Daily News
BeyondTrust Remote Support Zero-Day Exploited
A BeyondTrust Remote Support zero-day has been exploited since August 29, and CISA added it to the Known Exploited Vulnerabilities catalog on October 16. Google’s Mandiant ties the attacks to Armory Castle, a China-linked espionage group, and says any internet-reachable appliance on a vulnerable version should be treated as potentially compromised until it has been…
Read MoreCisco Secure Email Gateway Zero-Day Exploited Again
A Cisco Secure Email Gateway zero-day is under attack: one email with a crafted attachment lets an unauthenticated attacker write files and run commands as root. Cisco tracks it as CVE-2026-76519 (CVSS 9.8), and CISA added it to the Known Exploited Vulnerabilities catalog on October 14. It is the second Secure Email Gateway flaw exploited…
Read MoreIvanti Connect Secure Zero-Day Chain Reaches Root
Volexity found an Ivanti Connect Secure zero-day chain that gave one attacker unauthenticated root on a VPN appliance running the latest build at the time. Ivanti has fixed two of the three flaws. As of October 14, the third, the privilege escalation that turns a web-server foothold into root, has no fix. Ivanti’s own Integrity…
Read MoreAhsayCBS Backup Server Vulnerability Exploited
An AhsayCBS backup server vulnerability is being exploited, and the version everyone was told to install did not fix it. Huntress saw attackers chain two flaws from October 7 to run code as SYSTEM on exposed Ahsay Cloud Backup Servers. On October 8 it found that 10.3.4, the release the public CVE entries call fixed,…
Read MoreIDC Frontier Ransomware: One Cloud, 495 Customers
One ransomware attack on one cloud region has hit 495 companies and local governments in Japan at once. IDC Frontier, a SoftBank subsidiary, said its IDCF Cloud service was struck by ransomware on October 7 at 3:40 a.m. local time, forcing it to shut down the network and systems of its East Japan Region 1.…
Read More