Attackers exploit a critical Cisco email gateway flaw to gain root access. Cisco urges customers to update scanner tools and check for compromise. Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS score of 9.8. An attacker can exploit the flaw by sending a crafted email attachment through the gateway and, if it lands right, writing arbitrary files to the underlying operating system. “A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.” reads the advisory. “This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.” The networking giant found this one in its own internal security scanning, which is at least some comfort, and became aware of active attacks in October. The advisory highlights that cleanest that not every Cisco email gateway is vulnerable. The File Reputation service, part of the Advanced Malware Protection feature, has to be enabled and assigned to a mail policy, and the Content Scanner Tools version has to be earlier than 25.3.0.5525. If either condition doesn’t apply, the attack path doesn’t exist. Checking is fast. To verify File Reputation status, open the web management interface and navigate to Mail Policies, then Advanced Malware Protection for either incoming or outgoing policies. To confirm the scanner version, run contentscannerstatus at the CLI. If the output shows anything older than 25.3.0.5525, the device is exposed. The cleanest remediation is updating the Content Scanner Tools package. “Updating the Content Scanner Tools does not require a software upgrade or a product restart. Customers who have enabled automatic Content Scanner Tools updates are not required to take any action once the update has been applied.” continues the advisory. “Customers who have disabled automatic updates should apply the Content Scanner Tools update manually.” Gateways with automatic updates enabled should check that the update has been installed by verifying the scanner version. If automatic updates are disabled, administrators can run contentscannerupdate from the command line to install it manually. Cisco has also released fixes in AsyncOS versions 15.5.5-014 and 16.5.0-780. Version 16.0 has no fixed release, so users must migrate to another version. Cisco recommends upgrading any version older than 16.5 directly to 16.5.0-780. Cisco-managed Secure Email Cloud customers are already protected and don’t need to take any action. Cisco’s compromise check is a single command: grep "System Security" system_logs. It returns one of three outputs: a confirmed compromise indicator, a scan that failed to complete, or a clean result. The last one isn’t a guarantee, though. “Upon successful exploitation of this vulnerability, attackers may obtain command execution with root privileges. With this level of access, attackers may remove or hide evidence of exploitation and indicators of compromise.” states the advisory. “Cisco strongly recommends that cross-checking the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity, including but not limited to unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.” That means a clean log result isn’t proof the device wasn’t compromised. Cisco strongly recommends also pulling firewall and network logs from outside the appliance to look for unexpected uploads to external addresses or downloads from suspicious ones. For virtual appliances, Cisco recommends rebuilding the system if it has been compromised. First, save forensic data, as upgrading the affected system will destroy it. Then deploy a new virtual machine with a fixed software version, rebuild the configuration from scratch without importing old configuration files, and change all credentials and cryptographic keys. Clustered systems need extra care because SSH keys are used to authenticate between members. If one system is compromised, its private keys could put the others at risk. This is the third Cisco email gateway flaw that attackers have exploited to gain root access since December 2025. Previous incidents involved a SQL injection flaw reported in September and a zero-day in the spam quarantine feature. Cisco has now confirmed that attackers are exploiting two vulnerabilities disclosed in a September security update. Read the full Cisco advisory for indicators of compromise and details of the fixed releases. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISCO)
Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August. As Microsoft explained when it acknowledged the issue last month, affected users experienced multiple symptoms, most commonly a black screen after sign-in, being unable to access their desktop until they manually started the desktop session, and Windows Explorer crashes in application event logs. However, this known issue mainly affects Azure Virtual Desktop (AVD) hosts using FSLogix, a software solution that speeds up user profile loading in virtual desktop environments. Microsoft has now addressed the bug in cumulative updates released as part of this month's Patch Tuesday and asked affected users to update their systems.
Android trojan Hirudo replaces genuine banking apps with modified versions to steal credentials and bypass security checks, enabling financial fraud. ThreatFabric researchers detailed a new Android banking trojan called Hirudo that takes a genuinely different approach to defeating banking security. Instead of throwing a fake login screen over the real app, it uninstalls the real app and puts a modified copy in its place. “What sets it apart is the lengths its operators go to once a bank is in their sights: rather than overlaying a fake screen on top of the genuine banking app, Hirudo attempts to replace the banking app itself with a modified copy that quietly disables the bank’s own security checks from the inside.” reads the analysis published by ThreatFabric. Eight Indonesian banking apps from seven banks already have specially designed replacements ready. The malware’s credential-stealing code also targets users in Indonesia, China, India, Mexico, Morocco, and Thailand. Hirudo is delivered as a second app hidden inside a convincing dropper. The dropper looks like a legitimate shopping app, short drama platform, or adult video service. It loads real content through a WebView to make the app look genuine. If it detects a banking app on the device and finds that Hirudo is not yet installed, it displays a fake in-app update prompt. One dropper analysed by researchers goes a step further. During installation, it creates a deliberately broken VPN connection that cuts off the device’s internet access while Hirudo is installed. This does not fully bypass Google Play Protect, but ThreatFabric believes the technique is designed to weaken online reputation checks and code analysis while the malicious APK is being installed. Hirudo is then installed as a separate app from the dropper. Before it can carry out its malicious activities, it must obtain its own Accessibility and notification permissions. When the payload detects a target banking app, it checks the app’s signing certificate against a stored reference, then shows a fake update prompt and immediately opens Android’s uninstaller without waiting for the user to tap confirm. It downloads the patched replacement in parallel. “Hirudo keeps a registry of 42 financial apps, but only eight Indonesian apps, across seven banks, have dedicated replacement downloads. For these, the RAT detects the installed banking app through Accessibility, checks its signing certificate against a stored reference, then shows a fake “update” prompt.” reads the analysis. “It opens Android’s uninstaller for the genuine app without waiting for the user to tap, and downloads the bank-specific replacement in parallel.” The replacement keeps the original package name and version number, but it’s signed with a public test key rather than the bank’s real certificate. Android won’t install it as an update over a properly signed app, which is why the original has to go first. That requirement is a real constraint: the victim can interrupt it. But if they don’t, what follows is clever enough to matter. The bank’s original code remains almost unchanged. Only one line is added to the app’s Application class. This line loads a built-in hooking engine when the app starts. The engine uses two open-source frameworks: YAHFA to modify Java methods and Dobby to modify native functions. It activates only when it finds a trigger file created by the RAT on the device. Without this file, the modified banking app appears harmless. Once activated, the engine runs inside the banking app and controls how it responds to security checks. If the app asks for its signing certificate, the engine returns the genuine one. If it checks which accessibility services are enabled, the engine returns an empty list. It also removes the flag that blocks screenshots, allowing the attacker to view and record the banking screen remotely. Play Integrity checks are sent over plain HTTP to a server controlled by the operator, which returns an acceptable result. Researchers highlight two important points. First, the keybox used for attestation has been leaked publicly, and at least two of its certificates are already on Google’s revocation list. Second, a valid Play Integrity response does not prove that the app has not been tampered with. In this case, the response was relayed through the operator’s server rather than generated through a genuine integrity check. The lures don’t spread through side-loaded APKs from shady forums. They’re served from Amazon CloudFront, tied to campaign tracking through OpenInstall attribution, and linked to Meta Pixel IDs connecting specific branding to specific campaign groups. Some download routes were still live through late September and into October 2026. The operator APK-processing panel, which rebuilds dropper and payload APKs into finished lures and patched banking apps, was reachable without authentication, with cloud storage buckets and credentials left exposed, a significant operational security failure that helped ThreatFabric map the operation. Records from August 2026 included thousands of credential entries split across campaign groups, device records, lock-screen history, and financial profiles with monthly income and risk score fields. Operators annotated records they considered “phished,” which signals a workflow built to convert stolen data into actual fraud rather than just collect it. ThreatFabric’s conclusion on the defensive side is worth reading directly: “once an app can be replaced, its locally produced signals — signature, accessibility list, integrity verdict — must be treated as attacker-influenced and verified server-side.” A valid Play Integrity verdict from a relayed request is not a green light. A clean accessibility list from a patched app is not evidence there’s no controlling service running. The signals the app produces locally are no longer trustworthy, and any bank relying on them as blockers rather than inputs to server-side risk scoring is running on assumptions this trojan was designed to exploit. “Hirudo marks a deliberate escalation in how Android bankers approach hardened applications. By moving its tampering inside the target app, the operation shifts the contest from the device to the application’s own integrity checks, and from a bespoke patch to a reusable engine that can be retargeted at other apps and regions.” concludes the report. “The defensive conclusion is consistent across every capability we examined: signals produced locally by an app that may have been replaced cannot be trusted on their own.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Android malware)
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM. The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems. In a report published earlier
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an
We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft Patch Tuesday security updates for October 2026 address a record 1,415 vulnerabilities, including a zero-day under active attack. The flaw, tracked as CVE-2026-96951, is a Windows Shell command injection vulnerability that allows an unauthorized attacker to bypass security protections over a network. Exploitation can evade Mark of the Web (MOTW) defenses, which help protect users from potentially dangerous files downloaded from the internet. Microsoft confirmed that the flaw is being actively exploited. “An attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses.” reads the advisory. “In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability. In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker’s site or send a malicious attachment.” According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 16, 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8.6), to its Kev Catalog. The vulnerability is an authentication bypass issue caused by spoofing in ICS versions before 25.1.3.0 that could allow a remote, unauthenticated attacker to execute arbitrary commands. ICS versions 22.7R2.14 and earlier are not affected. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group’s operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. Famous Chollima (a.k.a. WageMole) is commonly tracked as a North Korean threat actor associated with fraudulent IT-worker schemes that generate revenue for the DPRK regime. Because North Korea is subject to extensive international sanctions, its operatives seek technology jobs at companies worldwide, often using stolen, rented, or fabricated identities. In some cases, they also attempt to compromise employers’ networks to steal sensitive data, deploy malware, or obtain cryptocurrency and other assets. As part of an operation in Texas codenamed “Lonestar Roundup,” the FBI searched 40 residences suspected of hosting laptop farms between September 21 and 25.
Confirm this action.
Leaving now will discard your changes.