers are advised to apply the updates. https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/

En las últimas 24 horas, destacan avances en reconocimiento de voz con Grok Voice 3.0, nuevas amenazas como "lombrices" de IA que comprometen dispositivos domésticos, explotación crítica en Chrome creada con IA y vulnerabilidades activas en firewalls PAN-OS; mientras comunidades liberan datos de Cobalt Strike y Vercel refuerza su programa de recompensas tras detectar un zero-day en Linux. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 15/10/26 📆 |====

🚀 PRESENTACIÓN DE GROK VOICE 3.0: EL MODELO DE RECONOCIMIENTO DE VOZ MÁS INTELIGENTE

Grok Voice 3.0 revoluciona la atención al cliente con un sistema de reconocimiento de voz capaz de resolver llamadas en menos de un segundo. Además, su diseño eficiente reduce considerablemente los costos frente a otros modelos líderes, marcando un avance significativo para empresas que buscan mejorar la experiencia del usuario y la operatividad. Descubre cómo esta innovación puede transformar los servicios de voz en tu negocio. Más detalles aquí 👉 https://djar.co/J3NWb

🪱 SEÑALES DE VIDA PARA “LOMBRICES” DE IA EN DISPOSITIVOS DOMÉSTICOS

Anthropic ha identificado indicios preocupantes: “lombrices de IA” que podrían colonizar dispositivos domésticos, vulnerando la seguridad de nuestros hogares conectados. Esta investigación abre un debate crucial sobre las amenazas emergentes en el internet de las cosas y la necesidad de fortalecer las defensas frente a códigos inteligentes que se propagan de manera autónoma. Infórmate sobre estos riesgos y recomendaciones para proteger tus dispositivos. Lee más aquí 👉 https://djar.co/Y6yFm

💻 CADENA DE EXPLOTACIÓN EN CHROME DESARROLLADA CON IA VALORADA EN 250,000 DÓLARES

XBOW ha utilizado un modelo abierto de OpenAI para construir en apenas seis días una cadena completa de exploits en el navegador Chrome que facilita la ejecución remota de código en sistemas Windows. Esta hazaña resalta tanto el poder de las herramientas de IA para la seguridad ofensiva como la importancia crítica de mantener los sistemas actualizados. Google ya ha corregido las tres vulnerabilidades relacionadas. Conoce los detalles técnicos y cómo protegerte aquí 👉 https://djar.co/buCU

🔥 ALERTA DE VULNERABILIDAD RCE EN PAN-OS EXPLORADA EN ATAQUES REALES

Palo Alto Networks ha emitido parches urgentes para una vulnerabilidad de ejecución remota de código (CVE-2026-0322) detectada en su sistema operativo PAN-OS, utilizada activamente en campañas dirigidas contra firewalls. Esta amenaza de alta gravedad exige revisión inmediata para evitar compromisos críticos en la infraestructura. Descubre cómo actualizar tu sistema y mitigar este riesgo ahora mismo. Más información aquí 👉 https://djar.co/VXdS

📊 LIBERACIÓN DEL CORPUS COMPLETO DE BEACONS DE COBALT STRIKE PARA INVESTIGACIÓN

Fox-IT ha puesto a disposición la base de datos completa con 56,843 llamadas de beacon y sus configuraciones provenientes de Cobalt Strike, una herramienta común en ataques cibernéticos. Esta liberación masiva apoya a la comunidad de seguridad tanto en la defensa como en la ofensiva, facilitando análisis detallados para la detección temprana y respuesta frente a campañas maliciosas. Explora este recurso indispensable para profesionales de la ciberseguridad. Accede aquí 👉 https://djar.co/z5Ph

💰 RECOMPENSAS Y VULNERABILIDAD ZERO-DAY EN VERCEL: UN MILLÓN DE DÓLARES EN JUEGO

Vercel reveló un programa de recompensas que ha pagado 242,000 dólares tras 1,285 reportes, destacando la detección de una vulnerabilidad zero-day en entornos Linux. Aunque no hay indicios de robo de datos, esta situación enfatiza la importancia de la colaboración entre hackers éticos y empresas para blindar infraestructuras críticas. Entérate cómo Vercel gestiona la seguridad y el impacto de esta vulnerabilidad. Más detalles aquí 👉 https://djar.co/lU8Oh

Palo Alto Networks patched the PAN-OS CVE-2026-0322 zero-day vulnerability exploited in limited attacks to achieve root code execution on firewalls.

#PaloAltoNetworks #PANOS #CVE20260322 #ZeroDay #Cybersecurity

https://meterpreter.org/pan-os-cve-2026-0322-zero-day/?utm_source=mastodon&utm_medium=jetpack_social

🚨 Rapid Response: Ivanti Connect Secure Authentication Bypass (CVE-2026-104935)

Ivanti confirms active exploitation of a high-severity (CVSS 8.6) authentication bypass vulnerability in Ivanti Connect Secure that allows unauthenticated attackers to execute arbitrary commands. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 13.

Censys currently observes 7,604 Internet-exposed hosts and 269,319 web properties running Ivanti Connect Secure, excluding honeypots. These are total product exposures, not confirmed vulnerable systems.

Full Censys ARC advisory, including affected versions, available patches, and remediation guidance: https://censys.com/advisory/cve-2026-104935/

#CensysARC #Ivanti #Cybersecurity #VulnerabilityManagement #InfoSec

**Latest Global Updates (October 14-15, 2026)**

Cybersecurity: CISA urged immediate updates for Ivanti Connect Secure due to an actively exploited zero-day (CVE-2026-104935) found on Oct 14, 2026, enabling remote command execution. A global operation also disrupted a massive cybercriminal phishing network.

Technology: Samsung hosted its Future Wireless Summit on Oct 15, 2026, focusing on advancements in 6G and AI.

Geopolitics: FBI Director Kash Patel is reportedly in Russia (Oct 14-15, 2026) for high-level discussions on Ukraine and bilateral relations.

#AnonNews_irc #Cybersecurity #News

Attackers exploited a flaw in Nextcloud’s Collabora Online - Built-in CODE Server add-on (richdocumentscode) to plant web shells on servers.

The attack was possible only while the local document server was inactive, such as during a restart.

The flaw allowed remote commands with the permissions of the web server user.

Attackers were seen searching for files containing passwords and crypto wallets; there are no re…

https://en.hacks.gr/keno-asfaleias-sto-nextcloud-epitrepei-tin-klopi-eyaisthiton-dedomenon/

#Nextcloud #CollaboraOnline #WebShells #CVE2026110447

Nextcloud : des serveurs piratés via une faille critique de l’application Collabora Built-in CODE https://www.it-connect.fr/nextcloud-collabora-built-in-code-faille-webshell-cve-2026-110447/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

GhostPat : cette faille critique Docker Hub permettait d’usurper n’importe quel utilisateur https://www.it-connect.fr/docker-hub-faille-ghostpat-cve-2026-105445/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Docker

Docker Hub Security Advisory: CVE-2026-105445 | Docker #devopsish https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/

Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules

Drupal has shipped fixes for a critical flaw in its core Field UI module (CVE-2026-108097) that could let an attacker run code on a site’s server, The Hacker News reports. The flaw cannot be reached through core alone, but several exploit paths exist through contributed modules, at least one requiring no login; fixes are in Drupal 11.4.10, 11.3.19 and 10.6.19. https://thehackernews.com/2026/10/drupal-patches-critical-core-rce-flaw.html

Drupal has shipped fixes for a critical remote code execution vulnerability in its Field UI module, tracked as CVE-2026-108097.

The flaw cannot be reached through core alone, but requires contributed modules or custom code.

Over 150,000 reporting sites were on unsupported branches receiving no update.

Patches are available in versions 11.4.10, 11.3.19, and 10.6.19, with temporary mitigation options available for administrators una…

https://en.hacks.gr/epeigoyses-diorthoseis-asfaleias-apo-to-drupal-gia-sovaro-provlima-apomakrysmenoy-elegchoy/

#Drupal #CVE2026108097 #PHP #WebDev

The cURL CVE-2026-92392 vulnerability enables remote code execution during HTTP/2 uploads. Update to cURL 8.23.0 or disable HTTP/2 to protect systems.

#cURL #CVE202692392 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/curl-cve-2026-92392-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

A SiteGuard Server Edition vulnerability, CVE-2026-106931, is exploited in the wild and grants root or SYSTEM access. Update to Ver8.00 Update 5 now.

#SiteGuard #CVE2026106931 #ExploitedInTheWild #WAF #CommandInjection #JPCERT #PatchNow #CyberSecurity

https://securityonline.info/siteguard-cve-2026-106931-exploited/?utm_source=mastodon&utm_medium=jetpack_social

Ahsay Backup has issued new updates for AhsayCBS addressing two vulnerabilities, designated as CVE-2026-105133 and CVE-2026-105134, after finding that previous August patches were incomplete.

Researchers observed the flaws being chained to achieve unauthenticated remote code execution, web shells, and cryptocurrency miners.

New fixes are available in v10.3.4.45 and v9.15.2.70 hotfixes, and users are urged to reboot servers.

https://en.hacks.gr/nees-diorthoseis-asfaleias-apo-tin-ahsay-backup-gia-to-ahsaycbs-meta-apo-ellipi-metra/

#Ahsay #CVE2026105133 #Vulnerability #Patch

CVE-2026-105133 CVE-2026-105134 AhsayCBS Authentication Bypass and Command Injection: Technical Response & SOC Investigation Brief https://thecybermind.co/z2es

AhsayCBS authentication bypass and command injection require a coordinated response. This combined technical brief covers updated remediation, reported exploitation, investigation priorities, and detection-validation boundaries—while keeping backup recovery assurance in focus....

Unit 42 reveals how CL-STA-0954 deploys PEERSTITCH malware after a FortiManager breach, using FortiOS PEERSTITCH malware to hijack firewalls.

#PEERSTITCH #Fortinet #FortiManager #CVE202447575 #Unit42 #Cybersecurity #InfoSec

https://securityonline.info/fortios-peerstitch-malware-fortimanager/?utm_source=mastodon&utm_medium=jetpack_social

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Unit 42 has uncovered PEERSTITCH, a novel memory-resident malware deployed in an intrusion that began with exploitation of a FortiManager flaw (CVE-2024-47575) against a telecommunications organization. The attackers exfiltrated configurations, cryptographic material and database files covering more than 500 managed FortiGate firewalls, then used a second FortiOS flaw to deploy the implant. https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

Hey Palo, this doesn't distract from CVE-2026-0332. Yeah, yeah, I know, they do it too.

https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/