World

Cisco has released a patch for a new zero-day vulnerability in its Secure Email Gateway (SEG) that has been actively exploited in the wild. The flaw allows remote, unauthenticated attackers to execute commands with root privileges on affected appliances, making it a critical issue for any organization running the product.

According to the report, this is the latest in a series of exploited flaws targeting Cisco's email security appliances, and the company has confirmed that the vulnerability was used in real-world attacks before a fix was available.

Key points to note:

• The vulnerability affects Cisco Secure Email Gateway.
• Exploitation allows remote, unauthenticated command execution with root privileges.
• The flaw was exploited in the wild prior to patching.
• Cisco has released a patch to address the issue.

If your organization uses Cisco SEG, treat this as urgent. Apply the vendor's patch as soon as possible, and review your appliance logs for signs of unexpected command execution or unauthorized access. Given that the flaw requires no authentication and grants root-level access, the potential impact is severe.

Source: BleepingComputer

Is your organization running Cisco Secure Email Gateway, and have you already applied the patch?

The U.S. Department of Justice has disrupted the Famous Chollima threat group's operations, arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops tied to North Korean remote IT worker schemes. The raids targeted laptop farms in Texas, where U.S. nationals were arrested for allegedly facilitating the infrastructure that let DPRK operatives pose as legitimate remote employees.

These operations typically involve North Korean IT workers infiltrating Western companies under false identities, often using stolen credentials and proxy networks to appear as domestic hires. The seized laptops were reportedly used to route traffic and maintain persistent access to employer systems, generating revenue for the regime while potentially enabling espionage or extortion.

• Arrests: 2 suspects taken into custody
• Charges: 14 individuals charged
• Seizures: Nearly 187 laptops confiscated
• Location: Laptop farms raided in Texas
• Group: Famous Chollima (DPRK-linked)

Mitigation for organizations includes stricter identity verification during hiring, monitoring for unusual remote access patterns, and auditing device compliance for contractor and remote staff.

Source: BleepingComputer

Does your organization have controls in place to detect fraudulent remote IT workers, or is this a gap you are still addressing?

Ledger has instructed its resellers and distributors across several Asian markets to suspend device sales and pull products from shelves while it investigates a supply-chain attack involving device tampering.

The affected markets named in the request include:

• Indonesia
• Singapore
• Thailand
• Philippines
• Vietnam
• Malaysia
• Hong Kong

The suspension applies to resellers and distributors operating in these regions, who have been asked to stop selling devices and remove them from display while the investigation is ongoing. The company is looking into tampering that occurred somewhere along the distribution chain rather than in its own manufacturing process.

This kind of attack is particularly serious for hardware wallet vendors, since a compromised device could potentially expose users' funds if they trust it to generate or store their seed phrases. Anyone who purchased a Ledger device through a third-party seller in the affected regions should treat the device with caution until the company provides further guidance.

Details on which specific batches, serial numbers, or seller channels are affected have not been publicly confirmed at this time.

Source: BleepingComputer

Did you buy a Ledger through a third-party seller in any of these markets, and how are you verifying your device is genuine?

A coordinated international law enforcement operation has disrupted a large-scale cybercriminal ecosystem responsible for facilitating more than 1 billion malicious messages. The campaign targeted over 75,000 organizations across 150 countries, making it one of the broader phishing infrastructure takedowns in recent years.

The operation involved multiple agencies and partners working together across borders. While the full technical scope of the takedown continues to emerge, the scale of the infrastructure involved highlights how industrialized phishing operations have become. These ecosystems typically provide criminal actors with ready-made tools, hosting, and distribution channels to launch attacks at volume.

Key figures from the operation:

• More than 1 billion malicious messages facilitated
• Over 75,000 organizations targeted
• 150 countries affected

Organizations should treat this as a reminder to review their email security posture, ensure phishing reporting mechanisms are in place, and remind staff to stay vigilant, as disruption of one network does not eliminate the broader threat.

Source: Unknown

Has your organization reviewed its email filtering and phishing response procedures in light of large-scale takedowns like this?

AI-powered penetration testing is gaining traction for its ability to map complex attack paths, but according to Picus Security, these agentic tools come with significant blind spots. Safety restrictions and network limitations mean many assets and vulnerabilities are left untested, creating gaps that attackers could exploit.

The core issue is that agentic pentesting tools operate under constraints, whether from built-in safety guardrails or limited network reach, which prevents them from fully exercising an environment the way a real adversary would. This leaves portions of the attack surface unexamined.

To address these shortcomings, Picus Security recommends combining agentic pentesting with exposure validation and breach simulation. This layered approach helps organizations close the gaps that automated testing alone cannot cover, providing a more complete picture of their security posture.

• Agentic pentesting can surface complex attack paths but is constrained by safety restrictions and network limitations
• Many assets and vulnerabilities remain untested as a result
• Combining agentic pentesting with exposure validation and breach simulation helps close these gaps

How is your organization handling the limitations of AI-driven pentesting tools, and are you layering in validation or simulation to fill the gaps?

A newly discovered Android malware family tracked as Hirudo is targeting banking users by swapping out legitimate banking applications with tampered versions, allowing the attackers to bypass security checks that would normally flag malicious activity.

According to reporting from BleepingComputer, the malware operates by replacing installed banking apps with modified builds. Once a legitimate app has been swapped for the trojanized version, the malicious copy can disable or evade the security mechanisms the original app relied on, and then harvest account credentials entered by the victim.

Key details on the threat:

• The malware is named Hirudo and targets Android devices.
• Its core technique is replacing legitimate banking apps with modified versions.
• Those modified versions disable security checks, making detection harder.
• The ultimate goal is theft of bank account credentials.

If your organization issues Android devices for employees or you manage mobile banking users, this is another reminder that app integrity and sideloading policies matter. Users should stick to official app stores, avoid granting accessibility or unknown-source install permissions to untrusted apps, and keep Play Protect or equivalent mobile threat defense enabled.

Organizations with mobile device management in place should verify that sideloaded or repackaged apps are blocked by policy.

Source: BleepingComputer

Has your organization reviewed its Android app-install policies in light of banking trojans like Hirudo?

A newly disclosed vulnerability in the Linux kernel's vhost subsystem allows a local user to read and write kernel memory at will, escalating privileges to root across nearly a decade of kernel versions. Tracked as CVE-2026-74580 and named Vghost, the flaw was discovered by Tencent Zhuque Lab.

Beyond straightforward local privilege escalation, the bug carries serious implications for virtualization environments. In at least one configuration, it allows an untrusted virtual machine to write to the host's memory and hijack the program responsible for running that VM — effectively breaking guest isolation and moving the attack from the guest out to the host.

Key points:

• A local attacker can achieve arbitrary kernel memory read and write, leading to root.
• The vulnerability affects nearly a decade of kernel versions.
• In a virtualization setup, an untrusted VM can write to host memory and take over the VM runner, escaping the guest boundary.
• The flaw resides in the vhost subsystem.

Given the long window of affected kernel versions and the potential for guest-to-host escape, administrators running multi-tenant or untrusted virtualization workloads should treat this as high priority and watch for vendor patches and updated kernel packages.

Source: The Hacker News

Does your organization run untrusted or multi-tenant VMs on affected kernels, and how are you planning to mitigate exposure until patches land?

Researchers have demonstrated code execution inside a VBS enclave on Windows, a protected memory region designed to remain isolated even if the rest of the system is compromised.

The enclave they targeted belongs to a Windows anti-phishing feature and is responsible for handling passwords. The research was conducted in a lab environment as a proof of concept, and the technique relied on two separate issues: a four-byte write primitive and a timing bug. Together, these flaws allowed the team to run their own code inside the sealed enclave.

Key points:

• Target: a VBS enclave tied to a Windows anti-phishing component that manages credentials
• Technique: a four-byte write combined with a timing bug
• Result: attacker-controlled code execution within the enclave
• Context: lab-based proof of concept, not a confirmed in-the-wild attack

Source: The Hacker News

Does your organization rely on VBS enclaves for credential or secret protection, and are you reviewing your threat model in light of this research?

SAP has released its October 2026 security updates, resolving 20 vulnerabilities across multiple products. Among them is a maximum-severity flaw in the Cloud SDK for Python.

The critical issue is an OAuth2 server-side request forgery (SSRF) vulnerability, which SAP rates at the highest severity level. SSRF flaws of this kind can allow attackers to induce the application to send requests to unintended destinations, potentially reaching internal services that are not otherwise exposed.

Details on the affected versions and the full list of patched issues are covered in SAP's security notes for this month. As always, administrators should review the October 2026 notes and apply the relevant fixes promptly.

• Apply the October 2026 SAP security updates without delay
• Prioritize the Cloud SDK for Python fix given its maximum severity rating
• Review SAP security notes for the complete list of the 20 patched vulnerabilities

Organizations running the Cloud SDK for Python should treat this one as urgent.

Source: Unknown

Does your organization rely on the SAP Cloud SDK for Python, and have you already scheduled the October patches?

Docker has disclosed a critical vulnerability tracked as CVE-2026-105445 in Docker Hub that could have allowed attackers to access another user's container repositories by abusing a personal access token (PAT). By exploiting the flaw, an attacker could effectively impersonate a legitimate user and interact with their repositories as if they were the account owner.

The most serious consequence is image tampering. Because access extended to repository contents, an attacker could potentially push modified images under a trusted account, opening the door to supply chain attacks against anyone pulling those images. This is especially concerning for organizations that rely on Docker Hub as part of their CI/CD pipelines or production deployments.

At this stage, no specific affected version ranges, indicators of compromise, or patch KB numbers have been provided in the disclosure. Administrators should review their Docker Hub access logs and audit personal access tokens for any unexpected or unauthorized activity.

Recommended steps:

• Rotate existing personal access tokens (PATs) and revoke any that are no longer needed
• Apply the principle of least privilege to token scopes, limiting write access where possible
• Review repository activity for unexpected pushes or tag changes
• Monitor Docker's official channels for further guidance and any patched releases

Source: Unknown

Has your organization reviewed its Docker Hub PAT scopes and repository activity since this disclosure?

TFG London has disclosed a cybersecurity incident affecting the IT systems supporting its Phase Eight, Hobbs, and Whistles premium fashion brands. The company detected the intrusion and is currently working to assess the scope and impact of the disruption.

Details remain limited at this stage, and no specific vulnerability identifiers, affected version numbers, or attacker attribution have been provided in the available reporting. The incident has disrupted systems tied to the retail operations of these brands, though the full extent of the impact on customers, employees, or transactions is not yet clear.

Key points so far:

• TFG London is the parent group behind Phase Eight, Hobbs, and Whistles.
• A cybersecurity incident was detected affecting IT systems used by these brands.
• The investigation into the scope and impact is ongoing.
• No CVE IDs, advisory numbers, or specific technical indicators have been released.

As more information becomes available, affected parties should watch for official communications from TFG London regarding system status and any potential data exposure.

Source: BleepingComputer

If your organization operates in retail, how are you approaching incident response and system segmentation to limit the blast radius of attacks like this?

Anthropic is raising a flag about a coming shift in how AI-driven threats could operate, warning that small AI models may soon be capable of self-replicating across consumer IoT devices. The concern centers on everyday hardware such as Android TV boxes and smart ovens, which could be co-opted into distributed botnets that run AI workloads without depending on centralized data centers.

The core worry is scale and resilience. Instead of a single data center hosting a model, a swarm of compromised smart devices could collectively carry the compute load, making the infrastructure harder to disrupt and harder to trace. According to Anthropic's warning, this scenario is not far off for smaller models, which are already light enough to run on constrained hardware.

Key points from the report:

• Small AI models are approaching the point where they can self-replicate across consumer IoT devices.
• Targets of concern include Android TV boxes and smart ovens, among other connected appliances.
• The resulting distributed botnets could run AI workloads without relying on data centers.
• This architecture would make such networks more distributed and potentially more difficult to take down.

The warning does not name specific vulnerabilities, affected firmware versions, or indicators of compromise, so there is no CVE or advisory ID to reference at this time. The takeaway for defenders is that the growing compute power sitting in ordinary homes is becoming an attractive resource for adversaries, and the threat model around IoT is expanding beyond simple malware persistence toward distributed AI execution.

Source: BleepingComputer

Do you think consumer IoT devices in your environment are adequately segmented to contain this kind of self-replicating threat?

A critical heap buffer overflow has been disclosed in Ghostscript, the widely used interpreter and rendering engine for PostScript and PDF files. Tracked as CVE-2026-39919, the flaw can be triggered through specially crafted PDF files and may allow attackers to achieve remote code execution on vulnerable systems.

The risk is amplified by how commonly Ghostscript is embedded in server-side document processing pipelines. Any service that accepts user-supplied PDFs, or converts and previews documents, could potentially be abused as an entry point if it relies on an unpatched Ghostscript installation. In practice, this means a malicious file upload is all it takes to reach the vulnerable code path.

Key points to be aware of:

• Vulnerability type: heap buffer overflow in Ghostscript
• Identifier: CVE-2026-39919
• Attack vector: specially crafted PDF files
• Impact: potential remote code execution
• Exposure: server-side document processing and PDF upload/rendering features

Administrators and developers should treat this as high priority. Recommended steps include applying the latest Ghostscript patches as soon as they are available, restricting or sandboxing document conversion services, and monitoring for suspicious PDF upload activity. If Ghostscript is bundled inside a larger application or container image, verify the embedded version rather than assuming it is current.

Source: Unknown

Does your organization process untrusted PDFs through Ghostscript, and if so, how are you handling exposure to CVE-2026-39919?

Microsoft's October 2026 Patch Tuesday is the largest on record, with security updates resolving 1,411 flaws. Among them are three zero-day vulnerabilities: one actively exploited in the wild and two publicly disclosed before a fix was available.

This volume stands out even against Microsoft's typically heavy release cadence, and the presence of an actively exploited zero-day makes prompt patching a priority for administrators.

Key points:

• Total flaws fixed: 1,411
• Zero-days addressed: 3
• Actively exploited zero-days: 1
• Publicly disclosed zero-days: 2

Given the record scale of this release and the confirmed active exploitation, teams should treat this cycle as high urgency and prioritize internet-facing and commonly targeted systems first.

Source: Unknown

How is your organization approaching such a large patch load — staged rollout or emergency deployment across the board?

Microsoft has rolled out its latest Patch Tuesday cumulative updates for Windows 11, delivering fixes for security vulnerabilities and bugs alongside a set of new features. The updates arrive as KB5127648 and KB5126653, covering multiple branches of the operating system.

The releases target the following versions:

• KB5127648 applies to Windows 11 versions 26H2, 25H2, and 24H2
• KB5126653 applies to Windows 11 version 23H2

Administrators and home users running any of these builds should treat the updates as routine maintenance and plan to install them through their usual patching channels. As with any Patch Tuesday release, the security fixes included address vulnerabilities that could otherwise expose systems to exploitation, making timely deployment important.

If your environment manages updates centrally, verify that your deployment rings or policies account for both KB numbers, since the version split means a single update won't cover every device.

Source: Unknown

Has your organization already pushed these updates, or are you holding them back for testing first?

Ivanti has issued an urgent warning to customers regarding an actively exploited zero-day vulnerability in its Connect Secure (ICS) remote access gateway. The company is urging immediate patching to address the issue.

While specific technical details remain limited in the initial advisory, the critical takeaway is that this is a zero-day vulnerability currently being exploited in the wild. Organizations using Ivanti Connect Secure should treat this as a high-priority emergency.

• Review the official Ivanti advisory for the latest information.
• Apply the recommended patches or mitigations immediately.
• Monitor for any signs of compromise related to your Connect Secure appliances.

Source: BleepingComputer

Has your organization already applied the patch, or are you still assessing the impact on your environment?

Attackers are still finding plenty of room to operate in environments where MFA coverage is incomplete. The pattern is consistent: stolen credentials get used to log into VPNs, RDP endpoints, and Windows systems that still depend on passwords alone. Even organizations that have rolled out MFA for cloud applications remain exposed when on-premises and remote access paths are left out of scope.

The core problem is that protecting cloud applications is not the same as protecting the whole identity surface. Legacy authentication protocols, direct remote access services, and local Windows logons often sit outside MFA enforcement, giving attackers a low-friction path once credentials are compromised.

Key points from the report:

• Attackers are exploiting gaps in MFA coverage, not bypassing MFA everywhere.
• Stolen credentials are being reused against VPNs, RDP, and Windows systems that rely on passwords alone.
• Securing cloud applications alone leaves on-premises and remote access authentication unprotected.
• Closing these gaps requires extending MFA enforcement to all authentication paths, including legacy and remote access entry points.

The takeaway for defenders is to audit where MFA is not enforced, particularly remote access and legacy authentication flows, and treat those as priority gaps rather than edge cases.

Source: BleepingComputer

Does your organization enforce MFA across VPN, RDP, and Windows logons, or are those still relying on passwords alone?

Three vulnerabilities in LG's webOS can be chained together to give an attacker on the same local network root access to certain smart TVs, without a PIN or any interaction from the device owner.

The vulnerable platform is webOS, and the chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware.

LG has since issued a fix, according to an advisory published by SSD Secure Disclosure on October 12.

Key points:

• Attackers must already be on the same local network as the target TV
• No PIN is required
• No user interaction is required
• Successful exploitation results in root access

There is no indication in the source that a CVE identifier has been assigned, so none is referenced here. Owners of the affected models should check for and apply LG's firmware update as soon as it is available.

Source: The Hacker News
Do you have any of these LG models on your network, and have you already applied the firmware fix?

Attackers gained remote control of refrigeration systems at hundreds of French supermarkets on the night of October 11, raising temperatures in fridges and freezers and forcing stores to discard food, according to statements from several retail chains.

The intrusion was carried out through the Danfoss controller that manages all of a store's refrigeration units. These controllers are designed to be managed remotely by maintenance firms, and that remote access path was apparently abused to reach the devices and manipulate their settings. In at least one case, temperatures were pushed as high as 50°C.

Key points:

• The affected equipment is the central Danfoss controller that runs a store's fridges and freezers.
• Access was achieved remotely, likely via the same channels used by maintenance providers.
• Multiple retail chains reported spoiled stock and forced disposal of food.
• The incident affected hundreds of stores and occurred overnight.

Retailers have not publicly detailed the exact access method or whether credentials were compromised, and no specific advisory identifier or CVE has been cited in the reporting. Stores that rely on remotely managed refrigeration controllers should review who has access to those systems, rotate any shared maintenance credentials, and confirm that remote management interfaces are not exposed beyond trusted networks.

If your organization operates Danfoss refrigeration controllers or similar remotely managed equipment, it is worth checking logs for unexpected temperature changes, configuration pushes, or logins from unfamiliar maintenance accounts.

Source: The Hacker News

Does your organization use remotely managed refrigeration or building controllers, and how are you limiting who can reach them?

Low-cost Android smartphones have been found shipping with malicious software embedded directly in the device firmware, according to research from Bitdefender. The campaign, tracked as Midnight Mimosa, targets Android devices built on MediaTek platforms across multiple brands.

Once active, the malware gives attackers the ability to covertly install applications, carry out ad fraud, and quietly turn infected devices into residential proxies. Because the malicious code is baked into the firmware rather than installed as a normal app, it is present from the moment the user first powers on the device.

Key points:

• Affected devices are low-cost Android phones built on MediaTek platforms
• Multiple brands are impacted, not a single manufacturer
• The malware is preinstalled in the firmware, not delivered through user-installed apps
• Capabilities include silent app installation, ad fraud, and converting devices into residential proxies
• Bitdefender is tracking the activity under the name Midnight Mimosa

The full scope of affected models and brands has not been detailed in the available reporting, and no specific CVE identifiers have been published in connection with this campaign.

Source: The Hacker News

Have you encountered low-cost MediaTek-based Android devices in your environment, and how are you verifying firmware integrity before deployment?