Cyber Threat Brief — October 15 2026
⚠️ This report is AI-generated. Always validate findings.
1. Cisco Secure Email Gateway — one crafted email gives unauthenticated root — CVE-2026-76519
TL;DR: Cisco says attackers are exploiting a path-traversal bug in the gateway’s AMP File Reputation feature: a single email with a crafted attachment can write files and run commands as root, with no login and no workaround. CISA added it to KEV (due Oct 17). Confirm Content Scanner Tools is at 25.3.0.5525 or later today, then run Cisco’s compromise check on every cluster member.
What’s New:
- CVE-2026-76519 (CVSS 9.8, CWE-23) only bites when File Reputation is enabled on a mail policy and Content Scanner Tools is older than 25.3.0.5525. Cisco found it in internal scanning and learned of exploitation in October; it has shared no actor, victim count, or attack IOCs.
- The fix quietly shipped Sept 14 in the hardening release (AsyncOS 15.5.5-014 / 16.5.0-780) under umbrella CVE-2026-76440; Cisco split it out Wednesday once attacks were known. AsyncOS 16.0 has no fixed build, and 16.0.4-302 (the September CVE-2026-76461 fix) does not fix this one.
- This is the second exploited unauthenticated-root SEG bug in a month after CVE-2026-76461; Cisco has not linked the two campaigns.
- A rooted appliance exposes the SSH keys cluster members use to trust each other, and upgrading a compromised VM destroys its forensic logs.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Content Scanner Tools version below 25.3.0.5525 in contentscannerstatus output, on a gateway with “Enable File Reputation” checked under Mail Policies > Incoming/Outgoing Mail Policies > Advanced Malware Protection | Vulnerable version | T1190 | Appliance CLI / config inventory | Run contentscannerstatus on every Secure Email Gateway; where the version is below 25.3.0.5525, run contentscannerupdate (no restart needed) and turn on automatic updates. Then move AsyncOS to 15.5.5-014 or 16.5.0-780; 16.0 gateways must migrate. |
System Security: Suspected compromise indicator was found. line in the appliance system_logs | Compromise indicator | T1190 | SEG system_logs (CLI grep "System Security" system_logs, or the same string in forwarded syslog) | Run grep "System Security" system_logs on each cluster member and alert on the “Suspected compromise indicator was found” or “Security scan did not complete” strings in forwarded logs. On either, image the VM before upgrading and open a TAC case; a “No compromise indicator” line is not proof of safety. |
| Outbound connection initiated by a Secure Email Gateway IP to an external host that is not a Cisco update/AMP cloud endpoint or a known next-hop mail server | Exfiltration / C2 | T1041 | Perimeter firewall / NetFlow | Baseline egress from each SEG IP and alert on uploads to, or downloads from, unknown external IPs since Sept 14. Cisco says a root attacker can scrub on-box evidence, so off-box firewall logs are the authoritative record. |
| Cluster SSH key pairs on Secure Email Gateway cluster members | Credential exposure | T1552.004 | Cluster inventory / appliance config | If any member is compromised, rebuild every member of that cluster on a fresh fixed-release VM without importing the old configuration, and renew all credentials, certificates, and SSH keys. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No detection references Secure Email Gateway, AsyncOS, or ESA logs. |
| Elastic | None — verified | No rule ingests or models the appliance. |
| Sigma | None — verified | No rule ingests or models the appliance. |
Detection index: ESCU a268aee (2026-10-15) · elastic detection-rules 195f15c (2026-10-09) · SigmaHQ 7d8b152 (2026-10-14).
Hunt hint: Start with exposure: list every gateway, its Content Scanner Tools version, and whether any mail policy has File Reputation on. Run Cisco’s system_logs check on each cluster member and forward that string to your SIEM going forward. Then pull firewall logs for each SEG IP back to Sept 14 and look for connections that are not mail delivery or Cisco cloud lookups. Cisco has not published the malicious attachment type, so there is no message-level IOC to sweep the mail logs for yet.
Sources: Cisco advisory cisco-sa-esa-afw-zqYJkjxp · CISA KEV alert (Oct 14) · The Hacker News · BleepingComputer · SecurityWeek
2. Palo Alto PAN-OS management interface — authenticated root RCE — CVE-2026-0322
TL;DR: Palo Alto confirmed “very limited exploitation” of a code-injection bug in the PAN-OS management interface that lets an attacker with admin credentials run code as root on PA-Series and VM-Series firewalls and Panorama. CISA added it to KEV (due Oct 17). Restrict management access to a jump host now, patch, and check management logins against the three source IPs Palo Alto published.
What’s New:
- CVE-2026-0322 (CVSS-B 8.6, CWE-94) needs valid credentials and network reach to the management web interface; no special configuration is required. Cloud NGFW and Prisma Access are not affected. Palo Alto’s own researcher found it.
- Palo Alto tied three source IPs to the exploit attempts but shared no actor, start date, or post-exploitation detail.
- Fixed hotfixes exist on every supported train from 10.2 to 12.2; the 11.2.16 release was due Oct 15.
- Threat IDs 510046 and 510047 give only “limited coverage”, and only if management traffic is routed through a dataplane interface and decrypted, so most deployments will not see them fire.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| PAN-OS build older than the fixed hotfix for its train (e.g. 11.1.10-h25, 10.2.13-h21, 12.1.7-h6) | Vulnerable version | T1190 | Panorama device inventory / show system info | Upgrade to the fixed build for the train: 12.2.4; 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.16; 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, or 11.1.16-h3; 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, or 10.2.18-h12. Unsupported versions must move to a supported fixed build. |
| PAN-OS management web interface reachable from the internet or from any host other than the admin jump box | Exposure | T1190 | External attack-surface scan / device config (deviceconfig system permitted-ip) | Set the management permitted-IP list to the jump host only, and remove management profiles from internet-facing interfaces. Palo Alto rates the risk highest when the management interface is internet-reachable. |
Source IP 66.42.72[.]14 | IOC | T1190 | PAN-OS System log (auth events) / perimeter firewall | Block the IP and search management-interface authentication events and traffic to firewall/Panorama management addresses for 66.42.72.14. Any successful login from it means the admin account used is compromised. |
Source IP 208.83.239[.]114 | IOC | T1190 | PAN-OS System log (auth events) / perimeter firewall | Block the IP and search management-interface authentication events and traffic to firewall/Panorama management addresses for 208.83.239.114. |
Source IP 149.248.47[.]234 | IOC | T1190 | PAN-OS System log (auth events) / perimeter firewall | Block the IP and search management-interface authentication events and traffic to firewall/Panorama management addresses for 149.248.47.234. |
Successful management login (System log auth-success) from a source outside the jump-host allowlist | Valid account abuse | T1078 | PAN-OS System log / Config log | Alert on any admin auth-success whose source IP is not the jump host. Review the Config log for that admin’s session for new administrators or unexpected commits, and rotate the credential. Exploitation requires a valid login, so credential abuse is the earliest observable step. |
Threat ID 510046 / 510047 | IPS signature | T1190 | PAN-OS Threat log | Enable both IDs (content 9159-10287 or later) and alert on any hit. They only see management traffic that is routed through a dataplane interface with decryption on. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | Palo Alto appears only as a web/network data source for other vendors’ CVEs; nothing models PAN-OS management-interface exploitation or admin logins. |
| Elastic | Partial — Newly Observed Palo Alto Network Alert | Higher-order ESQL rule that surfaces first-seen high-severity PAN-OS threat alerts; it would only fire if Threat ID 510046/510047 trigger, which needs decrypted management traffic. |
| Sigma | None — verified | The only Palo Alto rules cover CVE-2024-3400 GlobalProtect telemetry logs, not the management interface. |
Detection index: ESCU a268aee (2026-10-15) · elastic detection-rules 195f15c (2026-10-09) · SigmaHQ 7d8b152 (2026-10-14).
Hunt hint: Pull PAN-OS System logs for management authentication and filter out the jump host; every remaining auth-success needs an owner. Search the same logs and your perimeter firewall for the three published IPs. For any suspect session, read the Config log for added administrators and commits, and treat the firewall as root-compromised if anything is unexplained. Patching does not undo stolen admin credentials, so rotate them on any device whose management interface was internet-reachable.
Sources: Palo Alto advisory CVE-2026-0322 · CISA KEV alert (Oct 14) · BleepingComputer · The Hacker News · SecurityWeek
3. Nextcloud Collabora Built-in CODE Server — web shells via unauthenticated command injection — CVE-2026-110447
TL;DR: Attackers have been planting PHP web shells on Nextcloud servers since Sept 10 through the optional Collabora Online Built-in CODE Server app (richdocumentscode), which ran a bash command built from the request path whenever its local server was down. Collabora published CVE-2026-110447 on Oct 14. Update the app to 26.4.303 or remove it (disabling it does not help), then sweep for shx*.php shells.
What’s New:
- In
richdocumentscode26.4.302 and older,proxy.phpput request text inside a double-quoted bash command, so$(...)in the URL path ran as the web-server user. It only works while the bundled CODE server is not running, such as after a restart, upgrade, or crash. Standalone Collabora servers and setups that use only the Nextcloud Office (richdocuments) app are not affected. - Three administrators reported compromises on GitHub. The payload wrote a one-line PHP shell, sent
uname -ato webhook.site, and then searched for password vaults and crypto wallets; one victim noticed through failed-sudo emails. No root access was reported. - The fix (26.4.303, Sept 11) shipped without a security note and requires Nextcloud 30 or later; Nextcloud 29 and older still receive the vulnerable app. CVSS 9.2; not in KEV.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
richdocumentscode app version 26.4.302 or older | Vulnerable version | T1190 | occ app:list / Nextcloud admin apps page | Run sudo -u www-data php occ app:list and find richdocumentscode. Update it to 26.4.303 or later, or remove it with occ app:remove richdocumentscode; disabling it leaves proxy.php reachable. Nextcloud 29 and older must upgrade Nextcloud or remove the app. |
GET to /apps/richdocumentscode/proxy.php?status whose path contains $(, %24%28, ${IFS}, %2e%2e, or base64${IFS}-d piped to sh | Exploit traffic | T1190 | Apache/nginx access log | Search access logs back to at least 2026-09-10 for proxy.php?status requests carrying any of those markers. A match with a 200 response while CODE was down should be treated as a successful command execution. |
PHP file named shx*.php or shrf*.php in apps/richdocumentscode/ (seen: shrf4645.php, shxa35d0.php, shx5cf91.php, shxd33ce.php, shxf4645.php, shx13a86.php, shx56367.php) | Web shell | T1505.003 | File integrity monitoring / EDR file events / occ integrity:check-core | Run find <nextcloud>/apps/richdocumentscode -name 'sh*.php' and alert on any new PHP file in that folder. Preserve a copy, then delete it, and search access logs for requests to that filename with ?c=. |
SHA-256 4b9fbd0663fbfd6028fc216ed18e0d6ef3ae498a7fdc97083e4b0ce3cec40562 | File hash (one-line $_GET['c'] / shell_exec web shell) | T1505.003 | EDR / FIM hash inventory | Hunt and block this hash across web servers. Because the shell is one line, also grep PHP files for shell_exec($c.' 2>&1'). |
Source IP 139.28.18[.]122 | IOC | T1190 | Web server access log / perimeter | Block and search access logs for 139.28.18.122; it ran the Sept 10 and Sept 11 attacks against proxy.php?status. |
Source IP 89.38.98[.]50 | IOC | T1190 | Web server access log / perimeter | Block and search access logs for 89.38.98.50; it sent the same payload on Sept 14 against an already patched server. |
Outbound HTTPS from the Nextcloud host to webhook[.]site (callback IDs 45060ed4-de0b-4119-8f0d-2a2776bbd413, 774cf5e1-b5a4-4174-a1ad-0241861029a2) | Beacon | T1071.001 | Proxy / DNS / firewall egress logs | Alert on any server connecting to webhook.site and block it for server segments. The payload used it to confirm each new shell with uname -a output. |
www-data running find for *.kdbx, wallet.dat, keystore.json, .bitcoin, or .electrum | Credential discovery | T1083 | auditd / EDR process telemetry | Alert when the web-server account searches for vault and wallet names. Treat anything www-data could read as exposed. |
Failed sudo attempts by www-data | Privilege escalation attempt | T1548.003 | /var/log/auth.log / journald | Alert on sudo failures by www-data; that is how one victim discovered the break-in. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Web or Application Server Spawning a Shell | Fires on a Linux shell whose parent is apache2/httpd/nginx, so it covers mod_php setups but not php-fpm parents, and it will be noisy because Nextcloud legitimately launches the CODE AppImage. |
| Elastic | Partial — Suspicious Command Execution via Web Server | Covers php-fpm* parents; the shells’ sh -c "id 2>&1" and find / … commands match, but the ${IFS}-spaced injection can slip past its literal base64 -d patterns. |
| Sigma | Partial — Webshell Remote Command Execution | auditd execve by euid 33 (www-data) catches every command but needs an audit rule and tuning for the CODE launch; Linux Webshell Indicators misses php-fpm parents. |
Detection index: ESCU a268aee (2026-10-15) · elastic detection-rules 195f15c (2026-10-09) · SigmaHQ 7d8b152 (2026-10-14).
Hunt hint: Find every Nextcloud with richdocumentscode installed, enabled or not. Grep its access logs since Sept 10 for proxy.php?status with $(, ${IFS}, or %2e%2e in the path, then look for any sh*.php in the app folder and requests to it with ?c=. Check egress for webhook.site and auth.log for www-data sudo failures. If anything hits, rotate secrets readable by www-data, including config.php database credentials.
Sources: Collabora advisory GHSA-g3vx-3m76-fghh · Victim reports — richdocumentscode issue #354 · GitHub Advisory GHSA-f97p-r72q-64h2 · Nextcloud forum warning · The Hacker News
Status Updates
- CVE-2026-104935 (Ivanti Connect Secure): KEV due tomorrow, Oct 16. The privilege-escalation link in UTA0576’s chain is still unpatched (Ivanti says “coming weeks”), and CERT-FR issued alert CERTFR-2026-ALE-013. Original brief.
- CVE-2026-96951 (Windows Shell MotW bypass): KEV due tomorrow, Oct 16; Microsoft still has no IOCs. Tenable notes it is the third exploited Windows Shell bug this year after APT28-linked CVE-2026-21510, but no attribution exists for this one. Original brief.
- CVE-2026-105133 / CVE-2026-105134 (AhsayCBS): CISA added both to KEV on Oct 14 (due Oct 17). Ahsay’s fixes are hotfix 10.3.4.45 for v10 and new 9.15.2.70 for v9, each followed by a reboot; Huntress verified 10.3.4.45 blocks the entry point. Original brief.
- Danfoss / Copeland / Dixell refrigeration attacks (FROMAGEGATE): France’s finance minister says about 700 supermarkets were hit, and Dixell-equipped stores were attacked again Tuesday night. CERT-FR says campaigns are likely ongoing and a factory reset alone does not fix end-of-life units; Dixell advises upgrading XWEB 1.12.1 and older. Original brief.
- GhostAction (GitHub Actions secret theft): GitGuardian says an Oct 8–9 wave used about 1,900 hijacked accounts to push the workflow to more than 30,000 repositories and tried to pull 3,174 secrets. GitHub has blocked the workflow since Oct 9, so the Oct 10 and 12 waves got nothing; rotate secrets in any repo that ran
security-audit.ymlorgithub_actions_security.yml. Original brief. - CVE-2026-21589 (Atlassian Data Center file read): Still exploited (Previdian logged 339 attempts from 33 IPs in seven days) and still not in KEV as of catalog 2026.10.14. Original brief.
- CVE-2026-102255 (SonicWall SMA1000 SSRF): Still not in KEV as of 2026.10.14; Previdian logged 177 attempts from three IPs through Oct 14. Original brief.
- KEV deadlines passed: CVE-2026-86950 (Apple CoreGraphics, due Oct 13) (brief); the Flax Typhoon set CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, and CVE-2023-22894 (due Oct 11) (brief); CVE-2026-0257 (Palo Alto GlobalProtect) (brief).
- Retired from watch: FortiMail CVE-2026-104286 (last update 2026-10-07, 10-02); Zammad CVE-2026-102489 and CVE-2026-102490 (last update 2026-10-08, 10-03); Citrix NetScaler SAML DoS CVE-2026-88779 (last update 2026-10-07, 10-04); Cisco Catalyst SD-WAN Manager CVE-2026-76504 (last update 2026-10-02, 10-01). All KEV deadlines passed more than seven days ago with no material change.
- Deferred, not yet briefed: Langflow CVE-2026-105740 (authenticated MCP stdio RCE; exploitation reported only by Previdian sensors) and SiteGuard Server Edition CVE-2026-106931 (vendor-confirmed exploited local command injection, Japan-centric) — recheck 2026-10-17; SAP Cloud SDK CVE-2026-89111 and Ghostscript CVE-2026-39919 — recheck 2026-10-17; AnyDesk Linux “AnyPwn” — recheck 2026-10-16.
- Watching (no change): CVE-2026-97229 GitLab, public PoC but no in-the-wild use (10-13), CVE-2026-85097 and CVE-2026-107406 (10-09), CVE-2026-82077 (10-11), CVE-2026-61500 and CVE-2026-88062 (10-04), CVE-2026-83548 and CVE-2026-83549 (09-03).