🚨 ACTIVE EXPLOITATION
UPDATE: Palo Alto Networks patches actively exploited PAN-OS RCE zero-day CVE-2026-0322
CVE-2026-0322
Palo Alto Networks has patched a PAN-OS management interface RCE zero-day, CVE-2026-0322, that has seen limited exploitation in attacks.- Affects PA-Series and VM-Series firewalls plus Panorama virtual and M-Series appliances running PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2; Cloud NGFW and Prisma Access are not affected.
- Authenticated attackers with network access to the PAN-OS management interface can execute arbitrary code with root privileges (CVSS 8.6).
- Exploitation requires existing credentials and management interface access; Palo Alto observed very limited exploitation targeting the management interface.
- Fixes released for all affected branches, with PAN-OS 11.2.16 expected October 15; no workarounds exist, though Threat Prevention signatures offer limited coverage.
- CISA added CVE-2026-0322 to the KEV catalog with a federal mitigation deadline of October 17; observed attacker IPs: 66.42.72[.]14, 208.83.239[.]114, 149.248.47[.]234.
Sources 📄 Source: security.paloaltonetworks.com · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer, CISA KEVUPDATE: Cisco Secure Email Gateway zero-day path traversal flaw added to CISA KEV
CVE-2026-76519
A zero-day relative path traversal vulnerability (CVE-2026-76519) in Cisco Secure Email Gateway has been added to CISA's KEV catalog.- Affects Cisco Secure Email Gateway appliances running Cisco AsyncOS software.
- The relative path traversal flaw (CVE-2026-76519) lets an unauthenticated, remote attacker write arbitrary files on the underlying operating system.
- Attackers can exploit the flaw remotely without authentication, potentially achieving root-level command execution.
- CISA added the vulnerability to its KEV catalog with a remediation due date of 2026-10-17 under BOD 26-04.
- Cisco disclosed the flaw alongside related September 2026 advisories affecting Secure Email Gateway and Secure Email and Web Manager.
🕵️ RESEARCH & DEEP DIVES
Claude Code Desktop 'SneakPeek' zero-click flaw exposed developer credentials
A zero-click flaw in Claude Code Desktop's preview pane let attackers silently steal developer credentials.- Affects developers using Anthropic Claude Code Desktop's automated preview pane, which renders HTML files in real time.
- Three chained flaws — missing content security policy, unrestricted origin access, and inactive request filtering — bypassed built-in sandbox protections.
- Attackers could plant a public repo with an HTML file padded past 256KB containing a malicious script; when Claude Code reviewed or edited it, the preview auto-rendered and silently exfiltrated credentials.
- Stolen data included SSH private keys, AWS and GitHub credentials, API keys, and Claude OAuth tokens.
- Noma researchers reported the bug July 4; the first fix was bypassed, with a final patch deployed Aug. 17.
Yam Store phishing marketplace fueled 1 billion messages; Microsoft disrupts Storm-3119 ecosystem
Microsoft has disrupted a Chinese-language cybercrime marketplace, Yam Store, that supplied cloud infrastructure and phishing kits behind more than 1 billion phishing messages worldwide.- Yam Store (tracked as Storm-3119) is an initial access broker selling fraudulently obtained Microsoft 365 and Google cloud environments, including domains tied to legitimate, expired, or previously used organizations
- Three phishing kits sold through the marketplace — CoGUI, Haozi (Phoenix), and Iron Man System (tracked as Storm-2990) — enabled over 1 billion phishing emails and SMS messages to more than 75,000 organizations since January 2026
- Targets included healthcare, financial services, wholesale distribution, and IT sectors in Japan, the US, Australia, and India; over 750 million messages targeted Microsoft customers across 150+ countries
- Iron Man System includes 2,335 phishing templates across 139 countries impersonating government, law enforcement, healthcare, finance, transportation, and retail brands
- Kits use evasion techniques including geofencing, fake CAPTCHA gates, IP block/allow lists, anti-detection configs, and Telegram bots for real-time victim notifications; payments were accepted in USDT and Ethereum; Microsoft disabled over 20,000 tenants tied to 140,000+ malicious domains
Unit 42 uncovers PEERSTITCH implant deployed via FortiManager CVE-2024-47575 intrusion
CVE-2024-47575
Unit 42 details an intrusion in which attackers exploited FortiManager CVE-2024-47575 to steal data on 500+ FortiGate firewalls and deploy a stealthy memory-resident implant called PEERSTITCH.- Affects FortiManager appliances (including FortiManager Cloud); CVE-2024-47575 is a missing-authentication flaw in the fgfmd daemon allowing unauthenticated remote code execution via the FMG-Access channel on TCP port 541.
- Attackers tracked as CL-STA-0954/UNC5820, with tradecraft overlapping suspected nation-state activity, hit a telecom managed service provider in September 2024 and exfiltrated an archive (.tm) with configs, credentials, keys and databases for 500+ managed FortiGate firewalls.
- They registered a rogue Virtual FortiGate named localhost (serial FMG-VMTM23017412) from 45.32.41[.]202 (later 198.199.122[.]22), pushed packet-capture rules to downstream firewalls, decrypted stolen credentials, and logged in via SSL/VPN from 23.240.77[.]233 and 47.18.167[.]159.
- The attackers exploited a second flaw, CVE-2025-61624 (FortiOS auto-script path traversal), to deploy PEERSTITCH, a memory-resident ARM64 malware with no on-disk binary, no listening ports and no outbound connections, communicating through legitimate process traffic.
- Mandiant observed mass exploitation across 50+ FortiManager devices in various industries as early as June 27, 2024.
Sources 📄 Source: fortiguard.com · 📎 Coverage: unit42.paloaltonetworks.com · 👁 via Palo Alto Unit 42Smashing Security #488: FBI arrests ransomware negotiator tied to ShinyHunters probe; ASOS app hacked
Smashing Security podcast episode 488 discusses the FBI's arrest of a ransomware negotiator linked to the ShinyHunters investigation and the ASOS app hack.- Ransomware negotiator Edward Dabrowski was arrested by the FBI at a cybersecurity conference in connection with the ShinyHunters investigation.
- The FBI and Dutch National Police announced the arrest of an alleged ShinyHunters leader, carried out by the Dutch High-Tech Crime Unit.
- ShinyHunters separately claims it breached FBI systems via a PeopleSoft zero-day, stealing data on thousands of FBI employees and job applicants.
- Hackers also gained access to ASOS's app and used it to message every customer, prompting a company response.
- Episode 488 features Graham Cluley and special guest Paul Ducklin discussing these stories.
📋 ADVISORIES
- 📄 Source for Anthropic's Sept 2026 threat report details Claude misuse, from stolen API keys to AI-run attacks on ~30 AI labs — www-cdn.anthropic.com
🔓 CVEs & KEV
CVE-2026-110862 — better-auth — CVSS 9.3 — Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic LinkBe...
CVE-2026-110858 — gitpython-developers GitPython — CVSS 9.2 — GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() RefspecGitP...
CVE-2026-110864 — better-auth — CVSS 9.1 — Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth ProxyB...
CVE-2026-110867 — renovatebot renovate — CVSS 9.0 — Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared PresetRenovate...
CVE-2026-110859 — gitpython-developers GitPython — CVSS 8.7 — GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch NameGit...
CVE-2026-110856 — gitpython-developers GitPython — CVSS 8.7 — GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_dateGitPy...
CVE-2026-110863 — better-auth sso — CVSS 8.6 — Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal ...
CVE-2026-110868 — renovatebot renovate — CVSS 8.4 — Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasourcesRenova...
<https://cve.threatint.com/CVE/CVE-2026-110857?utm_campaign=info&utm_medium=rss&utm_source