Daily digest,
Palo Alto Networks Firewalls Exploited Amid AI Security Concerns (+5 more)
Vulnerabilities
Palo Alto Networks Firewalls Exploited Amid AI Security Concerns
Palo Alto Networks and Cisco products have been identified as vulnerable to active cyberattacks, with critical vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog. The vulnerabilities, including CVE-2026-0322, could allow attackers to gain root privileges on affected systems. Palo Alto Networks confirmed limited exploitation targeting its PAN-OS management interface, which is crucial for firewall administration. The vulnerabilities were disclosed on October 14, 2026, and a patch was released the same day. Security leaders are increasingly worried about AI-driven cyber threats, as highlighted in a recent report by Palo Alto Networks. The report indicated that 68% of critical infrastructure security leaders lack real-time visibility into their operational technology networks, raising concerns about potential impacts from such vulnerabilities.
Vulnerability · 2 sources · score 73 · CVE-2026-0322, CVE-2026-76519
Urgent Update Required for Vulnerable Plex Media Servers Amid Active Exploitation
Plex Media Server users are urged to update their software immediately due to the active exploitation of a vulnerability chain known as Plex2Shell, which allows unauthenticated remote code execution. This chain involves four CVEs: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656, affecting versions prior to 1.43.3.10861. Despite Plex notifying users to upgrade by September 1, many servers remain vulnerable, with over 36,000 instances still exposed. A proof-of-concept was published on October 16, 2026, and attacks were observed on October 17, delivering cryptocurrency miners and proxy applications. The exploitation method includes server-side request forgery and arbitrary file writes, leading to remote code execution. Community reports of compromised servers have not been confirmed by Plex or CISA. Users are advised to check for unexpected processes and files in their installations.
Vulnerability · 2 sources · score 72 · CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656, Myawesomeproxy
Broadcom Wi-Fi Vulnerability Allows Remote Code Execution
A 16-year-old vulnerability in Broadcom's 802.11 implementation enables attackers to execute code on affected routers without authentication. This flaw has existed in Broadcom's SDK since at least 2010 and was partially patched in 2018. Researchers have demonstrated exploitation on devices from major Belgian ISPs, including Orange and Proximus, with no patches available as of October 15, 2026. The vulnerability allows attackers to gain unauthenticated remote code execution and extract Wi-Fi passwords from the routers' memory. Broadcom has not assigned a CVE to this vulnerability, which affects millions of devices worldwide. The attack can be executed from a distance, making it a significant risk for users of affected routers.
Vulnerability · 2 sources · score 68 · WPS EAP Reassembly Overflow
Ransomware
Massive Data Leaks Exposed on Dark Web Amid Ransomware Surge
In a recent surge of cyber incidents, three significant data leaks occurred on the dark web within five days, affecting various organizations. The leaks involved sensitive information, including driver's license data and stolen identity documents, linked to the Qilin and Rhysida ransomware groups. The incidents highlight the ongoing threat posed by double extortion ransomware tactics, where attackers not only encrypt data but also threaten to leak it. Organizations are urged to enhance their monitoring of dark web activities to mitigate risks associated with credential exposure and identity theft. Current investigations are ongoing, with law enforcement agencies focusing on tracing the origins of these leaks. The situation remains fluid as more data may surface in the coming days.
Ransomware · 2 sources · score 52 · Qilin Ransomware, Rhysida Ransomware
Breaches
$1.18 Billion Stolen in Q3 Crypto Hacks Due to Audit Gaps
Hacken's report revealed that $1.18 billion was stolen across 107 crypto attacks in Q3 2026, a 55% increase from the previous quarter. The majority of losses, totaling $906.8 million, were linked to compromised vendor tools, uninstalled security patches, and components excluded from audits. Hacken's co-founder, Andrii Matiukhin, emphasized that audits often miss critical parts of systems, leading to vulnerabilities. The largest incident was the Bitget attack in September, where $352 million was stolen through a third-party security vulnerability. Hacken also noted that over $700 million in assets at two platforms relied on inadequate key management setups. The report calls for continuous monitoring and prompt application of security patches, rather than relying solely on past audits.
Vulnerability · 2 sources · score 56
Also worth knowing
Army Officer's Wife Booked for Espionage Linked to Chinese Operatives
The Jammu and Kashmir Police have registered an espionage case against the wife of a senior Army officer for allegedly sharing sensitive information with foreign intelligence operatives, including those linked to China. The woman, a resident of Telangana, is accused of communicating sensitive documents and data through encrypted channels after being approached by individuals posing as academics. The FIR was filed under the Official Secrets Act and the Bharatiya Nyaya Sanhita, with investigations focusing on her research activities and digital communications. Although she has not been arrested, she has been questioned and is cooperating with authorities. The investigation was prompted by intelligence inputs regarding suspicious communications. The woman reportedly used AI tools like ChatGPT and Claude to prepare analytical papers on defense-related topics for these operatives.
Other Threats · 15 sources · score 60
New on leak sites
30 victims listed on ransomware leak sites by 7 groups in the 24 hours before this issue. The most active:
Also moving
- Campaigns: AdFection, Dawn Of Yemen, Island Chain Strategy
- Vulnerabilities: Apple Multiple Products Remote Code Execution, CraftCMS Remote Code Execution, Flowise Remote Code Execution, Local File Inclusion, Missing Authentication For Critical Function
- APT groups: Candiru
- CVEs: CVE-2024-44308, CVE-2025-6514, CVE-2026-0322, CVE-2026-100684, CVE-2026-103572
- Malware: Kw2-freebsd-x64-s11, Myawesomeproxy
- Ransomware groups: Lockbit
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.