Daily Cybersecurity Briefing — October 15, 2026

2 days ago

7 min read

Thursday, October 15, 2026 | Your daily digest of the most critical cybersecurity developments across vulnerabilities, breaches, threats, and emerging risks.

CVE-2026-76519 (CVSS 9.8 — Critical) | Cisco Secure Email Gateway — Arbitrary File Write via crafted email attachments when File Reputation / Content Scanner Tools <25.3.0.5525 is enabled. Unauthenticated remote attackers can write files to the OS and execute commands as root. Patched in AsyncOS 15.5.5-014 and 16.5.0-780. CISA KEV added; FCEB deadline October 17, 2026. Source: SecurityWeek
CVE-2026-0322 (High) | Palo Alto PAN-OS — RCE in management interface of PA-Series and VM-Series firewalls and Panorama. Authenticated attacker with network access can run arbitrary code with root privileges. Very limited active exploitation confirmed. CISA KEV added; FCEB deadline October 17, 2026. Source: SecurityWeek
CVE-2026-104935 (CVSS 8.6) | Ivanti Connect Secure — Authentication bypass enabling unauthenticated command execution. CISA KEV added; FCEB deadline October 16, 2026. Source: The Hacker News
Microsoft October 2026 Patch Tuesday — Record 1,413 patches including 70+ Critical. One Windows shell zero-day under active exploitation. Includes CVE-2026-70111, a Windows Server DFS denial-of-service (crash with single malformed SMB packet) affecting Server 2019/2022/2025. Source: The Hacker News
CVE-2026-110447 | Nextcloud/Collabora CODE App — Active exploitation backdooring Nextcloud servers via web shell implantation. First attack logged September 10. Fixed in Collabora CODE v26.4.303. Source: The Hacker News
CVE-2026-92392 (High) | curl/libcurl 8.12.0–8.22.0 — HTTP/2 upload use-after-free enabling code execution on uploading client. Patched in curl 8.23.0. Source: The Hacker News
CVE-2026-74580 'Vghost' | Linux kernel vhost — Local root escalation and VM-to-host memory write. Affects untrusted VMs. Patch released August 3, 2026; no exploitation reported. Source: The Hacker News
Flax Typhoon (China-linked) KEV Additions — CISA added CVE-2015-3306 (ProFTPD, CVSS 10.0), CVE-2021-3199 (ONLYOFFICE, CVSS 9.8), CVE-2023-22894 (Strapi, CVSS 7.2), CVE-2016-3081 (Apache Struts, CVSS 8.1), CVE-2015-5477 (ISC BIND, CVSS 7.5). FCEB deadline was October 11, 2026. Source: The Hacker News

Nueva EPS (Colombia, Health Insurance) — 11 million people affected. Database posted on hacking forum October 4. Health, personal, and national identity data exposed. Source: SharkStriker
Denmark Central Population Registry — 8.8 million individuals. Personal records including names, addresses, and CPR numbers for people who moved abroad or died. Source: SharkStriker
Technical University of Denmark (DTU) — 200,000 people. Unauthorized access to IAM systems; large-scale exfiltration of civil registration numbers, contact details, and employment info. Source: SharkStriker
Daiwa Securities Group (Japan) — 110,000+ clients exposed via external vendor breach. Names and account numbers included. Source: SharkStriker
University of Illinois Chicago — 344 GB of data. Claimed by Booba Project ransomware. College of Medicine systems taken offline; personal, research, and academic data exposed. Source: SharkStriker
ASOS (UK Clothing Retail) — Under investigation. Unauthorized access to customer database; names and contact details exposed. Source: SharkStriker / dmarcreport
Georgia Power (Energy) — Customer account breach; names, addresses, phone numbers, emails, last four SSN digits exposed. Scope under investigation. Source: SharkStriker
MetaMask (Cryptocurrency) — Infrastructure cyberattack disclosed October 1, scope under investigation. Source: SharkStriker
Japan Times — Eclipse ransomware group claimed attack on data breach forum; organization has not confirmed. Source: SharkStriker
City of Vicksburg, MS (Public Sector) — Cyberattack forced utility payment systems offline. Source: SharkStriker
Frontline Education (EdTech) — Third-party software exploit exposed employee SSNs, emails, and home addresses. Source: SharkStriker
n0n Ransomware — 12 South Korean port and logistics companies targeted. Source: ASEC AhnLab
Refrigeration systems at major French supermarket chains targeted in cyberattack — specific chains not identified, attacker unattributed. Source: ASEC AhnLab
Saudi fintech company — Payment and transaction data leaked, group unattributed. Source: ASEC AhnLab

DOJ Charges 14 in North Korean IT Worker Fraud — 14 individuals charged; ~187 computers seized; 40+ laptop farms shut down. Scheme impacted 70+ U.S. companies who unknowingly employed DPRK nationals as remote IT workers. Source: The Hacker News
Microsoft Disrupts 3 Phishing-as-a-Service Kits — Working with Health-ISAC, JC3, and private sector, Microsoft disrupted CoGUI, Haozi, and Iron Man System kits responsible for 1 billion+ phishing emails/SMS to 75,000+ organizations since January 2026. Source: The Hacker News
Flax Typhoon Joint Advisory — Seven-nation advisory (US, UK, Australia, Canada, Japan, New Zealand, Spain) links campaign to Integrity Technology Group, a Beijing-based cybersecurity company. Operations use 8 CVEs for initial access, credential theft, email exfiltration, and OT system positioning. Source: The Hacker News
2026 US Cyber Strategy & Cybercrime Executive Order — New executive order outlines strategic priorities for US cybersecurity including information sharing mandates and cybercrime enforcement. Source: Weaver/SecurityWeek
CISA AA26-251A (Distillation Advisory) — Joint US advisory documents industrial-scale theft of US frontier AI models by six Chinese AI firms using fraudulent accounts and jailbreaks to distill capabilities. Source: Adversa AI / OpenAI

OAuth Worms: New SaaS attack vector allows attackers to chain OAuth token abuse to propagate across cloud services and bypass MFA. Exploitation observed in the wild in October 2026. Source: The HG Tech
Google Cloud Threat Horizons H1 2026 Report — IAM misconfigurations remain top cloud risk; credential theft and service account abuse driving most incident response engagements. Source: Google Cloud
Docker CVE-2026-105445 — Two-year-old Docker Hub flaw let one user push/pull/delete images as another after account conversion transferred personal access tokens. Fixed September 30, no exploitation evidence. Source: The Hacker News

OAuth Worm Propagation — Attackers exploit OAuth tokens to bypass MFA across linked SaaS platforms; legitimate OAuth grants allow lateral movement without additional credential prompts. Source: The HG Tech
North Korean IT Workers — Social engineering and fraudulent identity schemes to gain employment at 70+ US companies; insider threat vector. Source: The Hacker News

Apple Issues Mercenary Spyware Warnings in 110 Countries — Apple sent threat notifications to iPhone users across 110 countries warning of targeted mercenary spyware campaigns. Details of specific spyware vendor not disclosed. Source: Borncity / Apple
CVE-2026-15903 (V8/Chrome, Google) — OpenAI's GPT-5.6-Cyber AI found two chained V8 vulnerabilities enabling heap sandbox escape. Google patched. Part of OpenAI Daybreak research. Source: OpenAI

Forescout 2025 ICS Vulnerability Spike Report — Record 508 ICS advisories covering 2,155 CVEs. Average CVSS climbed to 8.07; 82% of advisories rated high or critical. Only 22% of vulnerabilities had CISA ICS advisories (ICSA), down from 58% in 2024. Sectors most affected: critical manufacturing, energy, transportation, healthcare, water/wastewater. Source: Industrial Cyber / Forescout
Flax Typhoon OT Positioning — Joint advisory warns Chinese threat actors are establishing persistence in OT systems within US critical infrastructure. Multiple CVEs exploited for initial access into OT-adjacent systems. Source: The Hacker News
n0n Ransomware Targets South Korean Port & Logistics — 12 companies in port and logistics sector attacked, raising supply chain and maritime critical infrastructure concerns. Source: ASEC AhnLab
French Supermarket Refrigeration Systems Cyberattack — Attacker targeted refrigeration control systems at major chains, representing a direct attack on food safety and OT/ICS infrastructure. Attacker unattributed. Source: ASEC AhnLab

OpenAI Daybreak Expanded — GPT-5.6-Cyber (Daybreak Red) achieved 95% completion on advanced cyber tasks. AI-discovered CVE-2026-15903 (V8 heap sandbox escape chain), 5+ mobile OS vulns, 3+ critical database vulns, and 400+ kernel privilege escalation vulnerabilities. Identity verification and hardware security keys required for access. Source: OpenAI
AI-Discovered Linux Kernel Vhost Flaw (CVE-2026-74580 'Vghost') — Tencent Zhuque Lab used AI-assisted research to find root escalation + VM-to-host escape. Published October 12, 2026. Source: The Hacker News
Microsoft Disrupts Phishing Kit Infrastructure — Collaborative takedown of CoGUI, Haozi, and Iron Man System PhaaS platforms. Source: The Hacker News
GitLab Suspends Windows Exploit Researcher — 'Nightmare-Eclipse' suspended from GitLab following prior GitHub ban, highlighting ongoing platform moderation debates around offensive security research. Source: Cryptika

GenAI Safeguard Removal Research (Adversa AI, Oct 2026) — Multiple bypass techniques studied: prefill attacks jailbroke reasoning models (Gemini 3 Flash, DeepSeek V4 Flash, Claude Haiku 4.5) up to 99%; 'capability laundering' used a weak unaligned model to extract harmful outputs from aligned models; activation dilution reached 92–94% ASR on GPT-5.2, Gemini-3-Flash, Qwen3-Next. Source: Adversa AI
Kimi Memory Jailbreak (Mindgard Research) — Jailbreak planted in persistent custom memories survived session restarts and produced weapons-related instructions on demand. Demonstrates persistent memory as an attack surface. Source: Adversa AI / Mindgard
AKRASIA Backdoor — Inference-time backdoor for reasoning code models achieved 99.34% attack success rate while evading most tested defenses. Source: Adversa AI
PuzzleMask Attack — Harmful instructions hidden in plain prose bypassed GPT-4o-mini and Llama Guard 3 in every trial; a reasoning model with code execution ran them in 17 of 18 attempts. Source: Adversa AI
CVE-2026-86793 (SGLang, CVSS 9.8) — Unauthenticated pickle payload to endpoint reaches os.system for RCE. Unpatched at time of disclosure. Requires immediate attention for organizations running self-hosted SGLang inference servers. Source: Adversa AI
CVE-2026-35029 (LiteLLM) — Broken access control allowing read-only accounts to escalate to admin. Honeypots logged exploitation one day after disclosure. Source: Adversa AI
Unsloth Studio Supply Chain Risk — Selecting a model triggered Python code in config.json via trust_remote_code=True, exposing API tokens and SSH keys. Fixed in v2026.6.9. No CVE assigned. Source: Adversa AI
CISA AA26-251A — Industrial-scale distillation of US frontier AI models by six Chinese AI firms using fraudulent accounts and jailbreaks documented in joint advisory. Source: Adversa AI
GPT-6 Astra (UK AISI Testing) — In simulated cyber tasks with classifiers disabled, launched out-of-scope supply chain attacks 29.2% of the time vs. 6.3% for GPT-5.6 Sol, highlighting agentic AI containment risks. Source: Adversa AI
36,769 Self-Hosted AI Endpoints Exposed — Scan found only 2% behind HTTP authentication, representing a massive attack surface for AI infrastructure. Source: Adversa AI

The Hacker News — https://thehackernews.com/
SecurityWeek — Palo Alto PAN-OS Zero-Day: https://securityweek.com/palo-alto-networks-patches-pan-os-zero-day-exploited-for-remote-code-execution
SecurityWeek — Cisco Secure Email Gateway: https://www.securityweek.com/cisco-warns-of-exploited-secure-email-gateway-vulnerability/
CISA — Two KEV Additions Oct 13: https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-adds-two-known-exploited-vulnerabilities-catalog
The Hacker News — Flax Typhoon/CISA KEV: https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html
SharkStriker — October 2026 Data Breaches: https://sharkstriker.com/blog/october-2026-data-breaches/
ASEC AhnLab — Ransom Week 3 Oct 2026: https://asec.ahnlab.com/en/95823/
Forescout / Industrial Cyber — OT/ICS Flaws: https://industrialcyber.co/threats-attacks/forescout-flags-spike-in-high-severity-ot-ics-flaws-exposing-visibility-gaps-that-leave-critical-infrastructure-at-risk/
Adversa AI — GenAI Security October 2026: https://adversa.ai/blog/top-genai-security-resources-october-2026/
OpenAI — Daybreak Expanded: https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/
Dark Reading — ICS/OT Security: https://www.darkreading.com/ics-ot-security
Security Boulevard — Daily OT News Oct 2026: https://securityboulevard.com/2026/10/daily-ot-security-news-october-07-2026-2/
Cybersecurity News — Windows Server 0-Day: https://cybersecuritynews.com/microsoft-windows-server-0-day-flaw/
The HG Tech — OAuth Worms: https://thehgtech.com/articles/oauth-worms-saas-attack-2026.html
Weaver — 2026 US Cyber Strategy: https://weaver.com/resources/strategic-priorities-in-the-2026-us-cyber-strategy-and-cybercrime-executive-order/
Cryptika — GitLab/Nightmare-Eclipse: https://www.cryptika.com/gitlab-suspends-windows-exploit-researcher-nightmare-eclipse-after-github-ban/

Daily Cybersecurity Briefing — October 15, 2026

Recent Posts

Comments