Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to halt wallet sales and remove products from shelves while it investigates hardware implant incidents. The company announced the decision in response to discovering that devices purchased from CryptoBilis had been modified to steal seed phrases used to access crypto assets and send them to an unauthorized party over an LTE connection. Ledger sells physical cryptocurrency wallets that securely store private keys used for managing and authorizing digital asset transactions. Following reports of cryptocurrency losses from multiple users, Ledger launched an investigation on October 9 and confirmed that some devices sold by CryptoBilis had been tampered with. Yesterday, Ledger’s Donjon security arm shared more details about the hardware implant found inside devices from the reseller , largely confirming earlier reports by Mark Karpelès and Tibane Labs.
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. Tracked as CVE-2026-76519, this vulnerability stems from a relative path traversal weakness in SEG's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. Threat actors can exploit this issue by sending an email with a maliciously crafted attachment through an unpatched device. "A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system," Cisco said in a Wednesday advisory. "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." CVE-2026-76519 affects SEG instances where the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.
Microsoft Patch Tuesday security updates for October 2026 address a record 1,415 vulnerabilities. Prioritize the exploited zero-day, critical bugs and potentially wormable vulnerabilities. Microsoft just shattered every patch record in the book. October 2026 brought us a staggering 1,415 new CVEs from Microsoft alone. “Well, it’s a new record release from Microsoft, again. This is also the first four-digit volume we have ever seen and includes six-digit CVEs. As always, counting this load is tricky, but I see 1,415 new CVEs from Microsoft. That puts this month at a greater volume than any previous YEAR from Microsoft. I’m starting to think I don’t like this new normal.” states ZDI. “As for the products affected by this release, we have Windows and Windows components, Office and Office Components, Developer Tools and .NET, SharePoint, Linux kernel, Skype for Business and Microsoft Lync, SQL Server and Dynamics, Azure and cloud services, and Exchange server.” This is the first time Microsoft has reported more than 1,000 vulnerabilities in a single month. To help security teams handle this huge number of flaws, Microsoft introduced “risk cohorts” to group related vulnerabilities, similar to the old security bulletin system. AI is clearly helping researchers find bugs faster, both for attackers and defenders. The good news is that vulnerabilities are still being discovered faster than attackers are exploiting them. Security teams should focus on the most serious threats first instead of trying to patch every low-risk flaw at once. Instead, focus immediately on what’s actively burning in the wild. The single zero-day under active attack this month is CVE-2026-96951, a Windows Shell security feature bypass used to dodge Mark of the Web protections. “An attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses.” reads the advisory. “In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability. In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker’s site or send a malicious attachment.” Other high-priority threats include a critical unauthenticated SharePoint privilege escalation bug (CVE-2026-102866), a high-scoring SQL Server remote code execution flaw (CVE-2026-65674), and a massive wave of 59 potentially wormable vulnerabilities spanning core network services like DHCP, Remote Desktop Gateway, and DNS. Below are the descriptions for the above issues: CVE-2026-96951 (CVSS score of 8.8) is a Windows Shell command injection vulnerability that allows an unauthorized attacker to bypass security protections over a network. Exploitation can evade Mark of the Web (MOTW) defenses, which help protect users from potentially dangerous files downloaded from the internet. Microsoft confirmed that the flaw is being actively exploited. CVE-2026-102866 (CVSS score of 8.1) is a Microsoft SharePoint Server vulnerability caused by improper verification of cryptographic signatures. It allows an unauthenticated attacker to elevate privileges over a network, potentially gaining unauthorized access to sensitive information or modifying data. CVE-2026-65674 (CVSS score of 8.8) is a Microsoft SQL Server remote code execution vulnerability caused by the deserialization of untrusted data. An authorized attacker with the required privileges could exploit the flaw over a network to execute code on the affected server. “I may be wrong about some of these – there are a few where the description is somewhat…er…ambiguous, but regardless, this number of wormable bugs in 2026 should cause some level of concern. Not panic.” concludes ZDI. “There’s no need for that, but it is disconcerting to see this many juicy targets sitting out there. Please do your best to test and deploy these fixes in a timely manner.” Prioritize the proven, public, and exploited flaws first, and take a deep breath before diving into the rest of the patch mountain. Make sure your operational priorities remain laser-focused on real risk rather than chasing vanity metrics. Make every effort to test and apply these patches as soon as possible. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Patch Tuesday)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. Tracked as CVE-2026-104935, this high-severity authentication bypass vulnerability lets remote threat actors without privileges execute arbitrary commands on targeted ICS systems in low-complexity attacks that don't require user interaction. Ivanti released ICS versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 on Tuesday to address this security flaw and warned customers to "act immediately" because of "limited exploitation in the wild." While Ivanti didn't share additional information about ongoing attacks targeting CVE-2026-104935, cybersecurity firm Volexity reported that an unknown threat actor it tracks as UTA0576 has been chaining this security issue with two other flaws in attacks since at least October 3rd.
Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled.
Ivanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise. On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance running version 22.8R2.4, the latest build available at the time. Three chained zero-days gave an unknown attacker unauthenticated root access. “n the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance.” states Volexity. “This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935.” The attacker, tracked as UTA0576, had been inside the device since at least October 3, two days before anyone noticed. Ivanti released a patch for two of the three vulnerabilities on October 13; the privilege escalation fix is still coming in a future release. The first flaw affects welcome.cgi, the public login page. An attacker sends a request to this page that passes the authentication checks but includes the path to a protected internal script in an HTTP header. The system checks the URL to decide whether to allow the request, but uses the header to decide where to send it. This mismatch allows the attacker to bypass authentication. The attacker then uploads a Perl script disguised as a ZIP file through another endpoint. The server saves the file, checks whether it is a valid ZIP archive, and schedules it for deletion when the check fails. Before the file is deleted, the attacker sends multiple requests to its predictable location on disk. If a request reaches the file in time, the script executes. Both the authentication bypass and the race-condition flaw that enables remote code execution are tracked under CVE-2026-104935. The third step escalates from the limited web server user to full root. A privileged background service called dsinvoked runs maintenance tasks as root and looks up which programs to execute in a shared configuration store. UTA0576 patches that store in memory, redirects a legitimate task to the Perl interpreter instead, triggers the task, and gets root execution. Then everything gets silently restored to its original state. Volexity found that the attack changed code in memory but restored the configuration data, which explains why Ivanti’s Integrity Checker Tool did not detect anything suspicious. The tool checks files stored on disk, but this attack left no permanent changes there. Each time UTA0576 ran a command, the attackers repeated the entire exploit chain. They received the results through normal HTTPS responses instead of using a persistent backdoor or web shell. They also deleted selected entries from Ivanti debug logs and Linux audit logs covering the attack. Temporary files were removed automatically after use. The attackers hid a packet capture tool under a renamed executable in a directory not shown in normal file listings. They also used eight rotating capture files, allowing older network traffic to be overwritten. Once inside, UTA0576 went straight for credentials. The attacker deployed a custom Python LDAP tool that authenticated to an internal domain controller using the VPN appliance’s own service account and searched Active Directory specifically for LAPS local administrator passwords, BitLocker recovery keys, and any attributes containing passwords in plaintext. Results were compressed and encoded before being exfiltrated back through the same exploit channel. The attacker also ran a packet capture tool to harvest cleartext credentials from LDAP traffic already flowing through the device, built a custom Kerberos implementation capable of Kerberoasting attacks, and ran password-spraying campaigns against Active Directory accounts. “Volexity’s forensic investigation revealed that, immediately after exploiting an ICS VPN appliance, UTA0576 began conducting reconnaissance, stealing credentials, and exfiltrating data. Because the operation was detected and disrupted, the threat actor’s ultimate objectives could not be determined.” Volexity continues. “However, Volexity assesses with high confidence that UTA0576’s actions signaled preparation for lateral movement and a broader compromise of the victim network.” Volexity believes with medium confidence that UTA0576 uses large language models (LLMs) to develop exploits and carry out post-exploitation activities. That’s not a certain finding, but it’s the kind of attribution detail that’s starting to appear more regularly in incident reports, and it fits the pattern of a single operator producing work that would previously have required a team. “Volexity’s forensic investigation revealed that, immediately after exploiting an ICS VPN appliance, UTA0576 began conducting reconnaissance, stealing credentials, and exfiltrating data.” concludes the report. “Because the operation was detected and disrupted, the threat actor’s ultimate objectives could not be determined.” The attackers’ motives remain unclear, but the targets suggest a possible criminal motive rather than espionage. Apply the patches immediately, and don’t assume your appliance is safe just because the Integrity Checker found no problems. This week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Ivanti Connect Secure FortiMail flaw CVE-2026-104935 (CVSS score of 8.6) to its Known Exploited Vulnerabilities (KEV) catalog. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Ivanti)
Netskope tracks four XWorm versions in the wild, 46 plugins, and new tools for location, audio and live browser control, with detections up fourfold. Netskope Threat Labs has been following XWorm since September 2024, and its latest report shows the malware has changed a lot. Over the past year the team identified four distinct versions running at the same time in the wild. Detection volume is still high, with 1,236 events across more than 100 customer organizations in the third quarter of 2026, four times the number from the same quarter in 2025. The leak fueled the surge. In June 2025, a cracked version of the XWorm builder was released publicly. In August, the source code for a modified version, 6.4, also leaked. These leaks gave XWorm more exposure and helped drive its growth. Netskope’s data shows how long the impact lasted. Detections more than quadrupled between the third and fourth quarters of 2025. In the first quarter of 2026, they reached seven times the original level and stayed there through the second quarter. Detections fell to 1,236 in the third quarter of 2026, but September alone accounted for 601, matching the monthly average during the peak in the first half of the year. The victims skew toward money. Financial services make up about 35% of affected customers, and activity is concentrated in India, Brazil, Italy, Panama and the United States. “The public leak of the V6.4 builder in mid-2025 drove this initial surge, keeping activity consistently above pre-leak baselines ever since.” reads Netskope’s analysis. “The financial services sector accounts for approximately 35% of affected customers, with activity concentrated in India, Brazil, Italy, Panama, and the United States.” Since Netskope published its report on version 6.0 in July 2025, four new versions of the malware have been discovered: V6.4, V6.5 (“XWorm Reborn”), V7.2, and V7.4. Three of these versions were released after the malware generator tool became publicly available. The number of known plugin features has also increased from 35 to 46. This includes new modules, such as SteamTokenRecovery, Rootkit, ResetSurvival, and Cmstp-Bypass, as well as several plugins that were previously removed in V6.0 but have now been brought back. Each new version includes small but significant updates: V6.4 includes file details that link it to celestialproject.org. V6.5 updates its branding link to c3lestial.fun, adds five new plugins, and introduces a built-in license check for the tool itself. V7.2 adds stronger code protection to hide its activity, uses six different tricks to avoid running in virtual analysis environments, and disguises its file details as the software Voicemod. V7.4 introduces a new file delivery system (dropper), uses a technique to bypass Windows security monitoring, switches to a new communication channel for commands, and reinstates license checks. The surveillance side is where it gets uncomfortable. Netskope says XWorm has moved from an infostealer to a full surveillance platform. Three plugins matter most: Maps, Microphone and HBrowser, and webcam capture is also available on demand. HBrowser changes how account theft works. Starting with version 6, it gives the operator a live view of the victim’s running browser, relays the operator’s mouse, keyboard and paste actions into it, and streams the screen back. The commands travel over XWorm’s usual encrypted channel and run on the victim’s machine. This creates a full remote browser session for the attacker. Because every logged-in tab remains open, the attacker can access accounts directly without needing to steal passwords or bypass multi-factor authentication (MFA). Netskope notes that this plugin grants full account access without ever extracting login credentials. The location-tracking feature bypasses the standard Windows permission prompt. It first modifies a Windows system setting to suppress consent requests, then attempts to fetch precise GPS coordinates within 15 seconds to send to the attacker. If GPS is unavailable, it falls back to IP-based location tracking. Because the modified setting remains in place, future location requests continue to bypass user permission. “XWorm continues to evolve and has now added surveillance capabilities. It can track geolocation and record the victim’s audio without requesting the victim’s permission.” continues the report. “The HBrowser plugin gives operators direct control of the victim’s live browser session, granting access to accounts without needing to exfiltrate credentials and making MFA irrelevant.” Microphone does what the name says. It captures audio from any device on the machine, with the operator choosing which one, and streams it back in half-second chunks that are compressed, encoded and encrypted, so audio reaches the operator with about half a second of delay. The microphone stays active for as long as the operator keeps the session open, and both Maps and Microphone run without privilege escalation or a visible prompt. Netskope expects more of the same. Since the builder and source code were leaked, it expects continued upgrades and use of the toolkit. Its indicators of compromise are on the team’s GitHub, and its protection flags the samples as Gen:Variant.Application.Lazy and Trojan.Generic. The key lesson for security teams is that multi-factor authentication (MFA) cannot protect accounts once an attacker has already gained access to an active browser session. This vulnerability applies to any account currently logged in on an infected computer. The HBrowser plugin clearly demonstrates this risk: from the attacker’s perspective, it provides a complete, live remote browser session with full access to open accounts. “Since its builder and source code were leaked, we expect continued upgrades and use of this toolkit. Netskope Threat Labs will continue to monitor XWorm.” NetSkope concludes. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and memory layout, and curl expects a real attack to end in a crash
Confirm this action.
Leaving now will discard your changes.