The Hot Drop

Oct 16

The Hot Drop for 10-16-2026

CISA yells ‘patch now’ for two vendors with active zero-days. Armory Castle drops root access via BeyondTrust. Is your Connect Secure appliance already compromised?

Since the last show: 6 new · 3 developing · 1 returning · 7 dropped · 18% overlap with the previous show

Contents

  1. Palo Alto and Cisco Patch Actively Exploited Zero-Days in PAN-OS and Secure Email Gateway
  2. Armory Castle Exploits BeyondTrust Zero-Day for Root Access
  3. Ivanti Zero-Day CVE-2025-0282 Actively Exploited
  4. Ivanti Warns Config Pushes Break Zero-Day Mitigations
  5. Silent Lynx Exploits WinRAR Flaw to Target CIS Governments
  6. AI-Orchestrated Campaign Compromises 440 PaperCut Servers Across 48 Countries
  7. FortiManager Compromise Exposes 500+ Firewalls to PEERSTITCH Malware
  8. Hackers Exploit Collabora CODE Flaw to Backdoor Nextcloud Servers
  9. FBI arrests third ShinyHunters suspect in global crackdown
  10. CyberXero Uses 51 AI Agents to Steal 628,000 Ukrainian Records

1. Palo Alto and Cisco Patch Actively Exploited Zero-Days in PAN-OS and Secure Email Gateway (Lead)

Event first seen in a show

What changed

This is the third time since December 2025 that attackers have exploited Cisco email gateway bugs to gain root access. Cisco released fixes for the vulnerability in AsyncOS versions 15.5.5-014 and 16.5.0-780. CISA added CVE-2026-0322 and CVE-2026-76519 to its Known Exploited Vulnerabilities catalog, requiring FCEB agencies to prioritize fixes by October 17, 2026. Reports agree on the severity and active exploitation, but note that Cisco Secure Email Cloud customers are already protected. Cisco Secure Email Gateway versions 13.0 through 16.0 contain a critical SQL injection flaw in email parsing that allows unauthenticated remote attackers to execute arbitrary commands with root privileges. The vulnerability is triggered by crafted email attachments and is rated CVSS 9.8. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on Wednesday, October 14, 2026, citing active exploitation of this Palo Alto Networks PAN-OS flaw. Palo Alto Networks issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The technical flaw in CVE-2026-76519 is classified as an improper path validation / arbitrary file write vulnerability (CWE-23) in the Advanced Malware Protection feature.

How it works

Threat actors exploit CVE-2026-76519 in Cisco Secure Email Gateways by sending crafted attachments to trigger improper path validation. The vulnerability stems from insufficient validation of malicious SQL statements within crafted emails, enabling attackers to bypass data plane controls and spawn shell commands on the underlying operating system. The exploit chains crafted SQL statements into the email parser, which then passes unvalidated data to backend commands via MSSQL_xp_cmdshell. An unauthenticated remote attacker sends a crafted email containing malicious SQL statements, bypassing input validation to execute arbitrary commands with root privileges on the underlying operating system. An unauthenticated attacker with network access to the Palo Alto PAN-OS management web interface can bypass authentication to invoke PHP scripts via CVE-2025-0108. This remote code execution vulnerability in the management interface allows an authenticated attacker with network access to inject code and gain root privileges on PA-Series and VM-Series firewalls. The vulnerability affects the PAN-OS management interface and allows authenticated attackers with network access to execute code as root on vulnerable devices. Possibly, A successful exploit of the vulnerability allows the attacker to execute commands with root privileges on the underlying operating system. A flaw in PAN-OS versions 10.1.0 through 11.2.0 allows unauthenticated attackers to bypass authentication and gain full system control. This vulnerability carries a severity score of 8.6 and impacts PA-Series and VM-Series firewalls, plus Panorama virtual and M-Series appliances. Successful exploitation enables code execution as root, granting the attacker the highest level of control over the affected firewall. Separately, a flaw in Cisco Secure Email Gateway versions 14.0.0-698 and 16.0.4-016 allows full system compromise without prior authentication. This specific flaw exploits improper path validation to execute root commands on AsyncOS, and CISA mandates fixes by October 17, 2026, for federal agencies. The underlying mechanism involves insufficient neutralization of SQL syntax, enabling adversaries to bypass authentication and write arbitrary files on the underlying AsyncOS. This enables root command execution on versions like 16.0.4-302, resulting in integrity and confidentiality impacts without remote code execution. Operators must apply the mandated fixes to prevent unauthorized root access on these critical network devices. The primary risk is the loss of system integrity and confidentiality due to unauthenticated root access. Watch for unauthorized file writes or root command execution on AsyncOS as a concrete signal of exploitation.

What to do

Cisco Secure Email Gateway faces root-level command execution via CVE-2026-76519, a flaw listed in the CISA Known Exploited Vulnerabilities catalog with a CVSS score of 9.8. This vulnerability demands immediate patching to prevent total system compromise through simple email delivery. Federal civilian agencies must mitigate this high-severity issue by October 17, 2026, as it is distinct from the other three CVEs in this event cluster. Concurrently, CVE-2026-0322 in Palo Alto Networks PAN-OS provides authenticated attackers with root code execution on firewalls, compounding the exposure of network edge infrastructure. Apply the Cisco zero-downtime update for the Content Scanner Tools engine to mitigate CVE-2026-76519 without rebooting the Secure Email Gateway. Deploy the Palo Alto Networks security update for CVE-2026-0322 to close the remote code execution vector in the PAN-OS management interface. Immediate mitigation requires parameterizing all SQL queries and disabling xp_cmdshell on affected systems immediately. Isolate affected devices and apply vendor patches while scanning for SQL injection indicators in email logs. Restrict management web interface access to trusted internal IP addresses per Palo Alto best practices.

Limits and watch

Automated static analysis flags the weakness, but verify the fix by checking the official CISA catalog for the exact patch release date. The root-privilege impact of CVE-2026-76519 remains a possible outcome rather than a confirmed observation in every environment. Active exploitation of CVE-2026-0322 is limited to authenticated attackers with network access to the management interface, not unauthenticated remote users. Watch for abnormal requests to public endpoints that correlate with web server processes spawning shells or writing webshells. Track lateral movement attempts where adversaries exploit remote services to reach internal systems after compromising the edge.

Vulnerabilities

  • CVE-2026-76461 — CVSS 9.8 (Critical) · CISA KEV · CWE-89 · Cisco Cisco Secure Email. A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying…
  • CVE-2026-76519 — CVSS 9.8 (Critical) · CISA KEV · CWE-23 · Cisco Cisco Secure Email. A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
  • CVE-2025-0108 — CVSS 9.1 (Critical) · CISA KEV · CWE-306 · Palo Alto Networks Cloud NGFW; Palo Alto Networks PAN-OS; Palo Alto Networks Prisma Access. An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS…
  • CVE-2026-0322 — CVSS 8.6 (High) · CISA KEV · CWE-94 · Palo Alto Networks Cloud NGFW; Palo Alto Networks PAN-OS; Palo Alto Networks Prisma Access. A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the…

Techniques

  • T1068 Exploitation for Privilege Escalation (Privilege Escalation)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1552.004 Private Keys (Credential Access)
  • T1556.006 Multi-Factor Authentication (Defense Impairment)

Indicators

  • 5 indicators on file

Coverage

2. Armory Castle Exploits BeyondTrust Zero-Day for Root Access (Segment)

Event first seen in a show

What changed

BeyondTrust publicly disclosed CVE-2026-102764 on October 15, 2026, confirming the flaw was patched in advisory BT26-05 released on October 8, 2026. Mandiant attributed the discovery of this threat activity to late September 2026, during an investigation into a separate zero-day vulnerability affecting edge devices from another vendor. Mandiant confirmed Armory Castle abused get_portal_info to extract x-ns-company before establishing a WebSocket channel. The actor deployed Sawfly, an obfuscated PHP webshell providing bidirectional encrypted command and control. Mandiant tracked this actor exploiting CVE-2025-22457, a critical flaw in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. Ivanti Connect Secure versions before 22.7R2.6 contain a critical stack-based buffer overflow allowing remote unauthenticated attackers to execute code. BeyondTrust patched CVE-2026-102764 on October 8, fixing a spoofing flaw in Remote Support that allows unauthenticated attackers to execute file operations.

How it works

BeyondTrust Remote Support and Privileged Remote Access versions zero allow unauthenticated attackers to run OS commands via command injection today. Internal components failed to validate message origins, enabling CWE-290 authentication bypass that lets attackers spoof trusted sources to manipulate the appliance. The flaw, rated CVSS 9.8, lets attackers bypass authentication entirely to crash the system or take full control of the gateway. Successful exploitation may allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. This flaw grants full execute access to site users, enabling command execution, data modification, and denial of service with a CVSS score of 9.9.

What to do

Armory Castle exploited this in August 2026 to escalate privileges and persist on affected systems, confirming active threat actor usage. Mandiant previously tracked a specific actor exploiting this exact vulnerability, confirming it is actively used in real-world campaigns. Mandiant tracked this specific vulnerability in a campaign, confirming it is actively exploited by threat actors targeting Ivanti infrastructure. This specific vulnerability enables full system compromise without credentials, distinguishing it from the other two CVEs in this event set. According to Mandiant, an unauthenticated attacker can exploit the flaw to perform file operations, leading to host-level control and access to stored credentials. BeyondTrust’s timeline places the first exploitation of the vulnerability on Aug. 29 against one hosted instance and one self-hosted appliance. Google urged affected BeyondTrust customers to apply patches immediately in its blog published on October 15. Operators must isolate affected systems today until patches arrive for these specific versions. Apply the latest BeyondTrust patch immediately to neutralize the OS command injection weakness before attackers exploit it. Patch affected BeyondTrust RS and PRA versions to prevent unauthorized code execution. Apply the latest patch immediately to harden the compilation environment and prevent remote exploitation.

Limits and watch

The hacker, tracked under the name Armory Castle, deployed custom backdoors and used the support tool’s administrative access to harvest credentials and steal sensitive information. Watch for suspicious child process creation under the service context following inbound access, which indicates likely exploitation rather than normal activity.

Vulnerabilities

  • CVE-2025-22457 — CVSS 9.8 (Critical) · CISA KEV · CWE-121 · Ivanti Connect Secure; Ivanti Policy Secure; Ivanti Neurons for ZTA gateways. A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to…
  • CVE-2026-1731 — CVSS 9.8 (Critical) · CISA KEV · CWE-78 · BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA). BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability.
  • CVE-2026-102764 — CVSS 9.3 (Critical) · CWE-290 · BeyondTrust Remote Support. The vulnerability exists within internal components of BeyondTrust’s Remote Support product.

Techniques

  • T1102 Web Service (Command And Control)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1505.003 Web Shell (Persistence)
  • T1556.006 Multi-Factor Authentication (Defense Impairment)

Coverage

3. Ivanti Zero-Day CVE-2025-0282 Actively Exploited (Segment)

Event now covered by 4 outlets (was 3); Blast radius expanded: new vendor(s): google; Mentioned in reporting, no attribution: malware DRYHOOK

What changed

Ivanti confirmed threat actors are exploiting CVE-2025-0282, a critical remote code execution flaw in Connect Secure appliances, to install malware. Google’s Mandiant and Microsoft’s MSTIC discovered the issue, which has been exploited since mid-December 2024. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog, mandating federal fixes by January 15, 2025. Patches for Policy Secure and Neurons for ZTA gateways are scheduled for January 21, 2025. Reportedly, Ivanti Connect Secure appliances are under active attack via a zero-day flaw, CVE-2025-0282. Reportedly, Ivanti confirmed that attackers exploited CVE-2025-0282, a zero-day stack-based buffer overflow, to install malware on Connect Secure appliances. The blast radius is significant, with Censys data showing over thirty-three thousand exposed instances globally. Ivanti released fixes for a stack-based buffer overflow in Connect Secure, Policy Secure, and Neurons for ZTA gateways. The use of SPAWN malware has been attributed to a China-nexus threat actor dubbed UNC5337, which is assessed to be a part of UNC5221 with medium confidence.

How it works

Hackers exploited a stack overflow in Ivanti Connect Secure before version 22.7R2.5 to run remote code without authentication. This flaw allows remote, unauthenticated attackers to execute code on Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways running versions prior to the specified patches. The weakness is a classic stack overflow where an authenticated user overwrites memory to execute unauthorized code. A local authenticated attacker can exploit this flaw to escalate privileges, potentially executing unauthorized code on the device. A second vulnerability, CVE-2025-0283, is a stack-based buffer overflow that allows local authenticated attackers to escalate their privileges on the device. Fuzzing detects this crash, while compiler hardening like /GS mitigates the memory corruption that causes the DoS or unauthorized code execution. Hackers exploited a remote unauthenticated flaw to install malware on Connect Secure appliances, causing crashes or resource consumption that disrupts availability. The vulnerability carries a CVSS score of seven, indicating high impact to confidentiality, integrity, and availability.

What to do

This vulnerability is distinct from CVE-2025-0282, requiring separate patching of versions prior to 22.7R2.5 or 22.7R1.2. Operators must verify ZTA gateways and Policy Secure versions to block the privilege escalation paired with CVE-2025-0282. CISA’s KEV listing mandates federal remediation for the unauthenticated remote code execution flaw by January 15, 2025. Apply the latest Ivanti patch immediately to prevent crashes or unauthorized execution. Upgrade Ivanti Connect Secure appliances to version 22.7R2.5 or later, performing a factory reset before applying the update as directed by the vendor. Deploy compiler hardening like StackGuard or ProPolice to detect buffer overflows, while fuzzing remains the primary method for identifying such stack vulnerabilities. Harden compilation environments using compiler extensions like StackGuard to detect this overflow condition.

Limits and watch

Reportedly, attribution of the SPAWN malware to the China-nexus actor UNC5337 carries only medium confidence, leaving the specific threat actor identity uncertain. The full extent of compromised devices remains unknown because Ivanti acknowledged only a limited number of affected customers without providing a total count. Watch for web server processes creating unexpected files in web directories and then spawning command shells or script interpreters, a key indicator of web shell deployment.

Vulnerabilities

  • CVE-2025-0282 — CVSS 9 (Critical) · CISA KEV · CWE-121 · Ivanti Connect Secure; Ivanti Policy Secure; Ivanti Neurons for ZTA gateways. A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated…
  • CVE-2025-0283 — CVSS 7 (High) · CWE-121 · Ivanti Connect Secure; Ivanti Policy Secure; Ivanti Neurons for ZTA gateways. A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated…

Techniques

  • T1021.007 Cloud Services (Lateral Movement)
  • T1505.003 Web Shell (Persistence)

Named actors and malware

  • DRYHOOK (malware)
  • PHASEJAM (malware)

Coverage

4. Ivanti Warns Config Pushes Break Zero-Day Mitigations (Segment)

Event first seen in a show

What changed

Ivanti disclosed two zero-day vulnerabilities, CVE-2023-46805 and CVE-2024-21887, affecting its Connect Secure and Policy Secure gateways on January 10, 2024. Over 2,100 devices have been specifically backdoored with GIFTEDVISITOR malware, affecting government entities and Fortune 500 companies. The core issue is that Ivanti has not released a permanent patch. Doing so triggers a race condition that disables the very security controls you applied to patch the zero-day flaws CVE-2023-46805 and CVE-2024-21887. While CISA has mandated immediate mitigation for federal agencies, the lack of a vendor patch means the risk remains high. Ivanti Connect Secure and Policy Secure versions 9.1R18 and 22.6R2 contain a critical command injection flaw. These same versions also contain a server-side request forgery flaw. Additionally, the SAML components in these products contain an XML external entity flaw. Security firm Volexity discovered these vulnerabilities in December 2023 and published indicators of compromise detailing attacker behavior. CISA added these vulnerabilities to its known exploited catalog and mandated immediate mitigation for federal agencies.

How it works

Ivanti Connect Secure 22.6R2 allows remote attackers to bypass control checks via identity spoofing under CWE-287. They exploit the SAML component to access restricted resources without authentication. A low-privilege user can exploit the web component to gain full administrator access. Attackers exploit this without authentication to access restricted resources on affected versions. Authenticated administrators can inject arbitrary commands via web components, bypassing input validation layers. The weakness stems from improper neutralization of special elements, where untrusted input constructs commands that bypass validation layers and execute downstream. Exploitation requires a prior access precondition that differs from the other five CVEs in this group. Attackers chain CVE-2023-46805, an authentication bypass, with CVE-2024-21887, a command injection flaw, to execute arbitrary commands on the appliance. The backdoor JavaScript installed by the attackers sends usernames, passwords, and authentication URLs to a threat actor-controlled HTTP server. Reportedly, threat actors have compromised 412 of over 26,000 internet-facing Ivanti Connect Secure hosts using credential theft. Secondary scans found more than 22 callback variants on these hosts, suggesting multiple actors are involved. One critical zero-day, rated 9.1, allows full appliance compromise and is listed in CISA’s exploited catalog. This CISA-listed vulnerability scores 9.1, granting full control over the appliance for anyone with admin access. A command injection on versions 9.1R18 and 22.6R2 grants full system access per CVSS 9.1 severity. Another flaw carries a CVSS score of 8.8, indicating high impact on confidentiality and integrity. A distinct zero-day grants high confidentiality access to restricted resources without authentication, separate from the other five CVEs. CVE-2023-46895 affects one of six linked flaws in this event set, targeting a specific product version.

What to do

Understanding this distinct access path helps operators isolate the single highest-risk component today. Because Ivanti has only provided recovery and mitigation steps rather than a fix, the exposure remains high for organizations that have not yet implemented the specific workarounds. Apply vendor-supplied mitigations now and search for indicators of compromise on Ivanti Connect Secure or Policy Secure infrastructure. Isolate affected appliances like Ivanti ICS 9.1R18 and IPS 22.6R2 while awaiting official patches for this high-severity issue. Validate input immediately against known good lists to stop unauthorized code execution and avoid external process calls. Check web components for Identity Spoofing indicators, as the CVSS 8.2 rating signals severe impact despite low access complexity.

Limits and watch

It is not yet known if the backdoored JavaScript that exfiltrates usernames and passwords to threat actor-controlled servers is present on all affected appliances or only those with specific configuration states. Until a patch arrives, watch for repeated control character detections in logs as a signal of exploitation attempts. Watch for repeated control character detections by filters, which signals an adversary exploiting multiple input layers to bypass validation. Also watch for abnormal LSASS memory access or replayed authentication attempts, indicating exploitation of credential access for unauthorized privileges.

Vulnerabilities

  • CVE-2024-21887 — CVSS 9.1 (Critical) · CISA KEV · CWE-77 · Ivanti ICS; Ivanti IPS. A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute…
  • CVE-2024-21888 — CVSS 8.8 (High) · Ivanti ICS; Ivanti IPS. A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.
  • CVE-2024-22024 — CVSS 8.3 (High) · CWE-611 · Ivanti ICS; Ivant ICS; Ivanti IPS. An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources…
  • CVE-2023-46805 — CVSS 8.2 (High) · CISA KEV · CWE-287 · Ivanti ICS; Ivanti IPS. An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
  • CVE-2024-21893 — CVSS 8.2 (High) · CISA KEV · CWE-918 · Ivanti ICS; Ivanti IPS. A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted…
  • CVE-2023-46895 — CVSS 0 (Low)

Techniques

  • T1102 Web Service (Command And Control)
  • T1212 Exploitation for Credential Access (Credential Access)
  • T1583.006 Web Services (Resource Development)
  • T1584.006 Web Services (Resource Development)

Named actors and malware

  • GIFTEDVISITOR (malware)

Coverage

5. Silent Lynx Exploits WinRAR Flaw to Target CIS Governments (Segment)

Event first seen in a show

What changed

Google revealed that multiple threat actors are exploiting a now-patched critical security flaw in RARLAB WinRAR to establish initial access and deploy payloads. The group, designated TAG-193, has targeted government and energy sectors across nine former Soviet states since early 2025. The group’s activity overlaps with other clusters like YoroTrooper, indicating potential shared infrastructure. Researchers found a public proof-of-concept exploit for CVE-2025-25257 on Fortinet FortiWeb infrastructure. WinRAR version 7.13, released July 30, 2025, patched CVE-2025-8088, a path traversal flaw in the Windows client. CISA added WinRAR 7.11 to its Known Exploited Vulnerabilities catalog, citing CVE-2025-6218.

How it works

The flaw allows path traversal in archive files, enabling code execution if a user opens a malicious file. Attackers exploit doubled triple dot slash sequences to escape restricted directories and drop malware into the Windows Startup folder. This SQL injection flaw in FortiWeb versions 7.0 through 7.6 allows unauthenticated attackers to execute unauthorized code via crafted HTTP requests. TAG-193 frequently sends spearphishing emails from compromised government accounts using official-looking documents. In April 2026, an adversary bypassed WinRAR’s restricted directory checks to execute arbitrary code on victim machines. This specific issue affects only the 64-bit version of WinRAR 7.11. With a CVSS score of 9.8 and a CISA KEV listing, the vulnerability poses a critical risk to data integrity and system availability. Separately, FortiWeb versions 7.0 through 7.6 face a vulnerability with a CVSS score of 9.8.

What to do

Actors like TAG-193 use this weakness to drop malware into the Windows Startup folder without elevated privileges, bypassing standard application controls. This behavior shifts investigation priority from generic phishing detection to forensic analysis of the Startup registry key and WinRAR archive contents. Because the exploit is patched in version 7.13, older WinRAR versions on government and energy sector systems in nine former Soviet states are the primary exposure indicator. Asset population of legacy software is the highest-value target for immediate remediation. Overlap between TAG-193 and clusters like YoroTrooper suggests shared infrastructure that could accelerate the spread of these interactive access tools. Apply the WinRAR 7.13 patch to close CVE-2025-8088 and immediately scrutinize any unexpected PowerShell processes launched by shortcuts or Office applications to disrupt the initial access chain. Hunt for suspicious changes in the Windows Startup folder to identify and remove batch scripts or LNK files that may be used to establish persistence following the exploitation of CVE-2025-25257. Defenders must apply the latest patch immediately to stop unauthenticated attackers from executing unauthorized SQL commands. Defenders can detect this SQL injection flaw using automated static analysis tools, though they must verify that proper input validation exists to avoid false positives. Defenders must patch WinRAR to version 7.13 or later immediately to close the window for this specific path traversal exploit.

Limits and watch

Static analysis tools can detect the flaw, but no patch date has been announced for the affected release window. Three staging directories host the exploit, yet no confirmed compromise has been observed, so watch for unauthorized file execution on affected FortiWeb instances. The specific patch date for FortiWeb 7.6.0 remains uncertain, requiring immediate verification of the current version against the affected range. TAG-193’s administrative connections to Silent Lynx servers originated from ProtonVPN egress IPs geolocated to Kazakhstan, but attribution to the group’s core command structure remains unconfirmed. The extent to which the China-based actor’s use of CVE-2025-8088 to deliver Poison Ivy overlaps with TAG-193’s operations is not established, as evidence attributes these actions to distinct entities without confirming shared infrastructure. Monitor for high-volume enumeration of Global Address Lists via PowerShell cmdlets like Get-GlobalAddressList from non-admin systems, as this indicates the T1087.003 technique used to map email accounts for further compromise. Watch for suspicious querying of organization-wide directory data via Google Workspace Directory API or Outlook GAL sync from abnormal users or unknown device contexts to detect early-stage reconnaissance.

Vulnerabilities

  • CVE-2025-25257 — CVSS 9.8 (Critical) · CISA KEV · CWE-89 · Fortinet FortiWeb. An improper neutralization of special elements used in an SQL command (‘SQL Injection’) vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through…
  • CVE-2025-8088 — CVSS 8.8 (High) · CISA KEV · CWE-35 · win.rar GmbH WinRAR. A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files.
  • CVE-2025-6218 — CVSS 7.8 (High) · CISA KEV · CWE-22 · RARLAB WinRAR. RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability.

Techniques

  • AML.T0072 Reverse Shell (Command And Control)
  • T1005 Data from Local System (Collection)
  • T1007 System Service Discovery (Discovery)
  • T1012 Query Registry (Discovery)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1016.001 Internet Connection Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • T1021.002 SMB/Windows Admin Shares (Lateral Movement)
  • T1025 Data from Removable Media (Collection)
  • T1027.005 Indicator Removal from Tools (Stealth)
  • and 10 more

Named actors and malware

  • TAG-193 (actor)
  • Bitter (actor)
  • Gamaredon (actor)
  • Sandworm (actor)
  • Turla (actor)
  • Cuba Ransomware (malware)
  • Tomiris (malware)

Coverage

6. AI-Orchestrated Campaign Compromises 440 PaperCut Servers Across 48 Countries (Segment)

Event first seen in a show

GreyNoise reported that the activity began on August 31, 2026, when the actor used a self-hosted lab to test the software. The actor’s reconnaissance identified 800 unique confirmed-vulnerable endpoints and 205 likely vulnerable hosts, totaling 1,005 hosts across at least 45 countries. On August thirty-first, 2026, attackers chained CVE-2026-82078 with CVE-2026-81578 to exploit PaperCut MF and NG versions twenty-five and twenty-six, achieving unauthenticated remote code execution. The actor combined OpenAI’s Codex harness with DeepSeek models to automate the attack. CISA added CVE-2026-81578 to its Known Exploited Vulnerabilities catalog, flagging an authentication bypass in those versions. Hunt[.]io found forty-five targets with working reverse SOCKS access and forty-six Active Directory domains in the recovered victim packages. The infrastructure sat on a single server in the Netherlands under AS213388. The actor’s tooling includes a registry hive dumper with MD5 hash ce870a91e8d27e8f663f0687abc60b04.

Today’s attack chain used CVE-2026-81578 to bypass PaperCut MF/NG 0 and 25.0.0 admin checks before validation. Unauthenticated remote requests reach administrative Tapestry components before validation completes, allowing attackers to modify system configurations without credentials. The flaw allows unsafe reflection in JDBC driver loading, executing arbitrary Java bytecode if configuration parameters are manipulated. The exposed tooling revealed a second PaperCut RCE path through XML-RPC using api[.]setConfigValue and api[.]lookUpUserNameByCardNo. An unauthenticated remote request modified Tapestry settings, yielding a CVSS 9.8 score via CWE-305 Authentication Bypass. This unsafe reflection flaw affects PaperCut MF and NG versions 0 through 26.0.0, allowing remote code execution under the server process context with a CVSS score of 9.1. A Linux persistence mechanism used chisel and cron to maintain reverse SOCKS5 access through compromised hosts.

Reportedly, GreyNoise identified at least 440 compromised instances across 395 organizations, confirming the attack surface extends far beyond the initial 45 targets with working reverse SOCKS access. The chain from CVE-2026-81578 to CVE-2026-82078 exposes a critical gap in application isolation, where the first flaw allows unauthenticated configuration changes and the second leverages unsafe class loading to execute arbitrary Java bytecode. Listed in CISA’s Known Exploited Vulnerabilities catalog, this high-severity issue requires strict input validation to prevent class selection attacks. Focus your investigation on any PaperCut instances still running versions 25.0.0 or 26.0.0, as these are the confirmed vulnerable targets in the 1,005-host population. The recovered victim packages contain 46 distinct Active Directory domains, indicating the campaign successfully pivoted from initial access into core identity infrastructure. Patch PaperCut NG/MF 26.0.0 immediately to stop unauthenticated configuration changes. Apply strict allowlist validation for driver names now, since static analysis detects the unsafe class-loading pattern in current source. Reportedly, target the exposed directories on ports 8000, 18080, and 18081 of 45.142.193[.]132, which Hunt[.]io identified as active staging points. Prioritize detecting abnormal LSASS memory access and forged Kerberos tickets, as the framework links exploitation to these authentication anomalies.

The actor’s notes describe a second local RCE chain that does not depend on the original Tapestry trigger, leaving the full scope of post-exploitation capabilities unconfirmed. While a probe script identified nine live PaperCut hosts with reachable APIs, the total count of 1,005 potentially vulnerable hosts across 45 countries remains a reconnaissance estimate rather than a confirmed compromise list. Monitor. Watch.

Vulnerabilities

  • CVE-2026-81578 — CVSS 9.8 (Critical) · CISA KEV · CWE-305 · PaperCut PaperCut MF/NG. An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG.
  • CVE-2026-82078 — CVSS 9.1 (Critical) · CISA KEV · CWE-470 · PaperCut PaperCut MF/NG. An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG.

Techniques

  • AML.T0012 Valid Accounts (Initial Access)
  • AML.T0037 Data from Local System (Collection)
  • AML.T0049 Exploit Public-Facing Application (Initial Access)
  • AML.T0050 Command and Scripting Interpreter (Execution)
  • AML.T0055 Unsecured Credentials (Credential Access)
  • AML.T0069.002 System Prompt (Discovery)
  • AML.T0072 Reverse Shell (Command And Control)
  • AML.T0090 OS Credential Dumping (Credential Access)
  • AML.T0112 Machine Compromise (Impact)
  • T1003 OS Credential Dumping (Credential Access)
  • and 2 more

Indicators

  • 10 indicators on file

Coverage

7. FortiManager Compromise Exposes 500+ Firewalls to PEERSTITCH Malware (Segment)

Event first seen in a show

Mandiant has identified a new threat cluster, UNC5820, that is actively exploiting a critical zero-day in Fortinet FortiManager, tracked as CVE-2024-47575. The vulnerability, dubbed FortiJump, stems from a missing authentication for a critical function in FortiManager’s fgfmd daemon. Unit 42 says the attackers also exploited a second flaw, CVE-2025-61624, through FortiOS’s system[.]auto-script feature.

Mandiant’s UNC5820 cluster exploits FortiManager 7.6.0 and earlier by bypassing authentication for critical functions, enabling arbitrary code execution. The flaw, known as FortiJump, is a missing authentication issue that lets unauthenticated attackers execute arbitrary code via crafted requests. The vulnerability has been actively exploited in the wild. First observed on June 27, 2024, this vulnerability allows attackers to exfiltrate sensitive configuration data from FortiGate devices managed by compromised FortiManager systems. Unit 42 reports that a breach of a FortiManager appliance exposed configurations and sensitive data linked to more than 500 managed FortiGate firewalls. The vulnerability affects multiple versions of FortiManager and FortiManager Cloud, including 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, and 6.4.0 through 6.4.14. A CVSS 9.8 flaw grants attackers administrative privileges to modify sensitive data or execute commands on FortiManager devices running versions through 7.4.4. This flaw lets an authenticated admin write or delete arbitrary files in FortiOS 7.6.0 through 7.6.4 and older versions.

CVE-2024-47575 in FortiManager permits unauthenticated remote code execution, bypassing authentication to trigger credential access. This flaw let a single compromised appliance in a telecom breach execute commands and exfiltrate configs for over 500 downstream firewalls. The exposure cascades across the managed network, requiring immediate verification of all FortiGate firewalls and isolation of unpatched FortiManager appliances. Attackers injected PEERSTITCH malware into FortiOS daemons via FortiJump, using credential access for persistent stealth without traditional binaries. While injection into logging and VPN services is confirmed, uncertainty remains regarding lateral movement techniques, as the campaign has run since June 27, 2024. Monitor for PEERSTITCH indicators like unauthorized VPN sessions, noting that CVE-2025-61624 attribution may require separate investigation. Apply Fortinet patches immediately or implement recommended workarounds on all FortiManager instances to close the unauthenticated code execution vector. Isolate compromised systems and rotate credentials for all managed devices, as the UNC5820 cluster has been observed deploying PEERSTITCH malware to establish unauthorized VPN sessions. Manually verify authentication logic in FortiManager 7.6.0 and earlier, as automated scanners often miss this specific missing authentication weakness. Verify file integrity after any system[.]auto-script execution to stop unauthorized code creation. Isolate FortiManager 7.4.0 through 7.4.4 immediately, as manual analysis is required to verify session integrity. Immediately disable system[.]auto-script and upgrade FortiOS 7.6.0 to the latest patch to prevent file overwrite.

Mandiant attributes this activity to the UNC5820 cluster, though specific malicious IP addresses like 45[.]32[.]41[.]202 and 104[.]238[.]141[.]143 may not represent the complete infrastructure used. Watch for abnormal LSASS memory access or replayed authentication attempts, as these are key indicators of exploitation for credential access under technique T1212. Watch for failed or anomalous PAM authentications and unexpected crashes in authentication services, which signal potential exploitation of credential validation processes.

Vulnerabilities

  • CVE-2024-47575 — CVSS 9.8 (Critical) · CISA KEV · CWE-306 · Fortinet FortiManager. A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14…
  • CVE-2025-61624 — CVSS 6.5 (Medium) · CWE-22 · Fortinet FortiOS; Fortinet FortiProxy; Fortinet FortiSwitchManager. An Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all…

Techniques

  • AML.T0072 Reverse Shell (Command And Control)
  • T1003.007 Proc Filesystem (Credential Access)
  • T1098.005 Device Registration (Persistence)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1212 Exploitation for Credential Access (Credential Access)
  • T1552.004 Private Keys (Credential Access)

Indicators

  • 19 indicators on file

Coverage

8. Hackers Exploit Collabora CODE Flaw to Backdoor Nextcloud Servers (Segment)

Blast radius expanded: new vendor(s): github; new product(s): collabora online, richdocumentscode, os, docker, built-in code server; 2 new indicator(s) observed

Collabora Online maintainers published advisory GHSA-g3vx-3m76-fghh on October 14, 2026, disclosing a critical flaw in the built-in CODE Server app for Nextcloud. The vulnerability, tracked as CVE-2026-110447, allows unauthenticated attackers to inject OS commands through proxy[.]php when the local document server is down. The fix was committed on September 9 and released in version 26.4.303 on September 11, creating a four-week gap before the public advisory dropped. Standalone Collabora servers are safe, but any Nextcloud instance running the built-in app is at risk. Hackers are actively backdooring Nextcloud servers using a critical flaw in the Collabora CODE app. Collabora Online versions before 25.04.702 contain a critical OS command injection flaw in the richdocumentscode proxy. The same proxy also allows critical remote code execution in those versions. Reports indicate that attackers planted PHP webshells to search for password databases, password manager artifacts, and cryptocurrency wallets on compromised systems. The lead sheet details the specific hash for the webshell and the GitHub advisory ID for further correlation. This was introduced by a code change on September 9th and fixed in version 26.4.303 on September 11th. However, the official advisory did not drop until October 14th, leaving a four-week window where attackers could deploy PHP webshells.

The flaw stems from improper neutralization of special elements during multiple parser passes, enabling command injection that bypasses input validation layers. This remote code execution flaw allows unauthenticated attackers to execute arbitrary commands via proxy[.]php, bypassing input validation through multiple parsing layers. Specifically, the vulnerability enables OS command injection via proxy[.]php, allowing attackers to execute unauthorized commands on the host system. Successful exploitation requires the built-in CODE server to be stopped, such as after a restart, upgrade, or crash, which triggers the vulnerable command execution path. Threat actors exploited CVE-2026-110447 in Collabora Online before 26.4.303 via OS command injection in proxy[.]php when the CODE server was offline. All richdocumentscode releases earlier than 26.4.303 are affected, specifically within the Nextcloud app’s mechanism for starting the bundled Collabora server. Attackers exploit multiple input layers to execute unauthorized commands, causing full compromise of the Nextcloud environment. System administrators reported attacks against multiple endpoints dating back to September 10, where the web shell was used to locate credential stores and cryptocurrency wallets.

The exposure is specific to richdocumentscode app versions prior to 26.4.303, where the mechanism for starting the bundled server allows command injection when the local document server is down. This specific vulnerability is distinct from CVE-2026-110447, meaning the fix for one does not protect against the other. This specific flaw is distinct from other recent issues, as its fix does not address separate code paths in the same product. Upgrade Collabora Online immediately, because the earlier fix for a different code path does not stop this specific attack. Verify Nextcloud richdocumentscode instances are patched to 26.4.303 or higher to close the CVSS 9.2 risk. Upgrade the richdocumentscode app to version 26.4.303 or remove it entirely, as disabling the application is insufficient to mitigate the vulnerability. For Nextcloud 29 or older, upgrade the platform or remove the application to close the unauthenticated OS command injection vector in proxy[.]php.

Static analysis tools may miss the layered escape, so watch for repeated control character filtering in proxy traffic. Reports attribute the deployment of PHP webshells and searches for password databases and cryptocurrency wallets to the attacker, but the full scope of data exfiltration remains unconfirmed. The four-week gap between the September 11 fix and the October 14 advisory publication creates uncertainty regarding the extent of prior exploitation in environments that missed the initial patch. Watch for input filters catching control characters in proxy[.]php.

Vulnerabilities

  • CVE-2025-66208 — CVSS 9.8 (Critical) · CWE-78 · CollaboraOnline online. Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online.
  • CVE-2026-110447 — CVSS 9.2 (Critical) · CWE-78 · Collabora Collabora Online - Built-in CODE Server. Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than…

Techniques

  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1505.003 Web Shell (Persistence)

Indicators

  • 6 indicators on file

Coverage

9. FBI arrests third ShinyHunters suspect in global crackdown (Segment)

Event now covered by 16 outlets (was 15); Blast radius expanded: new vendor(s): aws; 3 new indicator(s) observed

What changed

A second vulnerability discovered by Anthropic’s Mythos model has been exploited in the wild. GTG-20006’s agents monitored whether security products detected deployed malware and modified tools when detection occurred. Specific claims about other targets like H&M or TFG London remain under investigation or are reported by fewer sources. H&M is reportedly investigating claims that it was targeted by the ShinyHunters cybercrime group. This is the third suspect taken down in the global crackdown on the ShinyHunters extortion group. Shiny Hunters allegedly extorted an estimated $70 million in the last year.

How it works

ShinyHunters exploited a third-party integration to access Rockstar Games’ internal Snowflake data warehouse. An Accenture contractor was allegedly removed from work with the bureau after failing to patch the vulnerability exploited by ShinyHunters. TFG London is still trying to establish whether any personal or sensitive information has been compromised.

What to do

On Friday ShinyHunters exploited a second vulnerability found by Anthropic’s Mythos model to breach systems. The group scans for open ports and AI chat agents to identify targets before launching attacks. They use stolen authentication tokens to impersonate internal services without exploiting underlying software flaws. Scan your environments for exposed AI agent endpoints and verify no unauthorized tools have shell command execution privileges. Audit AI agent configurations to ensure they cannot invoke tools reaching sensitive data warehouses like Snowflake or AWS GovCloud. ShinyHunters has allegedly breached more than 140 organizations using AI agents to automate every stage of the attack. It is unclear if breaches at H&M or TFG London are unique incidents or part of a broader automated campaign. Arrests in Jordan, Pennsylvania, and the Netherlands are dismantling the group, but data compromise extent remains uncertain. Attackers may exfiltrate information without triggering traditional detection signatures. Verify if active AI agents have been modified to suppress reporting or if TFG London brands were targeted by the same script used on the FBI’s jobs portal. An estimated seventy million dollars in extortion proceeds attributed to the group in the last year keeps the financial incentive for targeting high-value data significant. The threat surface extends beyond single-sector targets. Audit access logs for the specific systems targeted by Shiny Hunters to identify any unauthorized data exfiltration attempts, given the group’s history of breaching over 140 organizations.

Limits and watch

It remains possible that Shinyhunters accessed some of H&M Group’s data last week, but the extent of this compromise is not yet confirmed. Watch

Techniques

  • AML.T0006 Active Scanning (Reconnaissance)
  • AML.T0108 AI Agent (Command And Control)
  • T1003.003 NTDS (Credential Access)
  • T1003.006 DCSync (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • and 10 more

Named actors and malware

  • ShinyHunters (actor)
  • Cl0p (malware)
  • Scattered Spider (actor)
  • Clop (malware)
  • Lapsus$ (actor)
  • TeamPCP (actor)
  • ShinyHunters group (actor)

Indicators

  • 25 indicators on file

Coverage

10. CyberXero Uses 51 AI Agents to Steal 628,000 Ukrainian Records (Segment)

Event now covered by 5 outlets (was 4); Blast radius expanded: new vendor(s): crowdstrike

The manual arm of the operation targeted specific organizations, including a district heating provider in Kharkiv. A single automated run of the global pipeline scanned 4,708 targets, confirmed access to 429 WordPress admin panels, and deployed 32 webshells within 61 seconds. SOCRadar researchers confirm the actor uses the same infrastructure for both global WordPress attacks and this specific Ukrainian campaign. The operator was linked to Moscow time activity via a paid AI subscription, and they bypassed model safety refusals by framing requests as authorized tests. The actor behind CyberXero is a Russian-speaking, financially motivated threat actor known as an initial access broker who breaks into networks and sells access to other criminals.

The global pipeline uses a custom tool called wp2shell, which abuses a flaw in the WordPress REST API to inject SQL, plant a rogue admin account, and drop a webshell. Threat actors used the Cobalt Strike tool to target internal systems with APT and ransomware. Once control over the affected systems has been established, a Coinminer which mines Monero coins is installed.

CyberXero, a Russian-speaking initial access broker, leveraged httpd[.]exe to install web shells and exploit Apache vulnerabilities. The actor ran up to 51 specialized AIDE agents, yet 51% of 2025 infected machines were already mitigated by EDR. Investigators should examine Windows Task Scheduler and Host Firewall on the 429 compromised hosts for hidden tasks or deleted registry values. Monitor the 2,600 active infections to verify if the 32 new webshells trigger automated block rules or if the operator purchased the Disable Antivirus product. Check Windows Task Scheduler for suspicious tasks using schtasks, WMI, or PowerShell running under SYSTEM or odd user contexts. Inspect outbound HTTPS from command-line tools to Discord, Slack, or Graph API for unusual volume or persistence signaling C2.

Fifty-one percent of infected machines were mitigated by EDR, leaving forty-nine percent potentially active, while the full scope of Gh0st RAT installation attempts remains unconfirmed. SentinelOne attributes the actor’s use of AvNeutralizer to disable EDR, but the specific mechanisms for bypassing model safety refusals are not detailed in the evidence. Monitor for the creation, modification, or deletion of scheduled tasks via Task Scheduler, WMI, or PowerShell, especially those executed from svchost[.]exe or taskeng[.]exe. Watch for unusual outbound connections to web services from uncommon processes using SSL/TLS, particularly those exhibiting high outbound data volume or persistence.

Techniques

  • T1003.004 LSA Secrets (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1008 Fallback Channels (Command And Control)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • T1021.005 VNC (Lateral Movement)
  • T1027.010 Command Obfuscation (Stealth)
  • T1027.016 Junk Code Insertion (Stealth)
  • T1033 System Owner/User Discovery (Discovery)
  • T1036.004 Masquerade Task or Service (Stealth)
  • and 10 more

Named actors and malware

  • Cobalt Strike (malware)
  • Gh0st RAT (malware)
  • Black Basta (malware)
  • FIN7 (actor)

Indicators

  • 22 indicators on file

Coverage