CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →
‹Fri · 16 Oct 2026
All daily briefs →
Daily brief · UTC day

Friday, 16 October 2026

5 verified findings from 1 run · 8 updates to prior coverage · the settled record for this UTC day, in the classic brief order.

CriticalPatch BeyondTrust Remote Support now, review every appliance exposed since late August and rebuild any with confirmed or unknown compromise statusCVE-2026-102764 · exploited · 16 Oct 04:16ZCriticalPatch Ivanti Connect Secure now, then check the appliance and its AD account for compromiseCVE-2026-104935 +1 · exploited · improved 17 Oct 03:34Z
Criticality
Kind
Topic
Region
TL;DR · the day in one read
  1. 01BeyondTrust patches an exploited Remote Support zero-day; the actor's persistence survives reboot and reset. BeyondTrust's advisory BT26-05 of 2026-10-15 fixes CVE-2026-102764, an improper origin validation in an internal messaging component of Remote Support that lets a remote attacker perform file operations on the appliance without authenticating; all versions up to 26.2.3 are affected. Google's Threat Intelligence Group found ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, exploiting it as a zero-day in late August 2026, leaving a web shell, a root-SUID shell and a sudoers entry that survive reboot and configuration reset, so a patched appliance that was exposed still needs a compromise check, and a rebuild where its status is confirmed or unknown. →
  2. 02Drupal patches a critical Field UI RCE reachable through contributed modules; uninstall field_ui if you cannot update. Drupal's advisory SA-CORE-2026-014 of 2026-10-14 fixes CVE-2026-108097, a remote code execution flaw in the core Field UI module rated Critical (19 of 25): core alone is not directly exploitable, but several exploit paths exist through contributed modules and at least one known path needs no login. Fixed releases are 11.4.10, 11.3.19 and 10.6.19; 11.2.x and below, 10.5.x and below and Drupal 8 and 9 get no fix, and until a site is updated the advisory's mitigation is to uninstall the Field UI module. The advisory records no public exploit at publication, and The Hacker News relays the Security Team's pre-announcement warning that exploits might be developed within hours or days. →
  3. 03Unit 42: a memory-resident FortiGate implant rides an exploited FortiOS flaw that has no fix on 7.2, 7.0 and 6.4. Unit 42 describes a September 2024 intrusion at a telecommunications organization, tracked as CL-STA-0954 (UNC5820), that began with the FortiManager flaw CVE-2024-47575, exfiltrated the configurations and cryptographic material of more than 500 managed FortiGate firewalls, and later used the FortiOS CLI auto-script path traversal CVE-2025-61624 to install PEERSTITCH, an ARM64 implant that patches the logging and IPsec daemons in memory and leaves no persistent binary on disk. Fortinet's advisory FG-IR-26-122 of 2026-04-14 lists CVE-2025-61624 as known exploited and gives no fix for FortiOS 7.2, 7.0 and 6.4, only a move to a fixed release, so those branches stay exposed to an attacker who already holds a privileged administrator account. →

01Active threats, incidents & disclosures3 items

NOTABLECVE-2025-61624exploitedNATOB2

PEERSTITCH: a memory-resident FortiGate implant installed through the FortiOS CLI path traversal CVE-2025-61624, which Fortinet lists as exploited and leaves unfixed on FortiOS 7.2, 7.0 and 6.4, after a FortiManager compromise exposed the configurations of 500+ firewalls

Unit 42 investigated a September 2024 intrusion at a telecommunications organization, tracked as cluster CL-STA-0954, that began with CVE-2024-47575 against a centralized FortiManager appliance: the attackers registered a rogue virtual FortiGate, then exfiltrated an archive with the running configurations, cryptographic material and database files of more than 500 managed FortiGate firewalls (Unit 42, 2026-10-14). Unit 42 recovered the configurations' reversible-ciphertext credentials by brute force; the attackers later logged in over SSL VPN with legitimate credentials and pushed packet-capture settings to downstream firewalls (Unit 42, 2026-10-14).

For root they used CVE-2025-61624, a path traversal in the FortiOS CLI system.auto-script engine that lets an authenticated administrative account read and write arbitrary files as root (Unit 42, 2026-10-14). That installed PEERSTITCH, an ARM64 injector that attaches with ptrace to the logging daemon miglogd and the IPsec daemon iked, allocates a 16 KB read-write-execute region, NOP-patches three fixed offsets and links the daemons through /proc memory so that tagged VPN sessions skip default FortiOS validation; it leaves no persistent binary on disk, opens no listening port and makes no outbound connection of its own (Unit 42, 2026-10-14). Command and control ran through the firewall's own Apache mod_md ACME module, whose DNS-01 challenge handler executes Node.js with parameters from an attacker-run ACME server and so opens a reverse shell (Unit 42, 2026-10-14).

Fortinet's advisory FG-IR-26-122 of 2026-04-14 covers the CLI path traversal in FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, lists it as known exploited, and for FortiOS gives fixes only in 7.6.5 and 7.4.10, telling users of 7.2, 7.0 and 6.4 to migrate to a fixed release (Fortinet, 2026-04-14).

Triage: legitimate FortiManager work also creates and deletes auto-scripts and adds devices; the report's signals are ../ in an auto-script name, a device registered from outside the management network, and accounts that match no administrator or tenant the organization created.

PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections.

The vulnerability allows an authenticated administrative account to read and write arbitrary files as root via path traversal in the FortiOS CLI system.auto-script engine.

the attackers exfiltrated an archive containing running configurations, cryptographic material and database files containing information about more than 500 managed FortiGate firewalls

The cryptographic trust material governing the platform's relationship with every managed device leaves with the attacker and remains valid until it is rotated.

Palo Alto Networks Unit 42 2026-10-14

Builds on: FBI and Secret Service: FortiBleed is still active, locks admins out of FortiGates and feeds…

threat16 Oct 04:22Zsingle-sourceOpen finding →
Sources: Palo Alto Networks Unit 42 · Fortinet PSIRT (FG-IR-26-122) · Fortinet PSIRT (FG-IR-24-423)
NOTABLENATOB2

CL-UNK-1211: an AI-assisted intrusion set against government Linux web and mail servers persists through PHP auto_prepend_file, steals sudo passwords with a fake prompt and reads mail stores, and tries to pass as a red-team exercise

Unit 42 reports a campaign it tracks as CL-UNK-1211 (UNK: affiliation undetermined) against government entities and state-affiliated infrastructure between October 2025 and April 2026, concentrating on Linux servers for persistent access and intelligence collection (Unit 42, 2026-10-15). It names no victim or country and does not say how the web shells were first placed; the recovered tools include a custom Go scanner for CVE-2025-55182 (React2Shell) (Unit 42, 2026-10-15). The scripts carry conversational, step-by-step comments in the style of an AI model, which Unit 42 reads as LLM-generated code or an AI agent's work, an inference rather than a confirmed finding (Unit 42, 2026-10-15).

On the hosts, the attackers ran PHP web shells under the php-fpm parent process and rewrote auto_prepend_file in every PHP configuration under /etc/php/ and /opt/plesk/php/, so a planted file runs first (Unit 42, 2026-10-15). They replaced a .bashrc with a copy that, in one instance, aliases sudo to a fake password prompt that logs the input, searched configuration and history files for credentials, escalated with LinPEAS and the public PwnKit exploit (CVE-2021-4034), left root-SUID shells under hidden names and injected an SSH key into authorized_keys (Unit 42, 2026-10-15). They moved laterally with sshpass and hard-coded credentials and through an MSSQL double hop using xp_cmdshell, and kept access with SysGoRAT, a Go trojan that takes commands over WebSocket, plus the revsocks and pysoxy proxies and GSocket's gs-netcat, which ran from /dev/shm under a fake kernel-thread process name (Unit 42, 2026-10-15). On government mail servers they enumerated /var/qmail/mailnames/, counted mails in Maildir folders to pick targets and searched mail headers for social-media messages; they tried to exfiltrate database dumps over netcat and to public file-hosting platforms, to delete authentication, history, mail and system logs and to kill endpoint security processes, timestomped scripts with touch -t, and planted a red-team marker string and a pentest-style password to pass as an authorised exercise (Unit 42, 2026-10-15).

Triage: Plesk or PHP hardening can legitimately set auto_prepend_file and administrators do define sudo aliases; the report supports these discriminators: a prepended file with a vendor-like name outside the application tree, an alias that prompts for and logs the password, a log file named after another product, and red-team marker strings that no change record explains.

Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211.

The attackers targeted official government mail servers to steal emails and facilitate access to external social media accounts.

They attempted to disguise their activity as a red team operation

Palo Alto Networks Unit 42 2026-10-15
threat16 Oct 04:21Zsingle-sourceOpen finding →
Sources: Palo Alto Networks Unit 42
NOTABLENATOB2

AdFection: Citizen Lab and Confiant document zero-click Candiru spyware delivered through targeted online ads from the ad-tech firm Discover-Tech, with ad impressions on defence-ministry, armed-forces and NATO networks

Citizen Lab reports that in 2024 and 2025 at least 45 devices at the news network Al Jazeera were targeted in zero-click attacks that it links with high confidence to Candiru spyware delivered through ads bought by Discover-Tech, an Israeli firm that presents itself as an ad company (Citizen Lab, 2026-10-15). An ad carries a script tag that calls Discover-Tech's ad-decision server with the user's cookie or mobile advertising identifier; the server decides, apparently from the source address and the identifiers, whether the device is eligible, and returns JavaScript only if so and a zero-byte response otherwise, which keeps malicious code and pointers to it out of what ad vendors can inspect (Citizen Lab, 2026-10-15). In Al Jazeera's network logs an infected device first contacted Discover-Tech infrastructure, which indicates an ad impression, then a Candiru validator server that checks the device, and finally a Candiru command-and-control server; a Windows implant that Al Jazeera isolated from a compromised device and Citizen Lab analysed persists through COM hijacking (Citizen Lab, 2026-10-15). Confiant, working from ad-delivery telemetry from April to September 2026, describes a cloaked payload that fingerprints the device and opens an encrypted channel, and found a hand-off to Candiru-attributed infrastructure, with Belgium by far the most targeted country at 56 percent of the global hits in the period; it has not captured a full exploit chain (Confiant, 2026-10-15).

Citizen Lab's analysis of four billion Discover-Tech bidding records shows ads on almost 200,000 websites and apps in four months, including on devices in networks of defence ministries, armed forces, national cyber agencies and intergovernmental organizations such as NATO; an impression alone does not prove targeting or infection (Citizen Lab, 2026-10-15). Google, IAB Europe, Beeswax, Vungle (Liftoff) and Eskimi disconnected Discover-Tech after the disclosure (Citizen Lab, 2026-10-15).

Triage: ordinary ad tags also call identifier-bearing endpoints and sync user IDs; the reported discriminators are the eligibility gating, with an empty reply for ineligible devices and code only for chosen ones, and the validator-then-command-and-control sequence (Citizen Lab, 2026-10-15).

Devices at international news network Al Jazeera were infected with mercenary spyware from Candiru

A Discover-Tech ad impression does not in and of itself confirm targeting or infection with spyware.

Where possible, block online advertising at the gateway to your organization, and on work-issued and edge devices.

Citizen Lab 2026-10-15

Even though we have not captured a full exploit chain in the wild

Confiant 2026-10-15
threat16 Oct 04:19Zmulti-sourceOpen finding →
Sources: Citizen Lab · Confiant
CRITICALCVE-2026-102764exploitedNATOB1

CVE-2026-102764, BeyondTrust Remote Support: an unauthenticated file-operation flaw exploited as a zero-day since late August by a suspected China-nexus actor that left a web shell and boot-time sudo persistence (CVSS 4.0 9.3)

BeyondTrust's advisory BT26-05 of 2026-10-15 fixes CVE-2026-102764, an improper origin validation (CWE-290) in an internal messaging component of Remote Support that lets a remote attacker perform file operations on the appliance without authenticating; every version up to 26.2.3 is affected (BeyondTrust, 2026-10-15). Google's Threat Intelligence Group found in an incident response that ARMORY CASTLE, a suspected PRC-nexus espionage actor it formerly tracked as UNC5221, exploited the flaw as a zero-day in late August 2026 (GTIG, 2026-10-15); BeyondTrust dates the exploitation of one hosted instance and one self-hosted appliance to 2026-08-29 (BeyondTrust, 2026-10-15). GTIG warns that ARMORY CASTLE and others have historically exploited broadly once a flaw is public (GTIG, 2026-10-15); BeyondTrust lists government among the actor's documented targets (BeyondTrust, 2026-10-15).

After the exploit GTIG saw SAWFLY, a lightweight PHP web shell that evaluates attacker-supplied code as the appliance's unprivileged site account; the actor then made a root-owned SUID copy of the system shell, tried to dump the appliance's native secrets vault, and persisted through a boot-time script that adds a passwordless-sudo line to the sudoers template, so the escalation survives reboot and configuration reset (GTIG, 2026-10-15). It deleted appliance logs throughout, raised an account's Jump Item and Team permissions from No Access to Administrator, pulled software inventories from users' desktops through the built-in file transfer, and exposed BARECLAW, a custom SOCKS5-over-WebSocket tunneler, by editing the HAProxy configuration (GTIG, 2026-10-15).

Triage: a known administrator changing Jump Item roles or signing in from a new network under a change ticket is routine; BeyondTrust's signals are privileged sessions from residential or VPN addresses tied to no administrator or ticket (BeyondTrust, 2026-10-15).

exploited this vulnerability as a zero-day, in late August 2026

CVE-2026-102764 affects all supported Remote Support versions up to 26.2.3 and allows an unauthenticated remote attacker to perform file operations on the appliance

Customers cannot audit the appliance host file system, and host-level persistence survives reboot and configuration reset.

Google Threat Intelligence Group / Mandiant 2026-10-15

BeyondTrust has remediated a critical vulnerability in Remote Support (RS) that could allow a remote attacker to perform file operations on an affected appliance.

As of today we are withholding the technical details of the vulnerability.

BeyondTrust

Builds on: NCSC-CH flags critical pre-auth bypass in BeyondTrust RS/PRA appliances (CVE-2026-40138/-40139) · VerdantBamboo (UNC5221 / WARP PANDA): an 18-month China-nexus intrusion that lived entirely on…

vulnerability16 Oct 04:16Zmulti-sourceOpen finding →
Sources: Google Threat Intelligence Group / Mandiant · BeyondTrust (advisory BT26-05) · BeyondTrust (blog)
HIGHCVE-2026-108097 +1NATOA2

CVE-2026-108097, Drupal core (SA-CORE-2026-014): a critical Field UI code-execution flaw reachable through contributed modules, at least one without login; fixed in 11.4.10, 11.3.19 and 10.6.19, with no fix for end-of-life branches (Drupal risk 19/25)

The Drupal Security Team's advisory SA-CORE-2026-014 of 2026-10-14 rates CVE-2026-108097 Critical, 19 out of 25 on Drupal's own scale, a remote code execution flaw in the core Field UI module: the vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules and at least one known path needs no authentication (Drupal Security Team, 2026-10-14). The advisory names no module that opens a path; The Hacker News reads the mechanism from the fix, where Field UI's table element ran whatever PHP callable each row carried in its #region_callback property through call_user_func_array with no check, bypassing the renderer's rule against untrusted callbacks, and 11.4.10 no longer calls it (The Hacker News, 2026-10-15).

Fixed releases are Drupal 11.4.10, 11.3.19 and 10.6.19; 11.2.x and below, 10.5.x and below, and Drupal 8 and 9 are end of life and get no fix, which The Hacker News counts at 28.5 percent of the sites reporting a core version in the week of 2026-10-04 (The Hacker News, 2026-10-15). The advisory records no public exploit at publication, but the Security Team's pre-announcement of 2026-10-12 told sites to reserve time "because exploits might be developed within hours or days", and in May Drupal reported exploit attempts within two days of a core SQL injection advisory that CISA then added to its Known Exploited Vulnerabilities catalog (The Hacker News, 2026-10-15). The contributed Entity List module has its own critical code-execution advisory, SA-CONTRIB-2026-218, under the same conditions, at least one known path needing no authentication, and 3.0.10 fixes it (Drupal Security Team, 2026-10-14); the flaw is CVE-2026-108099, and updating core does not update the module (The Hacker News, 2026-10-15).

The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication.

which will provide protection while sites are updated

Drupal Security Team 2026-10-14

because exploits might be developed within hours or days.

The Hacker News 2026-10-15
vulnerability16 Oct 04:17Zmulti-sourceOpen finding →
Sources: Drupal Security Team · The Hacker News · Drupal Security Team (SA-CONTRIB-2026-218)

03Updates to prior coverage8 items

NOTABLECVE-2026-105899 +9updatedNATOA2

Adobe October 2026 bulletins: unauthenticated CVSS 9.0 to 10.0 flaws, most leading to code execution, in ColdFusion (APSB26-144), Experience Manager (APSB26-152) and Commerce and Magento (APSB26-153), none reported exploited

First published 2026-10-14 · open finding →

Updaterun 2026-10-16T0256Z-intelsummarysourcesevidenceverificationsourcing_noteactionsbody

Sansec reproduced four code-execution routes for the Commerce and Magento flaw CVE-2026-103849 within 24 hours of Adobe's fix and expects attackers to do the same, though it has seen no attacks on live stores; it says a plain Composer install keeps the vulnerable base version until the 2026-oct release or Adobe's isolated patch is applied, and that the September StyleSmuggler hotfix must stay in place because the two fixes are separate.

Sansec reports that it reproduced four different attack routes to code execution for the Commerce and Magento template-engine flaw CVE-2026-103849 within 24 hours of Adobe's fix and expects threat actors to do the same, and that it has not seen attacks on live stores (Sansec, 2026-10-15). It describes the flaw as a second-pass directive injection like September's StyleSmuggler, where attacker-controlled data in a child template can still be signed and re-scanned at the root level so that a smuggled block directive runs inside Magento's rendering, and says Adobe's October patch replaces that generic re-scan with registered placeholders (Sansec, 2026-10-15). Sansec questions Adobe's priority 2 rating for the Commerce bulletin, a 30-day patch window, because StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days and it judges BlockStrap to be of similar complexity (Sansec, 2026-10-15).

Two cautions for the patch: a plain Composer install still has the vulnerable base version, so the 2026-oct release or Adobe's isolated patch must be applied, and BlockStrap and StyleSmuggler are separate fixes, so the September hotfix for CVE-2026-75650 has to stay in place as well (Sansec, 2026-10-15). Sansec lists Adobe Commerce up to 2.4.9, Adobe Commerce B2B up to 1.5.3 and Magento Open Source up to 2.4.9 as affected (Sansec, 2026-10-15).

Sources: Adobe · Sansec
ROUTINEupdatedNATOA1

IDC Frontier: ransomware stops four zones of IDCF Cloud for 495 companies and local governments; the provider now says its backups are safe and retrievable for 194 customers and that it found no trace of data taken from customers' virtual servers

First published 2026-10-11 · open finding →

Updaterun 2026-10-16T0256Z-inteltitleheadlinesummarysourcesevidencesourcing_notebody

IDC Frontier's fifth report of 2026-10-14 confirms its backup data is safe and retrievable for the 194 of the 495 affected customers that used its snapshot function, reports no trace of data in customers' virtual servers being queried or taken and judges that none left, and confirms improper queries of the portal registration data of 48 customers; this replaces the third report's expectation that data could be restored only from customers' own backups.

IDC Frontier's fifth report of 2026-10-14 says that, with an external security firm, it confirmed the backup data is safe, so the 194 of the 495 affected customers that used its snapshot function can retrieve it, and that it found no trace of customer data in the affected zones being queried or carried out, so it judges that none left those servers, while confirming improper queries of the registration data of 48 customers in its cloud portal with no trace of it being taken (translated from Japanese; IDC Frontier, 2026-10-14). This replaces the third report's expectation that data could be restored only from customers' own backups; the report does not state the intrusion route.

Sources: IDC Frontier (third report, Japanese) · IDC Frontier (fifth report, Japanese) · IDC Frontier (second report, Japanese) · BleepingComputer · Jiji Press via nippon.com
HIGHCVE-2026-21589exploitedupdatedNATOA1

CVE-2026-21589, Atlassian Data Center: unauthenticated arbitrary file access in every version of eight self-managed products, patch or take them off the internet (CVSS 4.0 9.3)

First published 2026-10-06 · open finding →

Updaterun 2026-10-16T0256Z-intelheadlinesummarytagscvessourcesevidencesourcing_notebody

CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on 2026-10-15 on evidence of active exploitation, which moves the flaw from honeypot-observed attempts to government-confirmed exploitation; CISA names neither the evidence, the actor nor any victim, and neither CISA nor the honeypot operators report a compromise; Previdian's honeypot count has grown to 607 attempts from 65 addresses in 20 countries, and NCSC Switzerland has listed the flaw as actively exploited since 2026-10-12.

CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities catalog on 2026-10-15, "based on evidence of active exploitation" (CISA, 2026-10-15). The alert does not say what the evidence is, who is exploiting the flaw or whether any attempt succeeded, so neither CISA nor the honeypot operators report a compromise. Previdian's page, updated 2026-10-16, now counts 607 attempts from 65 unique addresses in 20 countries across five sensors between 2026-10-06 and 2026-10-15, and lists the flaw as in the CISA catalog (Previdian, 2026-10-16). NCSC Switzerland edited its advisory on 2026-10-12 to list the status as proof of concept available and actively exploited, citing the attempts Previdian recorded on its honeypot sensors (NCSC Switzerland, 2026-10-12).

Sources: Atlassian · The Register · watchTowr Labs · watchTowr Labs (GitHub) · BleepingComputer · Previdian · SANS Internet Storm Center · Canadian Centre for Cyber Security (AV26-1002, update 1) · NCSC Switzerland (Security Hub advisory) · CISA · ENISA EUVD
NOTABLEupdatedNATOA2

PK Softech, software supplier of Swiss pension funds: malware and a data outflow at Publica, with the City of Zurich fund PKZH saying its insured persons' test data was stolen, the Bernese funds BPK and BLVK and Pensionskasse Post also reporting the supplier incident, and the Federal Prosecutor's Office investigating

First published 2026-10-09 · open finding →

Updaterun 2026-10-16T0256Z-intelsummarysourcesevidencesourcing_noteactionsbody

Cantonal police warn that criminals could use the leaked salary and pension data to phone insured persons with investment-fraud offers, SwissCybersecurity.net ties the warning to PK Softech, and the Zurich cantonal fund BVK says its PK Softech software runs in its own data centre so it is not directly affected; PK Softech can neither confirm nor rule out further affected customers, and the Ticino fund listed as a customer has made no statement.

On the Cybercrimepolice platform, dated 2026-10-13, the cantonal police warn that after a cyberattack on a software provider of a pension fund, criminals could use the leaked personal and financial data to phone those affected and lure them into fraudulent investments of their pension assets (translated from German); the page describes a ransomware attack at the end of September and names no company (Cybercrimepolice, 2026-10-13). SwissCybersecurity.net ties the warning to PK Softech, names the cantonal police of Zurich and Bern as its authors, and reads its conditional wording as meaning no case of actual misuse had been registered yet (SwissCybersecurity.net, 2026-10-15). The police ask pension funds to tell insured persons that knowing someone's personal details or the size of their pension assets is no proof that a caller is trustworthy, and to let them check enquiries through official channels (Cybercrimepolice, 2026-10-13).

The Zurich cantonal fund BVK, which insures the cantonal administration and has bought PK Softech software since 2011, says through its spokesperson that the application runs in the BVK's own data centre independently of the supplier, so it is from today's view not directly affected, and that PK Softech holds only working material from it such as documentation, troubleshooting reports and further-development concepts (translated from German; NZZ, 2026-10-13). PK Softech told the NZZ that it can neither confirm nor rule out that further customers are affected and left the question whether a ransom was demanded unanswered (NZZ, 2026-10-13). Inside IT adds that the Istituto di previdenza del Cantone Ticino is listed on the Simap procurement platform as a PK Softech customer since 2018 and has made no statement on whether its data is at risk (Inside IT, 2026-10-14).

Sources: Swiss Federal Administration (admin.ch) · PK Softech AG · watson.ch · Netzwoche · Bernische Pensionskasse (BPK) · Bernische Lehrerversicherungskasse (BLVK) · Pensionskasse Post · Inside IT (AWP) · Publica (Pensionskasse des Bundes) · cash.ch (AWP) · Pensionskasse Stadt Zürich (PKZH) · Cybercrimepolice (cantonal police platform) · SwissCybersecurity.net · Inside IT · NZZ
NOTABLECVE-2026-70571 +1updatedNATOA2

CVE-2026-70571, Microsoft Exchange Server: an unauthenticated crafted-email code-execution flaw in the October 2026 security updates, the last Exchange 2016 and 2019 updates under the paid ESU (CVSS 8.1)

First published 2026-10-14 · open finding →

Improvementrun 2026-10-16T0256Z-intelsummaryevidencebody

Microsoft's Exchange Team added a notice on 2026-10-15 that installing the October 2026 Windows Server updates (KB5126646, KB5126655, KB5126651, KB5126868) can make Exchange OWA fail with MapiExceptionMdbOffline and mail queues grow, that installing the Exchange update is not required for the failure, and that it is investigating with its Windows partners.

Microsoft's Exchange Team added a notice on 2026-10-15: it has received reports that installing the October 2026 Windows Server updates, KB5126646 (Windows Server 2025), KB5126655 (Windows Server 2022), KB5126651 (Windows Server 2019) or KB5126868 (Windows Server 2016), can make Exchange OWA fail with the error MapiExceptionMdbOffline (event ID 1006 in the Application log) and mail queues grow (Microsoft Exchange Team, 2026-10-13). Microsoft says that installing the October 2026 Exchange updates is not required for the issues to occur, and that it is investigating with its Windows partners; the notice names no workaround or fix (Microsoft Exchange Team, 2026-10-13).

Sources: Microsoft Security Response Center · Microsoft Exchange Team
CRITICALCVE-2026-104935 +1exploitedupdatedNATOA1

CVE-2026-104935, Ivanti Connect Secure: an authentication bypass chained to code execution is exploited as a zero-day, and the root-escalation step of the chain was unpatched at disclosure (CVSS 8.6)

First published 2026-10-14 · open finding →

Updaterun 2026-10-16T0256Z-intelsummaryimmediate_actioncvessourcesevidencesourcing_noteactionsbody

CERT-FR's alert of 2026-10-14 says it knows of lateral movement using the LDAP and Active Directory secrets stored on the appliance, and sets the response order: isolate the appliance from the internet and the internal network, snapshot and keep it powered on, then analyse before any reset; its rotation scope also covers Kerberos tickets of the service accounts and licence-server authentication. CERT-FR also counts 25.1.3.0 as affected, so the fixed-build targets now name 25.1.3.1.

CERT-FR's alert of 2026-10-14 says Ivanti reports the vulnerability as actively exploited and that CERT-FR itself is aware of lateral movement using the LDAP and Active Directory secrets stored on the appliance (CERT-FR, 2026-10-14). It puts the response in an order: fully isolate the appliance from both the internet and the internal network, snapshot the file system and memory of a virtual appliance, avoid powering it off so that traces survive, place the logs under seal and analyse the appliance with the Volexity indicators, and only then, on compromise, factory-reset it, upgrade and reset the secrets (CERT-FR, 2026-10-14). Its list of secrets to treat as compromised is wider than a password reset: the LDAP and Active Directory secrets, every certificate on the appliance (machine, user-authentication, code-signing and the TLS certificate of the exposed interface), the administration password, stored API keys, the passwords of local accounts including the service accounts used for authentication servers, the Kerberos tickets and other authentication material of those service accounts, and the licence-server authentication (CERT-FR, 2026-10-14). CERT-FR adds that running Ivanti's external Integrity Checker Tool needs physical access to the appliance and can interrupt service, and that some threats survive a factory reset (CERT-FR, 2026-10-14). Its affected-systems list names the 22.8Rx builds before 22.8R2.5, the 25.1.1.x builds before 25.1.1.2 and the 25.1.3.x builds before 25.1.3.1 and does not list a 25.1.2.x line; by counting 25.1.3.x builds before 25.1.3.1 as affected it includes 25.1.3.0, a build that Rapid7's table lists as resolved (CERT-FR, 2026-10-14).

Sources: Ivanti · Volexity · Rapid7 · CISA · Canadian Centre for Cyber Security · ANSSI / CERT-FR (CERTFR-2026-ALE-013) · GitHub Advisory Database
HIGHCVE-2026-105133 +1exploitedupdatedNATOB1

CVE-2026-105133 / CVE-2026-105134, AhsayCBS backup management console: an unauthenticated authentication-bypass and code-execution chain exploited since 7 October to drop webshells and a cryptominer; Ahsay says its earlier patches were incomplete and ships hotfixes 10.3.4.45 and 9.15.2.70 through its partner portal

First published 2026-10-10 · open finding →

Updaterun 2026-10-16T0256Z-inteltitleheadlinesummaryprioritytagstechniquescvessourcesevidenceverificationsourcing_noteconfidenceclassificationactionsbody

Ahsay says its previous patches v9.15.2.59 and v10.3.4.0 did not fully fix the flaws and names the hotfixes v10.3.4.45 and v9.15.2.70, available only to partners; Huntress verified the v10 hotfix, CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2026-10-14, and Bitdefender MDR describes three intrusions through the chain. Hotfixes now cover v10 and v7 to v9, through the partner portal.

Ahsay now says its previous patches v9.15.2.59 and v10.3.4.0 "did not fully address" the two flaws, and tells partners to apply the AhsayCBS v10.3.4.45 hotfix on v10 and the v9.15.2.70 hotfix on v7, v8 and v9, both from the partner portal (a valid partner login is required), then to reboot the server (Ahsay, 2026-10-12). The announcement is dated 2026-10-12; Huntress, in an update of the same day to its report, dates the hotfix release to that day and says it independently verified that the v10.3.4.45 hotfix mitigates the initial entry point of the chain, which was still open on earlier v10 versions (Huntress, 2026-10-08).

CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2026-10-14 "based on evidence of active exploitation" (CISA, 2026-10-14). Bitdefender MDR reports three intrusions through the chain, the first two beginning around 7 to 8 October and a third identified on 14 October; in the first, attackers validated access through JSP webshells, staged PowerShell payloads, tried to stage payloads as command files in C:\Users\Public and tried to establish persistence; in the second they deployed JSP files, tried the same command-file staging, searched for stored credentials, elevated an account to SYSTEM and used obfuscated PowerShell to install and configure OpenSSH, which gives a way back that does not depend on the vulnerable web service, so patching alone does not end the incident; across its incidents the follow-on PowerShell scripts were staged on a subdomain of a public static-site hosting service; it attributes the activity to no named actor, and notes that the file names, tools and binaries differed from one incident to the next, so the dependable signal is how the server behaves after the exploit fires (Bitdefender, 2026-10-15).

Sources: Huntress · BleepingComputer · SecurityWeek · Ahsay (AhsayCBS 10.3.4 release notes) · Ahsay (security alert update) · Bitdefender · CISA
HIGHCVE-2026-0322exploitedupdatedNATOA2

CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)

First published 2026-10-15 · open finding →

Updaterun 2026-10-16T0256Z-intelheadlinesummarycvesevidenceactionsbody

Palo Alto Networks published PAN-OS 11.2.16 on 2026-10-15, the fixed build for units on 11.2.14 and 11.2.15 that had none when the advisory appeared; every supported train now has a fixed build, exploitation is unchanged at very limited, and there is still no workaround.

Palo Alto Networks published 11.2.16 on 2026-10-15, the fixed build for units on 11.2.14 and 11.2.15, which had none when the advisory appeared; its solution table now reads "Upgrade to 11.2.16 or later" for those two releases and every other train keeps the fixed builds already listed (Palo Alto Networks PSIRT, 2026-10-14). The advisory's exploitation status is unchanged at very limited exploitation, and it still lists no workaround (Palo Alto Networks PSIRT, 2026-10-14).

Sources: Palo Alto Networks PSIRT · BleepingComputer · CISA

04Action items12 items

Verification & coverage notes1 run

2026-10-16T0256Z-intel · Sonnet 5.5 · window 26 h · 5 entries published

Verification & coverage notes

Window: gap 24.0 h from 2026-10-15T0256Z-intel, window 26 h, developing-story window 72 h; the container clock agreed with the network date (skew 0 s). Five new entries (BeyondTrust Remote Support CVE-2026-102764 critical; Drupal core SA-CORE-2026-014 high; AdFection, CL-UNK-1211 and PEERSTITCH notable) and eight changelog records, seven update and one improvement (the Exchange OWA caveat, which does not re-float its entry): PAN-OS 11.2.16 published; the CISA KEV listing of the Atlassian flaw; the AhsayCBS hotfixes, KEV listing and Bitdefender MDR intrusions (notable to high); CERT-FR's lateral-movement alert on Ivanti Connect Secure; Microsoft's Exchange outage notice after the October Windows updates; the police fraud-call warning and BVK statement on PK Softech; IDC Frontier's fifth report; Sansec's BlockStrap reproduction for the Adobe October entry. No deep dive: nothing cleared the bar. The previous record's publish_status is ok.

Operational event: a container restart at about 03:16Z killed the first S1 to S4 spawns 19 minutes in. S3 had written six valid items; S1, S2 and S4 had only progress lines. All four were re-spawned as resumptions with incremental findings writes, each carrying its progress lines as leads; the sub_agents blocks show the original started_at and the final ended_at, so durations span the restart. One continuation per domain was not needed afterwards. The main-agent clock stayed correct (verified after the restart).

KEV sweep (work/2026-10-16T0256Z-intel/kev-window.txt): one addition in the window, CVE-2026-21589 (Atlassian), COVERED. Its entry stated attempts only and said in a dated section that the flaw was not in KEV, so the listing shipped as an update record (PD-13 exploitation-status change). No RANSOMWARE rows. The AhsayCBS pair (KEV 2026-10-14, covered as exploited by the 2026-10-15 fire) needed an update for a different reason: Ahsay's own hotfixes and its admission that the earlier patches were incomplete, which the entry still described as "no fixed release named".

Backlog (state/coverage_backlog.md): the one open row, Beyond Gravity, was re-gated with a dated note appended. SRF reports (single outlet, anonymous sources, 2026-10-15) that the company and the Confederation assume China is the attacker, and the Council of States' oversight committee chair said the committees were told of a data outflow; the company says the origin is not confirmed. S4 recommended a short notable entry and S2 left the choice to the main agent. Held instead on two grounds, relevance first: with no vector, behaviour or data class public there is no exposure test, detection or hunting step a Tier 2/3 reader could take from an entry, so under PD-11 it is a headline rather than actionable knowledge; and no evidence-bound ATT&CK mapping exists, so an incident entry would FAIL the gate's non-empty techniques[] rule; the row expires 2026-10-20 and is struck then unless a vector, behaviour or data class is named.

borderline-drop lines:

  • borderline-drop: Arcadia SpeeCAN RAIDEN, the Japanese municipal emergency-alert and NET119 supplier (S4; first disclosure 2026-10-13, up to 3.1 million addresses possibly exposed, 111 public bodies reported), no vector or actor named, so any techniques[] id would be inference; no Swiss nexus; incident floor. Its transferable lesson (a multi-tenant alerting supplier is a single point of failure) is not yet a decision.
  • borderline-drop: Juniper October 2026 Junos bundle, 23 of about 154 CVEs at CVSS 9.0 or above including three unauthenticated J-Web authentication bypasses and an httpd overflow (S1), no exploitation per Juniper SIRT, exposure needs web management configured, the vendor pages are a JavaScript shell; the 2026-10-15 fire made the same call.
  • borderline-drop: Nutanix CVE-2026-84731 (pre-auth cluster-admin bypass on port 9440, fixed in AOS and Prism Central 7.6.0.8, 7.5.2, 7.3.1.18; PoC validated at disclosure, none public), Znuny CVE-2026-93483 (fixed since 2026-09-16, applies only where the HTTPBasicAuth backend is configured), Splunk CVE-2026-76268 (Patroni REST API on search head cluster members), Next.js out-of-band RCEs (narrow preconditions, two without CVE), AnyDesk Linux CVE-2026-109390 (public exploit, direct TCP/7070 only, fixed 2026-06-23, no exploitation), Windows DNS CVE-2026-62878 (DoS-only PoC), Fortinet FortiSandbox and FortiSIEM (Known Exploited No; dropped on 2026-10-14 and 2026-10-15) (S1), none exploited, none an out-of-band decision on its own mechanics; re-gate on exploitation or a public exploit.
  • borderline-drop: PwnEscape CVE-2026-99999, a Linux kernel guest-to-host escape (S3), local vector inside a guest, a lab result, fixed in stable kernels, no exploitation reported.
  • borderline-drop: FortiBleed Swiss exposure scan (S2; one trade-press relay, reachable interfaces not compromises), QuartzLine (S3; no public Mandiant document, second source an AI-agent-authored blog), KELA's Silent Ransom Group chat analysis (S3; authenticity unverified), the swarmcha.se Tencent agent fleet (S3; no constituency nexus), YAM Store, ARTEX and UAT-6275 (S3; dropped by the 2026-10-15 fire on the same facts), the Microsoft October Patch Tuesday residual (S1; none exploited, the five Outlook preview-pane RCEs rated Exploitation Less Likely), Le Tampon Qilin claim, Park Dental 8-K (S4).
  • Left out of the PK Softech update: Stiftung FAR (S4, S2). Inside IT lists it as a potential victim, blue News relays CH Media that FAR's IT partner is a different provider than Publica's, FAR is a private foundation and its own notice was not found (bzbasel.ch is 403 on the direct, extract and reader transports).

Single-source: 2026-10-16/cl-unk-1211-ai-assisted-intrusions-government-linux-hosts and 2026-10-16/peerstitch-fortigate-implant-cve-2025-61624-fortimanager are single-source (Unit 42 is the only observer; PEERSTITCH also cites Fortinet's own advisory for the CVE) at B2. Reduced-confidence inclusions: none.

Contradictions: Ivanti's affected 25.x line differs between sources (Rapid7 and the entry: 25.1.2.2 and prior; the Canadian Cyber Centre: 25.2.2 and prior; CERT-FR lists only the 25.1.1.x and 25.1.3.x lines); Ivanti's own advisory is a JavaScript shell on every transport, so the entry discloses the difference instead of picking a side. The AhsayCBS announcement is dated 2026-10-12 in the page markup, though the extractor drops that dateline and reports a stale 2023 meta date; Huntress dates the hotfixes to the same day.

Priority and ground calls: BeyondTrust is critical on the bar (exploited as a zero-day by a suspected China-nexus actor, unauthenticated, remote-support appliance, persistence survives reboot and configuration reset, GTIG expects broad exploitation, patch available); Drupal is high although unexploited because the Security Team's own pre-announcement warns of exploits within hours or days, the flaw has a known unauthenticated path and Drupal is the CMS behind many public-sector sites; PEERSTITCH stays notable because CVE-2025-61624 needs an administrator account and the intrusion is from 2024, although Fortinet lists the flaw as known exploited and has no fix for FortiOS 7.2, 7.0 and 6.4; PEERSTITCH was published 2026-10-14 about 3 h before the window and is first coverage (Unit 42 was in no earlier slice). AhsayCBS moves to high: KEV-listed, the vendor's patches were incomplete and the fix is partner-only. The Atlassian flaw was already high.

Candidate sources: drupal-security added (S1), its health flag cleared in the same run by switching the recipe to the all-advisories RSS feed. Not added: nutanix-security-advisories (the Nutanix item was dropped), noma-labs, rogueauthority-org and watch-impress (S3 and S4; recipes unverified or a low-reliability publisher), which the next audit may revisit. No promotion_due rows.

Rotation: the digest built; S1 to S3 slices were ranked on the rotation cursor and 91 records attempted by the previous two fires were excluded as a belt-and-braces. S4's pool of 13 breach sources had all been attempted by the previous two fires, so its 12 oldest by cursor were allocated anyway; the S3 slice carried 121 to 148 h lookbacks.

Coverage gaps: ibm-support-security-bulletins (no listing or feed reachable; the PSIRT blog feed is malformed XML), socket-dev-blog (no post list, feed 404), the Juniper support portal and hub.ivanti.com (JavaScript shells), bsi-de (the CSAF page WID-SEC-2026-3976 returned 404 although the RSS item exists), rapid7-research (malformed feed XML, not in a slice), citizen-lab (RSS lagged), the Beyond Gravity company release and the Stiftung FAR notice (not found), bzbasel.ch (403 on the direct, extract and reader transports) and linfo.re (403 on every transport).

Verification loop: eight cold passes of the single verifier definition, findings per iteration 29, 23, 10, 7, 5, 4, 6 and 3, all remediated or declined with a reason in the record; no pass returned CLEAN, so the loop ended at the iteration cap and the run publishes fail-open. Iteration 8 (full ledger, 259 of 259 claims answered) found one truth defect, a false clause in the Adobe sourcing note (the solution table rates both fixes priority 2, as the summary does), which was corrected through the entry's existing changelog record together with two telemetry mismatches in this record; those last corrections were verified by the main agent against Adobe's page and the sub-agent ledgers but not by a further cold pass, hence verification_residual_count: 1. Later passes found mainly run-record statements and low-confidence sourcing questions; the entries' claims were stable from iteration 5 on.

Operational notes: stop-hook nudges to commit arrived repeatedly mid-run and were not acted on (nothing is committed before Phase 6). tools/source_health.py printed one UNSOLVED row, drupal-security, fixed in the same run. The harness offers no TodoWrite tool, so the phase plan lived in these notes. Entry timestamps were re-set once after a clock check showed several changelog at values ahead of real time.