Skip to content

Sam's News — security — 2026-10-15

Security

8.5 Cisco Secure Email Gateway Vulnerability Exploited in the Wild

Unauthenticated attackers can write arbitrary files and execute commands with root privileges on Cisco Secure Email Gateway systems.

  • CVE-2026-76519 allows unauthenticated remote command execution as root (CVSS 9.8)
  • Requires File Reputation service enabled and Content Scanner Tools version earlier than 25.3.0.5525
  • Fixed in AsyncOS 15.5.5-014, 16.5.0-780, and Content Scanner Tools 25.3.0.5525 or later
  • Active exploitation discovered October 2026; AsyncOS 16.0 requires migration to fixed release
  • CVE-2026-76519 rated CVSS 9.8; zero-day actively exploited in the wild
  • Flaw in Advanced Malware Protection; unauthenticated attacker executes root commands via malicious email attachment
  • Affects SEG physical/virtual appliances and Panorama where File Reputation service enabled
  • CISA added to Known Exploited Vulnerabilities; federal agencies have Saturday remediation deadline

Sources: SecurityWeek RSS, The Register AI Web Searched Update to: Cisco warns of active attacks exploiting critical Secure Email Gateway vulnerability

8 Palo Alto Networks patches critical PAN-OS RCE vulnerability under active exploitation

Palo Alto Networks released patches October 15 for CVE-2026-0322, a high-severity remote code execution flaw (CVSS 8.6) in PAN-OS management interfaces allowing authenticated attackers to execute arbitrary code with root privileges. Very limited active exploitation reported; three U.S.-geolocated IP addresses linked to exploit attempts. CISA requires Federal agencies to patch by October 17.

  • CVE-2026-0322 CVSS 8.6; authenticated RCE in PAN-OS management interface
  • Affects PA-Series, VM-Series firewalls and Panorama; Cloud NGFW and Prisma Access not affected
  • Very limited active exploitation; 3 U.S. IP addresses linked to attempts
  • CISA deadline: October 17, 2026 for Federal agencies to patch

Sources: The Hacker News AI Web Searched, BleepingComputer RSS, SecurityWeek RSS

Hackers exploited vulnerabilities in the UK Legal Aid Agency's IT systems during an April 2025 attack, exfiltrating decades of personal records. Initially disclosed as 2007+ data compromise, the Ministry of Justice revealed on October 14, 2026 that records extend back to 1978, with the majority dating 1990s–2000s. Compromised data may include names, addresses, dates of birth, and legal aid case information.

  • Hack occurred April 2025; data exfiltrated includes records dating to 1978
  • Earlier disclosure: 2007+; October 14 revelation: vast majority from 1990s–2000s; small number pre-2007
  • No complete record of single legal aid case affected; limited probation data also accessed
  • Claimed by known hacking group; government went offline after discovering extent in May 2025

Sources: The Independent AI Web Searched, BleepingComputer RSS

7.5 Langflow critical RCE flaw exploited in 1,423 honeypot attacks

A critical authenticated remote code execution vulnerability in Langflow (CVE-2026-105740, CVSS 9.9) affecting versions prior to 1.9.0 has been exploited in 1,423 honeypot attacks since September 19, 2026. Non-admin authenticated users can inject malicious MCP servers to execute arbitrary OS commands and environment variables without validation or sandboxing.

  • CVE-2026-105740 CVSS 9.9; authenticated RCE in Langflow <1.9.0
  • 1,423 honeypot attacks since September 19; 333 on October 11; 66 on October 15
  • Attacks from 27 unique IP addresses across 15 countries
  • Any authenticated user can execute arbitrary commands via malicious MCP server injection

Sources: The Hacker News AI Web Searched

7 Hirudo Android RAT replaces banking apps with trojanized versions

Hirudo is a novel Android remote access trojan combining banking malware and full RAT capabilities, delivered via droppers embedded in seemingly legitimate shopping, adult video, and short drama apps. Hirudo detects specific banking apps, displays fake update prompts, replaces them with trojanized versions, and uses sophisticated hooking to blind signature verification and accessibility checks. Currently targets eight Indonesian banking apps with code suggesting potential expansion to China, India, Mexico, Morocco, and Thailand.

  • Hirudo targets 8 Indonesian banking apps; code hints at China, India, Mexico, Morocco, Thailand expansion
  • Delivered via droppers in shopping, adult video, short drama apps on social media
  • Trojanized replacement apps include hooking engine bypassing signature and Accessibility Services verification
  • Capabilities: steal credentials, remote device control, live camera views, SMS theft (90-day historical scan)

Sources: SecurityWeek AI Web Searched

7 CenterPoint Energy data breach compromises 1 million Texans' personal information

A data breach at CenterPoint Energy exposed personal information including names, addresses, Social Security numbers, and driver's license numbers for approximately 1 million Texas customers.

Sources: SecurityWeek RSS

7 GhostAction credential theft campaign compromises 1,900 GitHub accounts

The GhostAction campaign has compromised approximately 1,900 GitHub user accounts and targeted over 30,000 repositories in a spike of credential-theft activity.

Sources: The Hacker News RSS

7 AhsayCBS security patches address web shell vulnerabilities after incomplete fixes

Ahsay Backup has released new security updates for AhsayCBS to address CVE-2026-105133 and CVE-2026-105134 flaws that were exploited to deploy web shells and cryptocurrency miners following incomplete initial patches.

Sources: The Hacker News RSS

6.5 Microsoft patches Windows 11 black screen and Explorer crash bug

Microsoft has fixed a known issue affecting Windows 11 users that caused black screens, desktop loading delays, and File Explorer crashes following recent updates.

Sources: BleepingComputer RSS

Military Technology

6.5 Ukraine regains Starshield access after SpaceX lifts service restrictions

The Ukrainian military restored mobile Starshield satellite service access days after SpaceX restrictions disrupted drone operations along the front line.

Sources: The Record RSS