We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft Patch Tuesday security updates for October 2026 address a record 1,415 vulnerabilities, including a zero-day under active attack. The flaw, tracked as CVE-2026-96951, is a Windows Shell command injection vulnerability that allows an unauthorized attacker to bypass security protections over a network. Exploitation can evade Mark of the Web (MOTW) defenses, which help protect users from potentially dangerous files downloaded from the internet. Microsoft confirmed that the flaw is being actively exploited. “An attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses.” reads the advisory. “In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability. In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker’s site or send a malicious attachment.” According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 16, 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8.6), to its Kev Catalog. The vulnerability is an authentication bypass issue caused by spoofing in ICS versions before 25.1.3.0 that could allow a remote, unauthenticated attacker to execute arbitrary commands. ICS versions 22.7R2.14 and earlier are not affected. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group’s operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. Famous Chollima (a.k.a. WageMole) is commonly tracked as a North Korean threat actor associated with fraudulent IT-worker schemes that generate revenue for the DPRK regime. Because North Korea is subject to extensive international sanctions, its operatives seek technology jobs at companies worldwide, often using stolen, rented, or fabricated identities. In some cases, they also attempt to compromise employers’ networks to steal sensitive data, deploy malware, or obtain cryptocurrency and other assets. As part of an operation in Texas codenamed “Lonestar Roundup,” the FBI searched 40 residences suspected of hosting laptop farms between September 21 and 25.
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to halt wallet sales and remove products from shelves while it investigates hardware implant incidents. The company announced the decision in response to discovering that devices purchased from CryptoBilis had been modified to steal seed phrases used to access crypto assets and send them to an unauthorized party over an LTE connection. Ledger sells physical cryptocurrency wallets that securely store private keys used for managing and authorizing digital asset transactions. Following reports of cryptocurrency losses from multiple users, Ledger launched an investigation on October 9 and confirmed that some devices sold by CryptoBilis had been tampered with. Yesterday, Ledger’s Donjon security arm shared more details about the hardware implant found inside devices from the reseller , largely confirming earlier reports by Mark Karpelès and Tibane Labs.
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. Tracked as CVE-2026-76519, this vulnerability stems from a relative path traversal weakness in SEG's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. Threat actors can exploit this issue by sending an email with a maliciously crafted attachment through an unpatched device. "A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system," Cisco said in a Wednesday advisory. "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." CVE-2026-76519 affects SEG instances where the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.
Microsoft Patch Tuesday security updates for October 2026 address a record 1,415 vulnerabilities. Prioritize the exploited zero-day, critical bugs and potentially wormable vulnerabilities. Microsoft just shattered every patch record in the book. October 2026 brought us a staggering 1,415 new CVEs from Microsoft alone. “Well, it’s a new record release from Microsoft, again. This is also the first four-digit volume we have ever seen and includes six-digit CVEs. As always, counting this load is tricky, but I see 1,415 new CVEs from Microsoft. That puts this month at a greater volume than any previous YEAR from Microsoft. I’m starting to think I don’t like this new normal.” states ZDI. “As for the products affected by this release, we have Windows and Windows components, Office and Office Components, Developer Tools and .NET, SharePoint, Linux kernel, Skype for Business and Microsoft Lync, SQL Server and Dynamics, Azure and cloud services, and Exchange server.” This is the first time Microsoft has reported more than 1,000 vulnerabilities in a single month. To help security teams handle this huge number of flaws, Microsoft introduced “risk cohorts” to group related vulnerabilities, similar to the old security bulletin system. AI is clearly helping researchers find bugs faster, both for attackers and defenders. The good news is that vulnerabilities are still being discovered faster than attackers are exploiting them. Security teams should focus on the most serious threats first instead of trying to patch every low-risk flaw at once. Instead, focus immediately on what’s actively burning in the wild. The single zero-day under active attack this month is CVE-2026-96951, a Windows Shell security feature bypass used to dodge Mark of the Web protections. “An attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses.” reads the advisory. “In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability. In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker’s site or send a malicious attachment.” Other high-priority threats include a critical unauthenticated SharePoint privilege escalation bug (CVE-2026-102866), a high-scoring SQL Server remote code execution flaw (CVE-2026-65674), and a massive wave of 59 potentially wormable vulnerabilities spanning core network services like DHCP, Remote Desktop Gateway, and DNS. Below are the descriptions for the above issues: CVE-2026-96951 (CVSS score of 8.8) is a Windows Shell command injection vulnerability that allows an unauthorized attacker to bypass security protections over a network. Exploitation can evade Mark of the Web (MOTW) defenses, which help protect users from potentially dangerous files downloaded from the internet. Microsoft confirmed that the flaw is being actively exploited. CVE-2026-102866 (CVSS score of 8.1) is a Microsoft SharePoint Server vulnerability caused by improper verification of cryptographic signatures. It allows an unauthenticated attacker to elevate privileges over a network, potentially gaining unauthorized access to sensitive information or modifying data. CVE-2026-65674 (CVSS score of 8.8) is a Microsoft SQL Server remote code execution vulnerability caused by the deserialization of untrusted data. An authorized attacker with the required privileges could exploit the flaw over a network to execute code on the affected server. “I may be wrong about some of these – there are a few where the description is somewhat…er…ambiguous, but regardless, this number of wormable bugs in 2026 should cause some level of concern. Not panic.” concludes ZDI. “There’s no need for that, but it is disconcerting to see this many juicy targets sitting out there. Please do your best to test and deploy these fixes in a timely manner.” Prioritize the proven, public, and exploited flaws first, and take a deep breath before diving into the rest of the patch mountain. Make sure your operational priorities remain laser-focused on real risk rather than chasing vanity metrics. Make every effort to test and apply these patches as soon as possible. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Patch Tuesday)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. Tracked as CVE-2026-104935, this high-severity authentication bypass vulnerability lets remote threat actors without privileges execute arbitrary commands on targeted ICS systems in low-complexity attacks that don't require user interaction. Ivanti released ICS versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 on Tuesday to address this security flaw and warned customers to "act immediately" because of "limited exploitation in the wild." While Ivanti didn't share additional information about ongoing attacks targeting CVE-2026-104935, cybersecurity firm Volexity reported that an unknown threat actor it tracks as UTA0576 has been chaining this security issue with two other flaws in attacks since at least October 3rd.
Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled.
Confirm this action.
Leaving now will discard your changes.