News Last updated: 16 October 2026 12:00 UTC

Coming up

Full calendar →

ReportArctic Wolf Security Operations Report 20262 Sep – 28 Oct 2026Open now
ReportENISA Threat Landscape 202620 Sep – 5 Nov 2026Open now
ReportASD Annual Cyber Threat Report 2025-261 Oct – 15 Nov 2026Open now

Follow the daily brief: RSS · JSON point any reader at the RSS feed — no email needed.

How to read confidence

Confirmed: Verified by a primary source or first-party artifact.
Corroborated: Multiple independent secondary sources agree.
Claimed: A single claim (e.g. a leak-site post) without corroboration.
Disputed: Sources conflict; we show both sides and anchor on the facts.

Recently published reports

IBM Cost of a Data Breach 20262026-08-03
The Average Cost of a Data Breach Rises to $5 Million
Report desk: Barracuda Managed XDR Global Threat Report 20262026-08-03
Report desk: Barracuda Managed XDR Global Threat Report 2026
Report desk: Verizon 2026 Data Breach Investigations Report2026-07-25
Report desk: Verizon 2026 Data Breach Investigations Report
Report desk: Mandiant M-Trends 20262026-07-25
Report desk: Mandiant M-Trends 2026
Report desk: SentinelOne Annual Threat Report 2026 - A Defender's Guide from the Frontlines2026-07-25
Report desk: SentinelOne Annual Threat Report 2026 - A Defender's Guide from the Frontlines

Leak-site claims today: 41 listings
CISA KEVKEV: CVE-2026-104935 — Ivanti Connect Secure (Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability)Oct 16
Our takeCISA added CVE-2026-104935 in Ivanti Connect Secure to its KEV catalog: confirmed exploited in the wild for unauthenticated RCE. Patch now if you run it.Security Resilience desk
Sources & guidance
Sources (10)
- cisa_kev · cisa_kev
- cisa_advisories · cisa_advisories
- bleeping · bleeping
- rapid7 · rapid7
- securityweek · securityweek
- cccs · cccs
- cyberscoop · cyberscoop
- securityweek · securityweek
- therecord · therecord
- darkreading · darkreading
What this means for you — Security leader:CISA added CVE-2026-104935 in Ivanti Connect Secure to the KEV catalog: it is confirmed exploited in the wild and allows unauthenticated remote command execution. Apply the vendor patch or mitigations immediately if you run any affected version.
What this means for you — Lean IT orgs:Ivanti Connect Secure has a confirmed exploited vulnerability that lets attackers run commands without logging in. Check with your IT provider or MSP today about whether you use it and if the fix is applied.
What this means for you — MSP:CVE-2026-104935 is confirmed exploited in Ivanti Connect Secure (versions 25.1.1.1 and prior, 25.2.2 and prior, 22.8R2.4 and prior). Review all client instances and apply Ivanti's patch or mitigations now.
What this means for you — Researcher:CISA added CVE-2026-104935 to the KEV catalog after confirming active exploitation in Ivanti Connect Secure. It is an authentication bypass by spoofing that leads to unauthenticated remote command execution.
CISA KEVNew critical CVE: CVE-2026-76519 — A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated…Oct 16
Our takeCISA added CVE-2026-76519 to its KEV catalog: Cisco Secure Email Gateway relative path traversal that lets unauthenticated remote attackers write arbitrary files on the OS. Patch now if you run the affected AsyncOS releases (enterprises and smaller shops alike).Security Resilience desk
Sources & guidance
Sources (7)
- cisa_kev · cisa_kev
- cisa_advisories · cisa_advisories
- nvd_recent · nvd_recent
- cccs · cccs
- bleeping · bleeping
- hackernews · hackernews
- securityweek · securityweek
What this means for you — Security leader:Cisco added CVE-2026-76519 (relative path traversal in Secure Email Gateway) to the CISA KEV catalog. Update to 15.5.5-014, 16.5.0-780 (Email Gateway) or 15.5.5-006, 16.5.0-xxx (Email and Web Manager) immediately if you run these versions.
What this means for you — Lean IT orgs:Cisco added this email gateway vulnerability to the CISA KEV catalog. Update to a fixed version right away if you run Cisco Secure Email Gateway or the related Web Manager on your own hardware.
What this means for you — MSP:Cisco added CVE-2026-76519 to the CISA KEV catalog. Check every client running on-prem Secure Email Gateway or Secure Email and Web Manager and update to the fixed AsyncOS releases immediately.
What this means for you — Researcher:Cisco added CVE-2026-76519 to the CISA KEV catalog. Update to a fixed version right away if you run Cisco Secure Email Gateway or the related Web Manager on your own hardware.
CERT-BundChina-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support ServersOct 16
Our takeArmory Castle (China-nexus) exploited CVE-2026-102764 as a zero-day in late August to take over BeyondTrust Remote Support servers, then deployed custom tools and wiped logs. Patch now if you run it on-prem.Security Resilience desk
Sources & guidance
Sources (3)
- hackernews · hackernews
- cert_bund · cert_bund
- securityweek · securityweek
What this means for you — Security leader:BeyondTrust Remote Support on-prem customers: apply the patch for CVE-2026-102764 immediately and review logs for suspicious remote-support sessions from late August onward.
What this means for you — Lean IT orgs:If you run BeyondTrust Remote Support yourself, update it now. Most teams using only the hosted version have nothing to do.
What this means for you — MSP:Audit every client running on-prem BeyondTrust Remote Support; deploy the CVE-2026-102764 patch and hunt for Armory Castle artifacts in logs from late August.
What this means for you — Researcher:Armory Castle (UNC5221) used CVE-2026-102764 (improper origin validation, CVSS 9.3) as a zero-day in late August to gain initial access, deploy tools, and wipe logs.
PressOctober 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical VulnerabilitiesOct 16
Our takeMicrosoft's October 2026 Patch Tuesday fixes 1,413 CVEs, including three zero-days and 75 criticals. Patch today.Security Resilience desk
Sources & guidance
Sources (3)
- crowdstrike · crowdstrike
- infosec_mag · infosec_mag
- securityweek · securityweek
What this means for you — Security leader:Apply October 2026 patches for the 75 criticals and three exploited zero-days immediately; prioritize internet-facing systems and test thoroughly before broad rollout.
What this means for you — Lean IT orgs:Patch your Windows systems and any Microsoft software this week; focus first on anything exposed to the internet.
What this means for you — MSP:Schedule October 2026 patching for all clients; the three exploited zero-days and 75 criticals warrant immediate action on internet-facing assets across every stack.
What this means for you — Researcher:Review CrowdStrike's full breakdown of the 1,413 CVEs; the three zero-days and 75 criticals are the highest priority for exploit likelihood analysis.
AdvisoryCSA Singapore alert: 16 October 2026 16 October 2026 Active Exploitation of Vulnerability in Palo Alto Networks Products Attackers are exploiting a high-severity vulnerability in Palo Alto Networks PAN-OS to execute arbitrary code with root privileges. Patch immediately.Oct 16
Our takeCSA Singapore reports active exploitation of a high-severity vulnerability in Palo Alto Networks PAN-OS that lets attackers run arbitrary code as root. Patch immediately if you run PAN-OS.Security Resilience desk
Sources & guidance
Sources (2)
- csa_sg · csa_sg
- csa_sg · csa_sg
What this means for you — Security leader:CSA Singapore reports active exploitation of a high-severity vulnerability in Palo Alto Networks PAN-OS allowing root-level arbitrary code execution. Apply the vendor patch immediately and review exposure of management interfaces.
What this means for you — Lean IT orgs:If you run Palo Alto firewalls or Prisma Access, apply the PAN-OS security update right away. Most lean teams can do this through the device's web interface or by asking your MSP to handle it today.
What this means for you — MSP:CSA Singapore confirms in-the-wild exploitation of a root-level RCE in PAN-OS. Check every client PAN-OS, Cloud NGFW, Prisma Access, and Prisma Browser deployment and patch immediately; also confirm management planes are not internet-exposed.
What this means for you — Researcher:CSA Singapore alert (AL-2026-143) states active exploitation of a high-severity vulnerability in Palo Alto Networks PAN-OS enabling root arbitrary code execution. Patch all affected versions now.
AdvisoryCERT-In Warns Google Chrome Users of Critical Flaws That Could Allow CyberattacksOct 16
Our takeCERT-In warns of 37 high-severity flaws in Chrome; Google fixed them in 151.0.7922.109 and later. Update via chrome://settings/help or your usual channel.Security Resilience desk
Sources & guidance
Sources (4)
- the420_in · the420_in
- auscert_bulletins · auscert_bulletins
- hkcert · hkcert
- govcert_hk · govcert_hk
What this means for you — Security leader:Update Chrome to version 131.0.6778.85 (or later) via auto-update or chrome://settings/help. Review managed browser policies and confirm rollout across endpoints.
What this means for you — Lean IT orgs:Open Chrome, go to chrome://settings/help and let it update. Most teams can treat this as routine browser patching; restart the browser when done.
What this means for you — MSP:Push Chrome updates to all managed endpoints and verify version 131.0.6778.85 or higher; include this in client patch cadences and browser policy reviews.
What this means for you — Researcher:Review the 37 fixed CVEs in the October 2026 Chrome release; several are high/critical use-after-free and heap issues already under active exploitation.
CISA KEVKEV: CVE-2026-7273 — Zyxel GS1900 Series Switches (Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability)Oct 16
Our takeCISA added CVE-2026-7273 (Zyxel GS1900 buffer overflow) to KEV after confirmed in-the-wild exploitation granting command access; a Chinese-speaking actor has already hit nearly 1,000 unpatched switches. Patch immediately if you run these devices.Security Resilience desk
Sources & guidance
Sources (8)
- cisa_kev · cisa_kev
- cisa_advisories · cisa_advisories
- cccs · cccs
- securityweek · securityweek
- cisa_advisories · cisa_advisories
- cisa_advisories · cisa_advisories
- darkreading · darkreading
- securityweek · securityweek
What this means for you — Security leader:CISA added CVE-2026-7273 (stack-based buffer overflow in Zyxel GS1900 switches) to KEV. A Chinese-speaking actor has exploited it against nearly 1,000 devices to exfiltrate data. Patch or apply vendor mitigations immediately if you run these switches.
What this means for you — Lean IT orgs:If you use a Zyxel GS1900 switch, check the vendor advisory for the available update and install it right away. This flaw lets someone on your local network run commands without a password.
What this means for you — MSP:Scan client environments for Zyxel GS1900 series switches. CVE-2026-7273 is confirmed exploited in the wild by a Chinese actor; push the Zyxel firmware update or mitigations across all affected devices now.
What this means for you — Researcher:CISA added CVE-2026-7273 (Zyxel GS1900 stack-based buffer overflow) to KEV after confirmed in-the-wild exploitation granting command access; a Chinese-speaking actor has already hit nearly 1,000 unpatched switches. Patch immediately if you run these devices.
CISA KEVAL26-023 - Vulnerability Impacting Microsoft SharePoint Server - CVE-2026-65660Oct 16
Our takeCISA added CVE-2026-65660 (SharePoint code injection, CVSS 8.8) to KEV: it's being exploited in the wild. Patch immediately if you self-host SharePoint (some enterprises); most small teams use the hosted version and can ignore this one.Security Resilience desk
Sources & guidance
Sources (7)
- cccs · cccs
- cisa_kev · cisa_kev
- hackernews · hackernews
- msft_security · msft_security
- msft_security · msft_security
- msft_security · msft_security
- helpnet · helpnet
What this means for you — Security leader:Patch all on-premises SharePoint Servers immediately; CISA has listed CVE-2026-65660 in KEV confirming active exploitation.
What this means for you — Lean IT orgs:If you self-host Microsoft SharePoint Server, apply the Microsoft patch right away. Most small teams use SharePoint Online instead and can ignore this.
What this means for you — MSP:Confirm which clients run on-premises SharePoint Server and schedule the CVE-2026-65660 patch urgently; hosted M365 tenants are unaffected.
What this means for you — Researcher:CISA added CVE-2026-65660 (SharePoint code injection, CVSS 8.8) to KEV citing confirmed in-the-wild exploitation.
CERT-BundMonths-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware GroupsOct 16
Our takeReliaQuest reports that Qilin and Settra ransomware groups are still exploiting the PAN-OS CVE that Palo Alto fixed in May. If you haven't patched it yet, you remain exposed and should update now.Security Resilience desk
Sources & guidance
Sources (4)
- infosec_mag · infosec_mag
- hkcert · hkcert
- cert_bund · cert_bund
- the420_in · the420_in
What this means for you — Security leader:Apply the May 2026 PAN-OS update (including CVE-2026-0322) on all exposed firewalls and GlobalProtect VPN instances now. Monitor management-plane logs for post-authentication anomalous commands.
What this means for you — Lean IT orgs:If you run a Palo Alto firewall or VPN, check the version and apply the May update immediately; most cloud-managed instances will update automatically.
What this means for you — MSP:Audit every client Palo Alto firewall and GlobalProtect instance for versions before the May 2026 patch; push the update and restrict management-interface exposure.
What this means for you — Researcher:Qilin and Settra ransomware campaigns continue to chain the post-auth RCE in PAN-OS CVE-2026-0322 months after patch release.