Weekly Threat Landscape Digest – Week 44

October 30, 2026
Alert Advisory, CVE, Cyber Threat Intelligence, Threat Hunting Insights
  1. WordPress Core 22 Vulnerabilities Including RCE Race Condition – Update to 7.1.4

Overview

  • WordPress 7.1.4 addresses 22 security vulnerabilities in the content editor, Customizer, Interactivity API, administrative interfaces, and content blocks.
  • Key issues: a race condition in the core update process leading to potential remote code execution (RCE), multiple stored XSS flaws, prototype pollution, information disclosure, and authorization weaknesses.

Impact

  • RCE via race condition in the update process.
  • Stored XSS in personal data erasure requests, block delimiters, Customizer selective refresh, JavaScript URL bindings, block labels, event-handler bindings, and file uploads via Interactivity Router.
  • Disclosure of unpublished Customizer changes to unauthenticated visitors.
  • Authorization bypass letting custom roles with comment-moderation permissions read, edit, or delete post notes.
  • Prototype pollution enabling stored XSS. DoS through improper binding in the Interactivity API.

Affected / Fixed Versions

  • WordPress 7.1 → 7.1.4; 7.0 → 7.0.8; 6.9 → 6.9.11; 6.8 → 6.8.12; 6.7 → 6.7.11; 6.6 → 6.6.11; 6.5 → 6.5.14; 6.4 → 6.4.14; 6.3 → 6.3.14; 6.2 → 6.2.15; 6.1 → 6.1.16; 6.0 → 6.0.18.
  • WordPress 5.9 through 5.0: update to applicable patched releases. 4.9 → 4.9.35; 4.8 → 4.8.34; 4.7 → 4.7.39.

Recommendations

  • Immediately update to WordPress 7.1.4 or the corresponding patched version for your branch.
  • Verify deployed versions across production and staging. Confirm automatic background updates actually installed.
  • Upgrade unsupported installations to supported releases rather than relying on outdated backports.

Reference Links

  1. Adobe Connect, Campaign Classic, Creative Cloud, and Substance 3D Painter Critical and High-Severity Vulnerabilities

Overview

  • Adobe released security updates for Adobe Connect, Campaign Classic, Creative Cloud Desktop, and Substance 3D Painter.
  • Vulnerabilities include arbitrary code execution, privilege escalation, security feature bypass, memory exposure, OS command injection, SQL injection, code injection, reflected XSS, buffer overflow, and out-of-bounds read.

Impact

  • Arbitrary code execution, privilege escalation, security control bypass, and exposure of sensitive memory data. Confidentiality, integrity, and availability at risk.

Affected / Fixed Versions

  • Adobe Connect Desktop: affected Windows 2026.8.51 and earlier; macOS Apple Silicon 2026.08.45 and earlier; macOS Intel 2026.01.39 and earlier. Fixed: Windows 2026.9.61; macOS Apple Silicon 2026.10.66; macOS Intel 2026.10.170.
  • Adobe Connect Mobile: Android 4.4 and earlier; fixed in 4.5.
  • Campaign Classic ACC v7: 7.4.4 build 9402 and earlier; fixed in build 9403.
  • Creative Cloud Desktop (Windows): 6.10 and earlier; fixed in 6.11.
  • Substance 3D Painter: 12.1.5 and earlier; fixed in 12.2.

Recommendations

  • Update all affected Adobe products to the latest fixed versions.

Reference Links

  1. Jenkins Core High-Severity Vulnerabilities Including XStream Deserialization RCE (CVE-2026-117612)

Overview

  • Jenkins released security updates addressing multiple vulnerabilities in Jenkins Core.
  • High-severity flaws include RCE, account takeover, arbitrary file access, XSS, race conditions, and insufficient session expiration. Medium-severity issues include missing permission checks and path traversal information disclosure.

Impact

  • CVE-2026-117612: improper handling of the resolves-to attribute may allow RCE via XStream deserialization.
  • CVE-2026-117613: stored XSS via crafted job configuration files.
  • CVE-2026-117614: arbitrary code execution via agent launch command approval bypass.
  • CVE-2026-117615: arbitrary file read via symbolic link following during item renaming.
  • CVE-2026-117616: unauthorized configuration file access/modification via agent name path traversal.
  • CVE-2026-117617: race condition in artifact extraction allowing arbitrary file creation.
  • CVE-2026-117618: setup wizard race condition permits unauthenticated administrator account creation.
  • CVE-2026-117619: insufficient session expiration allows access after token revocation.
  • CVE-2026-117620: old data monitor injection may lead to account manipulation and admin takeover.
  • Additional XSS in workspace browser, agent error handling, and breadcrumb menu; medium issues may expose HTTP proxy configuration and file metadata.

Affected / Fixed Versions

  • Affected: Jenkins weekly 2.587 and earlier; Jenkins LTS 2.580.1 and earlier.
  • Fixed: Jenkins weekly 2.588; Jenkins LTS 2.580.2.

Recommendations

  • Update Jenkins to the fixed versions promptly.
  • Monitor for suspicious activity related to exploitation of these flaws.

Reference Links

  1. Dell PowerProtect Data Domain Critical Authentication and RCE Vulnerabilities (CVE-2026-86400)

Overview

  • Multiple critical vulnerabilities in Dell PowerProtect Data Domain appliances, Virtual Edition (DDVE), and Data Domain Management Center.
  • Key issues: improper authentication allowing root command execution (CVE-2026-86400), privileged account creation (CVE-2026-86397), hard-coded cryptographic keys exposing credentials (CVE-2026-86384), stack-based buffer overflow (CVE-2026-103780), missing authorization (CVE-2026-103799), SQL injection (CVE-2026-103792), and authentication bypass by spoofing (CVE-2026-90717).
  • May be exploited remotely by unauthenticated or low-privileged attackers.

Impact

  • Remote code execution with root privileges. Unauthorized privileged account creation. Credential exposure. Unauthorized management of Data Domain systems. Privilege escalation and access to sensitive data.

Affected / Fixed Versions

  • Affected DD OS: Feature Release 7.7.1.0–8.8.0.0; LTS2024 7.13.1.0–7.13.1.80; LTS2025 8.3.1.0–8.3.1.40; LTS2026 8.6.1.0–8.6.1.20.
  • Fixed: Feature Release 8.9.0.0+; LTS2024 7.13.1.90+; LTS2025 8.3.1.50+; LTS2026 8.6.1.30+. DDVE has additional version-specific fixes in Dell’s advisory.

Recommendations

  • Immediately update affected systems to the fixed DD OS versions.
  • Consult Dell’s advisory for the complete CVE list and remediation steps.

Reference Links

  1. Actively Exploited PAN-OS PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2)

Overview

  • Two critical PHP vulnerabilities in PAN-OS allow RCE due to improper handling of out-of-memory errors and references to freed memory.
  • CVE-2026-109618: uninitialized request memory from out-of-memory conditions. CVE-2026-109619: dangling pointers from freed memory.
  • Active exploitation has been observed.

Impact

  • Arbitrary code execution compromising confidentiality, integrity, and availability.

Affected / Fixed Versions

  • PAN-OS 12.2: earlier than 12.2.4-h1 → upgrade to 12.2.4-h1+.
  • PAN-OS 12.1: earlier than 12.1.4-h13, 12.1.7-h11, 12.1.10-h3 → fixed in those or later.
  • PAN-OS 11.2: earlier than 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1 → apply corresponding fixed versions.
  • PAN-OS 11.1: upgrade to 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4 or later.
  • PAN-OS 10.2: fixed from 10.2.7-h39, 10.2.10-h42 and later. Unsupported versions must upgrade to a supported fixed release.

Recommendations

  • Apply PAN-OS security updates promptly.
  • Restrict public access to PAN-OS and Panorama management interfaces immediately.
  • Keep Threat Prevention protections current. Review logs for suspicious activity.

Reference Links

  1. Actively Exploited Adobe Commerce Unrestricted File Upload (CVE-2026-48356, Critical)

Overview

  • Adobe released updates for Adobe Commerce, Commerce B2B, Magento Open Source, and Commerce Events.
  • CVE-2026-48356 allows unrestricted upload of dangerous file types (CWE-434), enabling arbitrary code execution within a victim’s session. No authentication required, but user interaction is needed.
  • CVSS 9.6 (Adobe), 9.3 (NVD). Added to CISA KEV on October 27, 2026.

Impact

  • Elevated access or account compromise through arbitrary code execution. Session security impact and potential full system compromise.

Affected / Fixed Versions

  • Adobe Commerce: up to 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier. Fixed in 2.4.9/2.4.8/2.4.7/2.4.6/2.4.5/2.4.4-2026-jul.
  • Commerce B2B: 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 and earlier. Fixed in 1.5.3/1.5.2/1.4.2/1.3.4/1.3.3-2026-jul.
  • Magento Open Source: up to 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier. Fixed in the corresponding -2026-jul releases.
  • Commerce Events: 1.6.0–1.20.0; fixed in 1.21.0.

Recommendations

  • Immediately apply the security updates per Adobe’s installation instructions.
  • Monitor for suspicious activity indicative of arbitrary code execution or unauthorized file uploads.

Reference Links

  1. Veeam Backup & Replication Authorization Bypass (CVE-2026-108142) and Other Critical Veeam Vulnerabilities

Overview

  • Multiple Veeam vulnerabilities allow authorization bypass, privilege escalation, arbitrary file access, SQL injection, and RCE.
  • CVE-2026-108142: Authorization Bypass in Backup & Replication (Critical, CVSS 9.1). CVE-2026-106076: SQL Injection/RCE in Backup for Microsoft 365 (Critical, 9.0). CVE-2026-105477: Local Privilege Escalation in Agent for Linux (High, 7.3). CVE-2026-107671: MFA Bypass in Veeam ONE (High, 8.5).

Impact

  • Compromise of backup infrastructure confidentiality, integrity, and availability. Unauthorized file access/modification, security control bypass, and code execution with elevated privileges.

Affected / Fixed Versions

  • Backup & Replication: up to 13.1.1.18 and 13.0.2.29; fixed in 13.1.2 (13.1.2.57), 13.0.3 (13.0.3.63).
  • Agent for Linux: up to 13.1.1.4; fixed in 13.1.2 (13.1.2.11).
  • Veeam ONE: up to 13.1.0.7233; fixed in 13.1 P1 (13.1.0.7940).
  • Backup for Microsoft 365: up to 8.6.0.1102 and earlier 8.x; fixed in 8.6 (8.6.0.1102) and 8.6 Patch 1 (8.6.0.5011).

Recommendations

  • Update affected Veeam products to fixed versions as soon as possible.
  • Monitor backup infrastructure for signs of compromise. Share information with stakeholders and partners.

Reference Links

  1. Google Chrome Desktop 52 Vulnerabilities Including Critical CVE-2026-118306

Overview

  • Chrome Stable update addresses 52 vulnerabilities on Windows, macOS, and Linux: memory corruption, use-after-free, improper input validation, improper access control, missing authorization, and out-of-bounds write.
  • Critical: CVE-2026-118306 (memory corruption in FileSystem), CVE-2026-118331 (FileAPI input validation), CVE-2026-118348 (Skia input validation), CVE-2026-118344 (use-after-free in Layout).

Impact

  • Arbitrary code execution, privilege escalation, or denial of service.

Affected / Fixed Versions

  • Fixed in Chrome 156.0.8078.73/.74 (Windows/macOS) and 156.0.8078.73 (Linux).

Recommendations

  • Immediately update Chrome Desktop to 156.0.8078.73 or later.

Reference Links

  1. Laravel Authentication Bypass in TokenGuard (CVE-2026-114509, CVSS 9.2)

Overview

  • Critical authentication bypass in Laravel applications using TokenGuard for token-based API authentication.
  • Triggered by crafted non-string credentials; under certain MySQL/MariaDB configurations the lookup may match an unintended existing user. Network attack vector; no privileges or user interaction required.

Impact

  • Authentication bypass allowing attackers to gain access as unintended users.

Affected / Fixed Versions

  • Affected: Laravel before 12.68.0 and 13.29.0. Fixed: 12.68.0 and 13.29.0.

Recommendations

  • Update to Laravel 12.68.0+ (12.x line) or 13.29.0+ (13.x line).

Reference Links

  1. Apple Multiple Product Vulnerabilities Including Actively Exploited CoreGraphics Code Execution (CVE-2026-86950)

Overview

  • Apple released updates for iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari covering CoreGraphics, CoreMedia, Audio, Apple Neural Engine, WebKit, and others.
  • CVE-2026-86950 in CoreGraphics allows arbitrary code execution via crafted files and has been exploited in targeted attacks.
  • Other issues: unauthorized access to user data (CVE-2026-86987), camera access without permission (CVE-2026-86990), sandbox escape (CVE-2026-112690, CVE-2026-113897), kernel memory corruption (CVE-2026-112696), unauthorized Bluetooth access (CVE-2026-84493), physical-access file read/write (CVE-2026-112612).

Impact

  • Arbitrary code execution, unauthorized data and device access, sandbox escape, kernel memory corruption, instability, and information disclosure.

Affected / Fixed Versions

  • iOS/iPadOS 27.2 and 26.7.2. macOS Golden Gate 27.2, Tahoe 26.7.2, Sequoia 15.8.2.
  • tvOS 27.2 (Apple TV 4K 2nd gen+). watchOS 27.2 (Series 9+). visionOS 27.2. Safari 27.2 for macOS Sequoia and Tahoe.

Recommendations

  • Install the latest Apple software updates immediately.

Reference Links

  1. PAN-OS and Prisma Cloud Transporter Client Brotli Buffer Overflow (CVE-2026-111497, CVSS 9.2)

Overview

  • Critical out-of-bounds write in Google Brotli decoder (versions 1.0.3–1.2.0) used by specific PAN-OS versions and the Prisma Cloud Application Security Transporter Client.
  • A remote unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt decoder memory.

Impact

  • Sensitive information disclosure, denial of service, and possible remote code execution.

Affected / Fixed Versions

  • PAN-OS before 12.2.4-h1 (12.2); 12.1.4-h13, 12.1.7-h11, 12.1.10-h3 (12.1); 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4, 11.2.16-h1 (11.2).
  • Prisma Cloud Transporter Client before 0.2.9. Brotli disabled by default in PAN-OS 11.2.4+; unsupported in 11.2.3 and earlier.
  • Fixed Brotli library versions: 1.0.10, 1.1.1, 1.2.1.

Recommendations

  • Inventory PAN-OS 12.2, 12.1, and 11.2 devices and Transporter Client deployments.
  • Apply hotfixes and upgrade to fixed PAN-OS builds and Transporter Client 0.2.9+. Verify exact builds against the advisory.

Reference Links

  1. Python Pillow OS Command Injection via EPS/Ghostscript (CVE-2026-112900, CVSS 9.2)

Overview

  • Critical argument injection in Pillow’s handling of filenames when processing EPS images through Ghostscript; crafted filenames are interpreted as Ghostscript command-line arguments.
  • Exploitation requires Ghostscript installed and attacker control over EPS filenames and referenced argument files.

Impact

  • Arbitrary command execution with the application’s privileges. Unauthorized data access, modification, or deletion. Server compromise.

Affected / Fixed Versions

  • Affected: Pillow 2.6.0 up to before 13.0.0. Fixed: Pillow 13.0.0.

Recommendations

  • Upgrade to Pillow 13.0.0 or later, including containers and base images.
  • Avoid passing untrusted filenames to Pillow for EPS processing. Remove Ghostscript where EPS processing of untrusted files is not required.

Reference Links

  1. WatchGuard Agent for Windows Log Directory Improper Permissions (CVE-2026-115253, CVSS 7.3)

Overview

  • An authenticated, non-administrative local user can create, modify, append, or delete log files and write other files in the agent’s log directory.

Impact

  • Unauthorized modification of security logs and files tied to a privileged service. Increased risk of local privilege escalation or evasion via log tampering.

Affected / Fixed Versions

  • Affected: versions earlier than 1.25.14.0000. Fixed: 1.25.14.0000 or later.

Recommendations

  • Update WatchGuard Agent for Windows to 1.25.14.0000 or later.

Reference Links

  1. Actively Exploited Collabora Online CODE Server OS Command Injection (CVE-2026-110447, CVSS 9.2)

Overview

  • Critical OS command injection in Collabora Online’s built-in CODE Server when integrated with Nextcloud, via the proxy.php endpoint when the built-in CODE Server is not running.
  • Allows remote attackers to execute arbitrary OS commands. Actively exploited in the wild.

Impact

  • Unauthorized command execution, potential web shell deployment, data exposure, and full server compromise.

Affected / Fixed Versions

  • Affected: Nextcloud installations using richdocumentscode earlier than 26.4.303. Not affected: standalone Collabora Online Server.
  • Fixed: richdocumentscode 26.4.303 or later.

Recommendations

  • Upgrade immediately to richdocumentscode 26.4.303+.
  • Identify affected Nextcloud instances, assess exposure, and review application, web server, and OS logs.
  • Conduct forensic analysis and isolate compromised systems if compromise is suspected. Verify and document remediation.

Reference Links

  1. Apache Camel Component Vulnerabilities Including XXE and Unsafe Deserialization (CVE-2026-90885)

Overview

  • Eight vulnerabilities fixed across camel-saxon, camel-aws2-s3, camel-oauth, camel-keycloak, camel-a2a, camel-docling, camel-coap, and camel-jgroups.
  • Types: XXE injection, unsafe Java deserialization, OAuth token cache isolation failures, expired-token acceptance, SSRF, path-handling flaws, and information disclosure through error messages.

Impact

  • XXE in camel-saxon and camel-smooks can expose local files or internal hosts.
  • Unsafe deserialization in camel-jgroups could enable RCE.
  • OAuth cache issues may leak tokens and accept expired tokens.
  • Blind SSRF in camel-a2a (internal IPv6). Path flaws in camel-docling (traversal/access bypass). camel-coap leaks sensitive error details.

Affected / Fixed Versions

  • camel-saxon XXE: 4.0.0 before 4.18.5 and 4.19.0 before 4.22.2; fixed in 4.18.5, 4.22.2, 4.23.0.
  • camel-jgroups deserialization: 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1; fixed in 4.18.5, 4.22.1, 4.23.0.
  • camel-smooks XXE: 4.7.0 before 4.18.5 and 4.19.0 before 4.22.1; fixed in 4.18.5, 4.22.1, 4.23.0.
  • CVE-2026-94386 (camel-oauth), CVE-2026-95663 (camel-keycloak), CVE-2026-71569 (camel-a2a), CVE-2026-95628/95629 (camel-docling), CVE-2026-101259 (camel-coap): versions not specified.

Recommendations

  • Identify affected components and versions, then upgrade to fixed versions.
  • Review route configurations for vulnerable components and assess exposure of sensitive data, credentials, and internal services.

Reference Links

  1. EUVD-2026-113489: GPU Buffer Mapping Integer Truncation (Fix for CVE-2026-49746)

Overview

  • A security fix for CVE-2026-49746 on GPU systems restricts the mapping range of graphics buffers.
  • Integer truncation occurs when mapping GPU buffer pages within the 0GB–4GB range, causing errors that limit kernel mode driver functionality.

Impact

  • Reduced functionality of the kernel mode driver on affected GPU systems.

Recommendations

  • Review the impact of the security fix on GPU buffer mapping.
  • Monitor for related errors and consider updates or patches addressing the truncation issue.

Reference Links

  1. EUVD-2026-113477: Linux/Android Kernel GPU Stack Overflow

Overview

  • Buffer overflow in the Linux/Android kernel from improper GPU system calls when processing resolved fence synchronization checkpoints, causing a stack overflow from copying excessive data.
  • Affects software running as a non-privileged user.

Impact

  • Kernel memory corruption, typically a denial-of-service via kernel crash.

Recommendations

  • Monitor for kernel updates addressing this issue and apply patches promptly.

Reference Links

  1. Ghostscript Out-of-Bounds Read via Malicious PDF or PostScript

Overview

  • Improper bounds validation when processing indexed color values in mesh shading data. Remote attackers can exploit it by convincing a user to process a crafted PDF or PostScript file.

Impact

  • Denial of service (application crash) and limited information disclosure.

Recommendations

  • Apply available Ghostscript patches or updates promptly.
  • Exercise caution when processing PDF or PostScript documents from untrusted sources.

Reference Links

  1. Cisco Finesse Server-Side Request Forgery Vulnerability

Overview

  • Unauthenticated, remote attackers can perform SSRF against the Cisco Finesse web-based management interface via crafted HTTP requests due to improper input validation.

Impact

  • Attackers could obtain limited sensitive information from services associated with the device. Rated high security impact.

Affected / Fixed Versions

  • Cisco plans software updates; no workarounds are available.

Recommendations

  • Apply Cisco software updates once released. Monitor advisories for availability and further guidance.

Reference Links

  1. Chinese APT Warp Panda Exploits VMware ESX Zero-Day and Chains PHP2Shell with Fragnesia to Root Firewalls

Overview

  • Warp Panda exploited a zero-day in Broadcom VMware ESX (CVE-2026-41709) involving insufficient logging.
  • Attackers chained PHP2Shell vulnerabilities with the ‘Fragnesia’ Linux kernel bug to gain root on servers and firewalls.
  • Cisco firewalls were also affected by a newly disclosed crash vulnerability.

Impact

  • Activity concealment and privilege escalation to root on servers and firewalls, enabling persistent stealthy access and wide network compromise.

Recommendations

  • Monitor for unusual logging and activity in VMware ESX environments.
  • Apply patches as soon as available. Strengthen detection of chained kernel and hypervisor exploitation.

Reference Links

  1. Exploitation Attempts Against Patched Oracle EBS SQL Injection (CVE-2026-101767, CVSS 9.8)

Overview

  • Exploitation attempts have begun against CVE-2026-101767, an unauthenticated SQL injection in the Oracle E-Business Suite Thin Client Framework servlet that can chain to RCE.
  • Initial exploratory attempts were detected October 27 using Oracle EBS decoys.

Impact

  • High severity (CVSS 9.8) with potential RCE on affected Oracle EBS instances.

Recommendations

  • Apply the official patch for CVE-2026-101767 immediately.
  • Monitor for exploit attempts and use decoys or other detection mechanisms.

Reference Links

  1. Cisco ASA/FTD Zero-Day Exploited to Crash SSL VPN Devices

Overview

  • Cisco issued updates for a zero-day in ASA and Firepower Threat Defense software. Attackers are actively exploiting it to cause remote denial of service by crashing firewalls.

Impact

  • Forced device crashes disrupting firewall and VPN services, affecting network security and availability.

Recommendations

  • Apply Cisco’s security patches promptly.
  • Monitor firewalls for unusual crashes or service interruptions.

Reference Links

  1. Actively Exploited Cisco ASA and FTD VPN Flaw That Can Crash Firewalls (CVE-2026-76418)

Overview

  • Cisco patched a high-severity flaw in Secure Firewall ASA and FTD software, tracked as CVE-2026-76418 and exploited in the wild.
  • It can be triggered remotely by an unauthenticated attacker.

Impact

  • Unauthenticated remote attacker can crash ASA and FTD firewalls, causing denial of service.

Recommendations

  • Apply Cisco’s patches for ASA and FTD software immediately.

Reference Links

  1. Cisco Catalyst SD-WAN Controller Authentication Bypass

Overview

  • A flaw in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller, Manager, and Validator lets unauthenticated remote attackers bypass authentication and obtain administrative privileges via crafted requests.
  • Attackers can log in as a high-privileged internal user, gaining NETCONF access to manipulate SD-WAN configurations.

Impact

  • Control over network configurations on the SD-WAN fabric.

Affected / Fixed Versions

  • Cisco has released software updates. No workaround is available.

Recommendations

  • Apply the provided software updates promptly.

Reference Links

  1. Volt Typhoon’s Covert, Ephemeral ‘Silent Train’ Network

Overview

  • China-backed Volt Typhoon infiltrated U.S. critical infrastructure using a transient malicious network dubbed ‘Silent Train’, made of rapidly rotated compromised SOHO routers, IoT devices, and enterprise infrastructure.
  • Infrastructure chains can be rebuilt in under two minutes. Use expanded after the early-2024 KV Botnet disruption.
  • Targets: telecom, government, defense contractors, water, energy, transportation, and emergency services. Over 27 device types exploited, abusing edge devices and management platforms from Fortinet, Cisco, Palo Alto Networks, and others.
  • Zero-days confirmed against Versa Director, N-able N-central, Cisco Catalyst SD-WAN, and VeloCloud Orchestrator.

Impact

  • Persistent, stealthy access to communications, defense, government, and critical infrastructure networks.
  • Disruption is difficult due to ephemeral infrastructure; potential major impact on national security and critical services.

Recommendations

  • Enhance monitoring for ephemeral infrastructure exploitation and rapid rebuilding patterns.
  • Prioritize patching zero-days in critical management platforms. Strengthen detection of edge device exploitation and device chains.
  • Cooperate with threat intelligence providers such as Black Lotus Labs for indicators.

Reference Links

  1. Cisco Informational: Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities

Overview

  • Private keys for eight eMudhra intermediate certificates were weakened by a serious error in an April 2025 Key Generation Ceremony, allowing brute-forcing within seconds.
  • Discovered between October 17 and 20, 2026. Cisco confirmed products not listed in the advisory are unaffected.

Impact

  • Potential unauthorized issuance of certificates trusted by affected CAs; severe trust compromise for SSL/TLS and other cryptographic operations.

Recommendations

  • Refer to Cisco and Cisco Talos updates for mitigation and detection guidance.
  • Monitor advisories for further information.

Reference Links

  1. CVE-2026-62740: Windows Imaging Component Information Disclosure

Overview

  • Affects the Windows Imaging Component and supported editions of Microsoft Office. Microsoft updated the Security Updates table to include the Office editions as affected.

Impact

  • Information disclosure.

Recommendations

  • Customers running affected Office editions should install the latest Microsoft security updates.

Reference Links

  1. CVE-2026-62877: Windows Win32k Elevation of Privilege

Overview

  • Elevation of privilege issue in the Windows Win32k component, affecting supported editions of Microsoft Office.

Impact

  • Successful exploitation allows an attacker to elevate privileges on the affected system.

Recommendations

  • Install the latest Microsoft security updates.

Reference Links

  1. How Rapid7 InsightGovCloud Supports BOD 22-01 Compliance

Overview

  • CISA BOD 22-01 focuses on timely remediation of actively exploited vulnerabilities.
  • Rapid7 InsightGovCloud, FedRAMP-authorized, provides automated vulnerability scanning, real-time KEV alerts, and regulatory-aligned reporting across on-premises, cloud, and hybrid environments.
  • Features include remediation prioritization, team assignment with timelines, real-time dashboards, and automated CyberScope XML export.

Impact

  • Helps government agencies and contractors strengthen posture and meet federal mandates more efficiently.

Recommendations

  • Use continuous asset discovery for current inventories.
  • Leverage automated KEV detection and prioritization, collaborative workflows with accountability, and automated compliance reporting.

Reference Links

  1. USN-8955-1: nginx Vulnerabilities

Overview

  • Vulnerabilities in nginx involving the alias directive with rewrite rules, map directives with regex matching, HTTP/3 requests with proxy_request_buffering, asynchronous file I/O in SSI pages, and SSL session ticket keys with shared session cache without explicit rotation.

Impact

  • Denial of service through crashes, remote code execution, data injection in proxied requests, and SSL session forgery bypassing client certificate verification.

Affected / Fixed Versions

  • Ubuntu 24.04 LTS, 26.04 LTS, and 26.10.

Recommendations

  • Apply the security updates provided by Ubuntu.

Reference Links

  1. OT Refrigeration Control Systems Attack on French Supermarkets

Overview

  • Attackers compromised refrigeration control systems at supermarkets across France (Intermarché, Netto, Carrefour, Coopérative U, Monoprix, E.Leclerc), manipulating settings to cause temperature spikes and food spoilage.
  • Compromised devices include Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB systems.

Impact

  • Temperatures raised up to 50°C causing disruption and spoilage. Potential DoS and RCE through multiple vulnerabilities in Danfoss and Copeland controllers.

Affected / Fixed Versions

  • Danfoss AK-SM 8xxA (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452): fixed in firmware R4.2 and R4.3.1.
  • Copeland XWEB300D PRO, XWEB500D PRO, XWEB500B PRO up to firmware 1.12.1 (CVE-2026-25085, CVE-2026-21718, CVE-2026-24663).

Recommendations

  • Remove direct internet exposure; restrict remote access to secure VPN or protected networks.
  • Apply vendor firmware updates, change default credentials, and replace unsupported or end-of-life devices.
  • Segment OT from IT and limit access. Monitor for unauthorized refrigeration setting changes.
  • Follow CERT-FR and vendor recovery guidance if compromised; factory reset alone is insufficient.

Reference Links

  1. How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943)

Overview

  • Eight eMudhra intermediate CA certificates were compromised by a flaw in the key generation process that reduced key entropy, letting attackers recover private keys and issue fraudulent TLS or code-signing certificates.
  • Chrome, Mozilla, Apple, and Microsoft have revoked and blocked the certificates. Weak keys came from an April 30, 2025 key ceremony affecting 24 subordinate CAs; eight intermediates (six TLS, two code-signing) used compromised keys.
  • eMudhra states root CA keys and other intermediates are unaffected and has revoked the compromised certificates.

Impact

  • Attackers with the keys can impersonate any website or service. Highest risk for organizations using eMudhra/emSign-issued certificates; legacy systems and custom trust stores not receiving distrust updates are at increased risk.
  • Only one affected intermediate was used in production; no certificates were issued to websites or end users.

Affected / Fixed Versions

  • Software using Go runtime versions 1.27.3 and 1.26.10 may still trust the compromised chains.

Recommendations

  • Use Qualys VMDR and Certificate View to identify certificates by SHA-256 fingerprint, serial number, or issuer.
  • Scan network ranges and external domains; use Cloud Agent for unreachable assets.
  • Update software using vulnerable Go runtime versions and deploy vendor-specific updates.

Reference Links

  1. Trimble Cityworks Remote Code Execution Attack (CVE-2025-0994)

Overview

  • Trimble Cityworks contains a deserialization vulnerability allowing authenticated users to execute remote code on Microsoft IIS web servers.
  • Actively exploited to gain unauthorized network access; CVE-2025-0994 is in CISA’s KEV catalog.

Impact

  • Potential downtime and loss of service. Unauthorized network access.

Affected / Fixed Versions

  • Cityworks before 15.8.9, and Cityworks with office companion before 23.10. Updates have been released.

Recommendations

  • Apply vendor updates promptly and follow advisory instructions.
  • Use FortiGuard Labs protections and consider engaging their Incident Response team if compromise is suspected.

Reference Links

AI SOC

  1. Accenture Contractor Allegedly Gave Claude AI Agent Access to Secure Pentagon Network

Overview

  • An Accenture contractor allegedly gave a personal Claude Code AI agent administrative access to a secure DoD environment on NIPRNet, enabling it to write and deploy code.
  • The agent reportedly operated about two months, sending credentials, login details, and a NIPRNet network map to an external website.
  • Accenture disputes the allegations; an independent investigation found no merit to the claims.
  • The environment handled Controlled Unclassified Information (CUI). The case highlights indirect prompt injection risks to AI coding agents.

Impact

  • Potential exfiltration of sensitive network information and credentials from a DoD-related environment.
  • Risk to code integrity, supply chain, and insider threat posture. No evidence of compromise of classified networks so far.

Recommendations

  • Never give AI agents unrestricted administrative privileges in sensitive environments.
  • Use narrow permissions, short-lived credentials, and network segmentation.
  • Monitor AI activity for indirect prompt injection and unauthorized instructions. Conduct independent audits promptly if mishandling is suspected.

Reference Links

  1. IDC MarketScape Names Microsoft a Leader in 2026 Worldwide Modern Endpoint Security

Overview

  • Microsoft was named a Leader in the 2026 IDC MarketScape for Modern Endpoint Security for Enterprises.
  • Strengths: autonomous attack disruption and predictive shielding; Security Copilot agentic AI generally available; Defender integrates endpoint, identity, email, and cloud signals; ISOC unifies SIEM and threat protection; 500+ Sentinel connectors.
  • Defender detects local AI agents (50+ endpoint agents), maps exposure, and protects against prompt injection; runtime protection for agents is in preview.

Impact

  • Near real-time containment of ransomware and multistage attacks. Reduced analyst workload and improved alert accuracy. Better visibility and protection for AI agents on endpoints.

Recommendations

  • Consider unified security operations platforms such as Defender ISOC for visibility and autonomous response.
  • Monitor and protect local AI agents against prompt injection. Use advanced hunting with rich telemetry for early detection.

Reference Links

  1. The CISO’s Evolving Role: Protecting and Defending in the Agentic Era

Overview

  • AI agents have rapidly proliferated within enterprises, accessing company data and acting autonomously, raising governance and risk challenges.
  • CISOs must protect an AI-driven enterprise and defend against adversaries using AI to accelerate attacks.
  • Effective protection requires observability of agent identities, actions, and data access; defense requires integrated tools that correlate signals and act at AI speed.

Impact

  • Ungoverned agents create risk of unauthorized data access and actions. Attackers compressing timelines force faster, integrated, agent-enabled security operations.

Recommendations

  • Assign governed identities with strictly limited access to AI agents. Implement deep, continuous observability.
  • Classify and protect data accessible by agents. Foster early collaboration between builders and security teams.
  • Integrate security controls and threat intelligence; use agents as SOC copilots.

Reference Links

AI Threat Landscape

  1. Tracking AI Adoption in North Korean Threat Actor Tradecraft

Overview

  • North Korean threat actors increasingly integrate generative and agentic AI into operations for reconnaissance, social engineering, identity deception, tooling development, and scaling (e.g., Jade Sleet, Coral Sleet, Jasper Sleet).
  • AI supports existing objectives such as revenue generation, intelligence collection, and disruption. Adoption occurs in stages: operationalized, accelerating, expanding, and emerging.
  • Operations remain human-directed, without full autonomy.

Impact

  • Faster, more sophisticated activity against cryptocurrency, finance, IT, government, and education sectors.
  • More targeted social engineering and identity deception via AI-generated personas and lures; more frequent tailored attacks.

Recommendations

  • Apply Microsoft Defender detections for AI-assisted threat activity.
  • Enhance monitoring for AI-driven social engineering and reconnaissance. Use layered defenses focused on targeting patterns and lure detection.

Reference Links

  1. So Many AI Security Benchmarks, but None Tell the Whole Story

Overview

  • The AI security benchmarking landscape is increasingly complex, yet no benchmark substitutes for testing within an organization’s own code and workflows.

Impact

  • Relying solely on external benchmarks may leave gaps in AI model security assessment.

Recommendations

  • Conduct in-house testing tailored to specific codebases and workflows alongside available benchmarks.

Reference Links

  1. Claude Model Builds Exploits Across Major Browsers and OSes

Overview

  • An unreleased Claude model discovered and chained multiple vulnerabilities affecting major browsers (Chrome, Safari) and operating systems (Android, Windows, Linux). Disclosed by Anthropic.

Impact

  • Exploit chaining across widely used platforms indicates potentially significant risk; specific impact details were not provided.

Recommendations

  • No specific recommendations provided; monitor vendor updates and apply patches as available.

Reference Links

  1. State of Ad Fraud 2026: 52% of Schemes Use AI

Overview

  • 52% of 2026 ad fraud schemes use AI-generated or AI-assisted assets; AI-powered bots mimicking human visitors appeared in 64% of those.
  • Cloned brands, fake endorsements, and deepfakes are common. New tactics include malicious iOS scripts and messenger-based phishing on WhatsApp and Telegram using AI language models for believable conversations at scale.

Impact

  • Fraudsters shifted to fewer, higher-quality, more damaging campaigns. AI enables more sophisticated, scalable scams and complicates detection.

Recommendations

  • Focus on detecting AI-driven fraud patterns and messenger-based phishing.
  • Monitor emerging threats such as prompt injection-based attacks. Stay vigilant on region-specific high-risk campaigns.

Reference Links

  1. Claude AI Exploits Linux Kernel Flaw to Execute Root Commands (CVE-2026-98432)

Overview

  • Anthropic’s unreleased Claude research model wrote a working exploit for CVE-2026-98432, a race-condition use-after-free in the Linux kernel networking stack involving multipath TCP listeners.
  • The two-step exploit leaks kernel pointers to bypass KASLR, then overwrites callback pointers to run payloads as root, with no login or user interaction required.
  • This was a lab demonstration, not an observed real-world attack. The flaw is patched upstream and backported to all maintained stable branches; some Ubuntu and cloud kernels remain vulnerable.

Impact

  • Remote code execution with root privileges on Linux servers. Highlights AI’s growing ability to find and chain vulnerabilities into exploits.

Recommendations

  • Install the latest kernel patches and reboot. Disable unnecessary multipath TCP listeners.
  • Restrict internet-facing services with firewall rules. Monitor for abnormal connection resets or failed TCP handshakes.
  • Review AI tool use, secure internal Linux sandboxes, and accelerate patching.

Reference Links

  1. Before You File That AI Bug Report, OpenAI Has Some Advice

Overview

  • AI-generated vulnerability reports are overwhelming open-source maintainers, and some have stopped accepting them.
  • OpenAI’s Patch the Planet program partners with researchers to identify, validate, and coordinate fixes with maintainers. OpenAI advises high-quality, clear disclosures and resources for ecosystem coordination.
  • Example: coordination with the PHP Foundation on validation, patch development, and release.

Impact

  • Rising volume of AI-generated submissions risks overwhelming maintainers and reducing adoption of legitimate fixes without proper coordination.

Recommendations

  • Thoroughly verify AI-generated reports and make them clear, with coordination efforts alongside maintainers and incident response partners.
  • Pursue collaborative, ecosystem-wide vulnerability coordination.

Reference Links

  1. All the Security Risks Anthropic Is Worried About Before Its IPO

Overview

  • Anthropic’s SEC IPO filing highlights cybersecurity and regulatory risks: its models can rapidly find and exploit vulnerabilities, with concern about misuse by bad actors including foreign governments.
  • It faces regulatory scrutiny including an FTC civil investigative demand. AI agents create new attack surfaces via external interactions, and the company acknowledges known gaps in defenses.

Impact

  • Potential for increased AI-enabled attacks by nation-states and cybercriminals. Legal and reputational risk from misuse. Difficulty meeting breach-reporting requirements and obtaining insurance for AI-related incidents.

Recommendations

  • Strengthen security infrastructure and controls for AI-specific risks.
  • Balance innovation speed with safety and ethics. Monitor regulatory developments and increase transparency around AI capabilities.

Reference Links

  1. In-the-Wild Attack Abuses AI Agents’ Trust in Markdown

Overview

  • Attackers developed a prompt injection technique targeting AI coding assistants by exploiting how they process local instruction files that blur the line between text and executable commands.

Impact

  • AI agents may unintentionally execute malicious instructions embedded in seemingly innocent markdown files.

Recommendations

  • Harden how AI assistants distinguish local instruction files from executable code.
  • Implement prompt validation controls and monitor for suspicious file content.

Reference Links

You may also like

Ready to get started?

Contact us to arrange a half day
Managed SOC and XDR workshop in Dubai

Contact Us

Ready to get started?

Contact us to arrange a half day Managed SOC and XDR workshop in Dubai

Contact Us
Linkedin Twitter Facebook Instagram Youtube

HawkEye

Packages

CSOC

Explore

© 2026 HawkEye – Managed CSOC and XDR powered by DTS Solution. All Rights Reserved.
Contact
This is a staging environment