Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. Multiple administrator reports indicate that attacks began in mid-September, roughly a month before the formal security bulletin, the GitHub advisory, and CVE publication. CVE-2026-110447 impacts richdocumentscode versions before 26.4.303 and resides in the Nextcloud app’s mechanism for starting the bundled Collabora server. The flaw affects only the optional built-in CODE server app. Standalone Collabora Online servers, Docker and RPM/DEB installations, and Nextcloud All-in-One deployments remain unaffected, according to Collabora. The attacks involve sending a malicious request to the app’s proxy.php endpoint, triggering OS command injection.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 (CVSS score of 9.8). An attacker can exploit the flaw by sending a crafted email attachment through the gateway and, if it lands right, writing arbitrary files to the underlying operating system. The flaw CVE-2026-0322 (CVSS score: 8.6) is a high-severity code injection vulnerability in the management interface of Palo Alto Networks PAN-OS. It could allow an authenticated attacker with network access and high-level privileges to execute arbitrary code with root privileges on an affected firewall. The vulnerability affects PA-Series and VM-Series firewalls and Panorama appliances. Palo Alto Networks confirmed that limited exploitation has been observed targeting the management interface. The company recommends restricting access to trusted internal IP addresses and installing the relevant security updates. The flaw CVE-2026-105133 (CVSS score: 5.5) is an improper authentication vulnerability in AhsayCBS, a backup management platform. The flaw affects the checkSysPwd function in the product’s API and could allow a remote attacker to bypass authentication by manipulating the random parameter. Starting on October 7, 2026, attackers used it to bypass authentication before exploiting a second vulnerability, CVE-2026-105134, to execute commands on affected servers. Huntress reported that at least five organizations had been targeted by October 8. The flaw CVE-2026-105134 (CVSS score: 9.3) is a critical operating system command injection vulnerability in the Replication Receiver component of AhsayCBS. The flaw affects the /rps/api/json/UpdateReceivers.do endpoint and could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying system. The vulnerability is being actively exploited in the wild. Attackers have chained it with CVE-2026-105133 to gain remote code execution with NT AUTHORITY\SYSTEM privileges, deploy JSP web shells and install XMRig cryptocurrency miners disguised as Microsoft Edge processes. Huntress observed attacks against at least five organizations by October 8, 2026. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by October 17, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia. Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia. The targets include the Orsk Oil Refinery in southern Russia, about 25 kilometers from the Kazakhstan border, and the government of Nizhny Novgorod, a major city about 425 kilometers east of Moscow. The city lies where the Volga and Oka rivers meet, an important waterway system connected to the Caspian Sea. This target may be significant because Kazakhstan depends on the Caspian basin. The group has been running targeted intrusion campaigns against government bodies, diplomatic missions and civil society organizations across Central Asia since at least 2024. “Silent Lynx (overlapping with activity tracked as UAT-6275 by Cisco Talos and as TAG-193 by Recorded Future) is a persistent threat actor that has conducted targeted intrusion campaigns against government ministries, diplomatic missions and civil society organizations across Central Asia since at least 2024.” the paper states. “The group maintains a strong focus on high-value public sector organizations in the Commonwealth of Independent States (CIS), frequently leveraging spear-phishing campaigns conducted through compromised government email accounts and malware staging through trusted public services such as GitHub to increase credibility and infection success rates.” The group overlaps significantly with clusters previously documented under names like YoroTrooper, ShadowSilk, and Hydra Saiga, all pointing at the same underlying activity. The toolkit is deliberately lightweight: PowerShell-based reverse shells, proprietary shells written in C++, C#, and Go, commodity tunneling tools, and spear phishing emails sent through compromised government email accounts in Tajikistan and Kyrgyzstan to add credibility. GitHub, Telegram, and hijacked legitimate servers all serve as staging platforms. Nothing about it is technically flashy, which is part of why the group has stayed active for years without much public attention. The researchers found links that go beyond technical evidence. In March 2026, a Tajik government agency contacted a Silent Lynx server, shortly after Kazakhstan’s lower house of parliament ratified a Treaty on Allied Relations with Tajikistan. In early April, a Belarusian government entity appeared on the same infrastructure, about a week before Kazakhstan’s president met with the Belarusian foreign minister in Astana. These links do not prove the reasons behind the activity, but the researchers highlight them in their paper, and they are difficult to ignore. The connection to the Orsk refinery also has a clear context. A Ukrainian drone attack in August forced the refinery to shut down for months. Russia had already asked Kazakhstan to help make up for the resulting loss of refining capacity. If a Kazakhstan-linked actor was collecting intelligence on Russian energy infrastructure at that time, it could have been assessing the economic impact or trying to understand how the disruption might affect Kazakhstan’s own export pipelines. The researchers stress that they do not have enough evidence to identify a specific motive. However, they present the facts and let readers draw their own conclusions. “A sample compiled in August 2025 was observed using a document titled Деловое предложение о сотрудничестве между ГК «Туркменнебит» и руководством Орского НПЗ (translated: Business proposal on cooperation between State Concern ‘Turkmennebit’ and the management of Orsk Refinery) (see Figure 11). We assess that this sample may be targeting Russia’s critical energy infrastructure, given the close integration of the Russian BREAK THE SILENCE: TRACKING SILENT LYNX THROUGH EXPOSED INFRASTRUCTURE SHEN & VÖGELE 10 VIRUS BULLETIN CONFERENCE OCTOBER 2026 and Kazakh energy sectors.” continues the report. “The document outlines proposals for developing mutually beneficial cooperation, with a particular focus on the exchange of expertise, technologies, and industry best practices. It is worth noting that the author of this PDF file is ‘pickle rick’ and the document was created just one hour after the payload was compiled. The name ‘pickle’ is aligned with the name ‘pickl’ we observed in the PickleShell PDB string3.” What gave the group away wasn’t a sophisticated interception, it was their own operational sloppiness. They left open directories exposed on public servers containing live tooling, staged payloads, and one very incriminating shell command history showing keyboard input typed in Latin with a Russian keyboard layout active, so “whoami” came out as “црщфьш.” GitHub commit timestamps across 77 commits fit working hours in Astana, Kazakhstan, at 95 percent, compared to only 51 percent if you plot them against Moscow time. Administration connections to Silent Lynx servers came from ProtonVPN egress IPs geolocated to Kazakhstan, exclusively on weekdays between 7 AM and noon local time. The group’s servers were also being reached from those VPN addresses, which Proton typically assigns based on geographic proximity. Two malware samples were uploaded to VirusTotal from Kazakhstan within minutes of compilation, which is classic anti-detection testing behavior and points to the operator location directly. “We identified several additional indicators that strengthen the assessment of a Kazakhstan-based origin. The first derives from what appears to be malware detection-testing activity conducted through VirusTotal.” continues the report. “Two samples showed this pattern: an early Chvost sample12 was uploaded to VirusTotal only 86 seconds after compilation, while a second sample13 was uploaded approximately four minutes after compilation. Both samples were uploaded from Kazakhstan, and the same uploaders had submitted additional tools that were later observed in Silent Lynx campaigns.” A researcher at Johns Hopkins School of Advanced International Studies told Reuters that the case highlights an important point: cyber espionage is no longer the domain of a few major powers. Smaller countries are also developing their capabilities and running long-term operations against neighboring states, often driven by serious geopolitical interests. Silent Lynx is also becoming more technically advanced. In April 2026, the group used an exploit for the first time to deliver malware. It abused a WinRAR path traversal flaw (CVE-2025-8088) to place malicious files directly in the Windows Startup folder, without requiring victims to enable macros. The group also stored a public proof of concept for a FortiWeb authentication bypass vulnerability on its own command-and-control (C2) server. Researchers have also found signs of growing interest in Linux systems. After relying mainly on social engineering for two years, Silent Lynx appears to be building a more advanced set of attack tools. Full joint Virus Bulletin paper with full indicators of compromise, malware hashes, and infrastructure details is available here. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, SILENT LYNX)
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network. The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn money by sharing their internet connections, on devices without the owners’ consent. Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses. By installing the app on multiple systems, the attacker likely accumulated larger payouts. Threat intelligence company GreyNoise discovered the campaign while investigating suspicious activity at an unnamed organization, and identified at least 143 compromised devices worldwide. According to the researchers, the attacker leveraged several vulnerabilities to breach edge devices and install the Pawns.app software:
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. AUR is a community-maintained, widely-used package index for Arch Linux and derivative distributions that hosts package build scripts (PKGBUILDs) for third-party and proprietary tools, beta, or older package versions that are no longer available via the official Linux distribution channels. The repository has recently become a target of malicious campaigns, including an attack in June in which 400 packages distributed credential-stealing malware with rootkit capabilities. Another campaign in July prompted Arch to temporarily disable package adoption. The latest campaign was detected on October 13 and involved malicious packages uploaded by a user named “marchos1as” under typosquatted names mimicking the yay and paru command-line tools.
Spyware vendors use online ad infrastructure to profile targets and deliver exploits without requiring users to click anything. The investigation links Discover-Tech to Candiru, an Israeli spyware vendor that the US government placed on its Entity List in 2021. Candiru has since used the name Integrity Labs. Citizen Lab also identified links involving other surveillance companies, including Bindecy and Intelos, suggesting that Discover-Tech’s infrastructure served more than one customer. The researchers examined almost four billion advertising bid records covering March to June 2026. During that period, Discover-Tech’s MyDSP platform bid on nearly 3.77 billion ad impressions and won about 442 million, with advertisements appearing across more than 120,000 websites and 70,000 mobile apps. “We reviewed bidding data for MyDSP for four months (March through June 2026). In this period, Discover-Tech’s MyDSP bid on 3,770,286,576 impressions, and appeared to win 441,954,291 (11.7%). About 76.7% of the bids were for ad impressions in mobile apps, and 23.3% for impressions in the web browser.” reads the report published by Citizen Lab. “The database shows a total of three advertisers, with nine total combinations between advertiser and an advertiser domain name.” Reuters, citing Citizen Lab and advertising security firm Confiant, reported that the company’s wider advertising activity reached more than 120,000 websites and 75,000 apps, potentially exposing hundreds of millions of people to its tracking infrastructure. The distinction between exposure and infection matters. Most advertisements didn’t necessarily deliver spyware, and seeing one doesn’t prove a device was compromised. But the system gave Discover-Tech a way to profile users at scale and select particular devices for more intrusive operations. “In 2024 and 2025, international news network Al Jazeera was targeted in a series of zero-click attacks that we link with high confidence to Candiru’s spyware delivered via Discover-Tech’s ads. At least 45 devices within Al Jazeera were targeted in these attacks.” continues the report. Citizen Lab reached this finding by examining network logs supplied by the broadcaster. The researchers linked the activity in 2024 and 2025 to Candiru spyware delivered through Discover-Tech advertisements, providing technical evidence of a real operation rather than a theoretical attack scenario. The advertising records also showed impressions on networks associated with sensitive organizations, including the Pentagon, NATO, the United Nations, the European Commission and the International Criminal Court. Researchers identified activity involving government, defense, media and critical-infrastructure networks across several countries. These findings don’t mean that every organization whose network displayed an advertisement suffered a spyware infection. They do show that advertising infrastructure can reach people working in environments where their identities, communications and device activity have intelligence value. This creates a problem for security teams. Traditional defenses focus on malicious attachments, suspicious links, vulnerable software and unauthorized network connections. AdFection adds another route: code delivered through a service that users and organizations routinely allow because it supports ordinary web browsing. Advertising identifiers, IP addresses, browser characteristics and other technical signals can help operators distinguish one device from another. When combined with targeted advertising, these signals can support reconnaissance and help an operator decide which users merit further attention. In intelligence terms, the same infrastructure can support both broad collection and selective exploitation. Discover-Tech’s access to major advertising platforms helped its operations appear legitimate. Citizen Lab found that Google and the advertising industry association IAB Europe had listed the company among approved vendors for years, despite links to people and businesses associated with the surveillance industry. Following the investigation, Google terminated Discover-Tech’s access to its advertising exchanges, while IAB Europe suspended its vendor status. Beeswax removed the company from its platform, and Vungle, operated by Liftoff, paused its access while reviewing the findings. Eskimi also blocked its accounts and domains. These actions matter, but they don’t resolve the underlying problem. The advertising industry relies on complex chains of buyers, exchanges, publishers and third-party scripts, often with limited visibility into what each component does when an advertisement loads. A company can pass routine checks while using targeting rules to deliver different code to different users, making malicious behavior harder to detect through automated scanning alone. Organizations should treat online advertising as a potential attack surface, particularly on devices used by executives, intelligence personnel, journalists and employees with access to sensitive systems. Blocking advertisements and tracking requests at the network gateway can reduce exposure, while managed devices should disable ad personalization where possible and use browsers with strong tracking protections. Security teams should also review traffic generated when advertisements load, looking for unexpected connections to external infrastructure or suspicious scripts. Organizations facing elevated targeting risks should consider stricter controls on advertising, browser extensions and third-party content, especially on systems used to access confidential information. The larger lesson is that a familiar user experience doesn’t guarantee a safe technical process. A banner promoting a phone or a pair of earbuds may look entirely ordinary, while the code behind it performs tracking or checks whether the device matches a target. The victim doesn’t need to click anything, and that’s precisely what makes this technique difficult to spot. “The distribution of spyware via targeted ads represents a security risk not only for potential victims but also for states and civil society at large.” continues the report. “Two major U.S. security agencies, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA), have warned already in 2018 and 2020 that adversaries may leverage malicious ads to deploy malware on devices, and thus both recommended that government agencies and other organizations use ad-blocking software.” This is the central warning from Citizen Lab’s investigation: online advertising is no longer just a privacy concern. Under the right conditions, it can become an operational tool for espionage. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, spyware)
AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and weaknesses of both approaches and explains where AI agents can improve security testing.
Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups. The joint action, dubbed International Effort Confluencia, included four law enforcement operations between March 2026 and September 2026. "Effective cross-border cooperation between law enforcement and the private sector has never been more urgent," said Stephen Fry, Executive Director of INTERPOL Investigation Support. "Behind every file is a child who was abused, and who is revictimized every time that image recirculates. Wherever offenders move, we have to move faster." The investigators executed 127 search warrants to arrest nearly 95 suspects and rescued a five-year-old victim whose parent had been producing and selling abuse material online.
Attackers exploit a critical Cisco email gateway flaw to gain root access. Cisco urges customers to update scanner tools and check for compromise. Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS score of 9.8. An attacker can exploit the flaw by sending a crafted email attachment through the gateway and, if it lands right, writing arbitrary files to the underlying operating system. “A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.” reads the advisory. “This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.” The networking giant found this one in its own internal security scanning, which is at least some comfort, and became aware of active attacks in October. The advisory highlights that cleanest that not every Cisco email gateway is vulnerable. The File Reputation service, part of the Advanced Malware Protection feature, has to be enabled and assigned to a mail policy, and the Content Scanner Tools version has to be earlier than 25.3.0.5525. If either condition doesn’t apply, the attack path doesn’t exist. Checking is fast. To verify File Reputation status, open the web management interface and navigate to Mail Policies, then Advanced Malware Protection for either incoming or outgoing policies. To confirm the scanner version, run contentscannerstatus at the CLI. If the output shows anything older than 25.3.0.5525, the device is exposed. The cleanest remediation is updating the Content Scanner Tools package. “Updating the Content Scanner Tools does not require a software upgrade or a product restart. Customers who have enabled automatic Content Scanner Tools updates are not required to take any action once the update has been applied.” continues the advisory. “Customers who have disabled automatic updates should apply the Content Scanner Tools update manually.” Gateways with automatic updates enabled should check that the update has been installed by verifying the scanner version. If automatic updates are disabled, administrators can run contentscannerupdate from the command line to install it manually. Cisco has also released fixes in AsyncOS versions 15.5.5-014 and 16.5.0-780. Version 16.0 has no fixed release, so users must migrate to another version. Cisco recommends upgrading any version older than 16.5 directly to 16.5.0-780. Cisco-managed Secure Email Cloud customers are already protected and don’t need to take any action. Cisco’s compromise check is a single command: grep "System Security" system_logs. It returns one of three outputs: a confirmed compromise indicator, a scan that failed to complete, or a clean result. The last one isn’t a guarantee, though. “Upon successful exploitation of this vulnerability, attackers may obtain command execution with root privileges. With this level of access, attackers may remove or hide evidence of exploitation and indicators of compromise.” states the advisory. “Cisco strongly recommends that cross-checking the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity, including but not limited to unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.” That means a clean log result isn’t proof the device wasn’t compromised. Cisco strongly recommends also pulling firewall and network logs from outside the appliance to look for unexpected uploads to external addresses or downloads from suspicious ones. For virtual appliances, Cisco recommends rebuilding the system if it has been compromised. First, save forensic data, as upgrading the affected system will destroy it. Then deploy a new virtual machine with a fixed software version, rebuild the configuration from scratch without importing old configuration files, and change all credentials and cryptographic keys. Clustered systems need extra care because SSH keys are used to authenticate between members. If one system is compromised, its private keys could put the others at risk. This is the third Cisco email gateway flaw that attackers have exploited to gain root access since December 2025. Previous incidents involved a SQL injection flaw reported in September and a zero-day in the spam quarantine feature. Cisco has now confirmed that attackers are exploiting two vulnerabilities disclosed in a September security update. Read the full Cisco advisory for indicators of compromise and details of the fixed releases. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISCO)
Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August. As Microsoft explained when it acknowledged the issue last month, affected users experienced multiple symptoms, most commonly a black screen after sign-in, being unable to access their desktop until they manually started the desktop session, and Windows Explorer crashes in application event logs. However, this known issue mainly affects Azure Virtual Desktop (AVD) hosts using FSLogix, a software solution that speeds up user profile loading in virtual desktop environments. Microsoft has now addressed the bug in cumulative updates released as part of this month's Patch Tuesday and asked affected users to update their systems.
Confirm this action.
Leaving now will discard your changes.