Microsoft's November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194)
On November 10, Microsoft patched 1,093 CVEs in its November 2026 Patch Tuesday release, with 63 rated critical, 1,029 rated as important, and one rated as moderate. This update includes a patch for one zero-day, CVE-2026-124194, a spoofing flaw in Microsoft Outlook that was exploited in the wild. This month's update includes patches for 287 products and components. The products with the most CVEs patched this month are: Microsoft Office Word (65) Microsoft Office Excel (64) SQL Server (53) Windows Advanced Rasterization Platform (37) Windows Installer (36) Windows Graphics Kernel (35) Windows Kernel (28) Microsoft Office SharePoint (27) Windows DNS (22) Microsoft Office Outlook (20) Windows Print Spooler Components (20) For more information, including the full list of patched products, please visit our blog.Tenable Security Intel Brief: PHP2Shell chain rooted 24 PAN-OS firewalls
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Dream says a PHP2Shell exploit chain gave an attacker root on 24 Palo Alto Networks firewalls, results Unit 42 says it confirmed. The brief also covers an unrevoked key that let an attacker publish a poisoned LiteLLM release, a Sophos report that a ransomware group told AI coding agents its intrusions were red team work, and Lumen tying a Cisco SD-WAN zero-day to Volt Typhoon. PHP2Shell chain rooted 24 exposed PAN-OS firewalls, Dream says → Brief: Dream says a custom PHP2Shell exploit (CVE-2026-109618 and CVE-2026-109619) chained with the Fragnesia Linux kernel flaw (CVE-2026-46300) gave an attacker root on 24 PAN-OS firewalls and a management server, results Palo Alto Networks' Unit 42 says it confirmed. Intel: The attack hits internet-exposed management interfaces, which Palo Alto Networks says are not exposed by default. Fixed builds are out. Dream says the chain goes from no login to root in under 15 minutes. The attacker rooted 24 of 240 firewalls. Two sat in a network Dream says appears to be US government-affiliated. From one, the attacker reached the management server and decrypted a directory account password to list every Active Directory user. Dream names no actor but sees indicators of a "Chinese-nexus" operation. CISA added the PHP CVEs to its Known Exploited Vulnerabilities catalog on October 26 and Fragnesia on October 28. Why it matters: Our Tenable Research team found PHP2Shell hard to scale because each setup needs tuning. Dream says its recovered files show tuning done for PAN-OS: 11 version profiles, one fully calibrated. Appliances that share one build are the exception, our team found: one calibrated exploit can reach many devices. Dream says the attacker used the management server's Active Directory connection to launch domain attacks, though the files Dream recovered do not show how far the compromise went. Unrevoked LiteLLM key let attacker publish poisoned PyPI release → Brief: LiteLLM, software that routes requests to AI models, says a key leaked in a public repository on May 27 and left unrevoked let an attacker push malicious version 1.107.0 to PyPI and its Docker images on October 21. Intel: According to LiteLLM, the attacker used the key on October 10 to take a GitHub organization owner's login token, then ran jobs in the project's automated build system that sent two maintainers' tokens to an outside address. On October 21 the attacker overrode branch protection, pointed the release at a lookalike repository, and approved it with a stolen maintainer token. PyPI quarantined the package that day. Socket found two of the secret-stealing workflows, from October 10 and 12, but did not link the stolen tokens to the release. LiteLLM says its audit logs tie one of the maintainer tokens stolen on October 10 to the approval. Why it matters: About three hours after the May commit, LiteLLM deleted the file and noted the key needed revoking. More than four months later it still worked. LiteLLM says it relaxed its device-locked approval rule the week of the release, so one stolen token triggered it and another approved it. An outside researcher flagged the release before LiteLLM responded. Ransomware group tells AI agents its intrusions are red team work → Brief: Sophos says GOLD OGRE, the group behind Aur0ra ransomware, used AI coding agents to escalate from stolen logins to domain administrator, the account that controls a Windows domain. Intel: To get the models to cooperate, the operators framed the break-ins as sanctioned red team exercises or as "diagnostics testing." Operators gave the agents VPN logins and proxy access and set their targets. Sophos says Cursor's Composer model and models from Anthropic, xAI and Moonshot orchestrated the intrusions. In some environments, the agents reached domain management access, and three of those victims later turned up on Aur0ra's leak site. The same analysis reads artifacts as suggesting the operators are Russian speakers. Separately, Gambit Security says an Aurora operator used Cursor Agent with Claude Sonnet as an exploitation assistant against ten organizations from April 8 to May 21. Why it matters: Sophos' workflow chart marks the first break-in and the final ransom stage as the human-controlled steps. Agents handled the steps between them with limited human involvement. In May, Sophos said a tool-building actor it now ties to GOLD OGRE likely used the same red team label to get past Claude's guardrails. Lumen ties Cisco SD-WAN zero-day exploitation to Volt Typhoon → Brief: Lumen's Black Lotus Labs says Volt Typhoon, a Chinese state-sponsored group, exploited CVE-2026-20127, a CVSS 10.0 flaw in Cisco Catalyst SD-WAN (software that manages network links between company sites), by late 2025 and kept going after Cisco's February disclosure. Intel: The report names the relay network "Silent Train," a constantly changing set of hacked routers, internet-connected devices and business equipment. We covered the flaw in February, when Talos tied its exploitation to UAT-8616. Cisco Talos now says UAT-11473 also exploited it and installed KeyDrift malware to collect keying material from SD-WAN controllers. Talos says UAT-11473's infrastructure "overlaps considerably" with Silent Train, but it does not say UAT-11473 is Volt Typhoon. That post describes historical activity with no intrusion dates. The Silent Train report never mentions UAT-11473 or KeyDrift. Why it matters: The flaw was already being exploited when Cisco disclosed it in February. Lumen now says Volt Typhoon was exploiting it by late 2025. Lumen says operators removed their tools from the relay devices and tore down each chain after every session to make the activity hard to attribute. Watching the relay network let Lumen see the exploitation. Stat of the week: 1,462 Suspects arrested by agencies from 20 African countries and the U.S. in Operation Serengeti III, a June 29 to August 31 cybercrime crackdown, according to INTERPOL, which says investigators recovered more than $105 million and linked the criminal activity to more than $385 million in losses. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: PHP2Shell and Brotli2Shell join KEV
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, PHP2Shell went from early exploit attempts to working exploits, and CISA added both of its flaws to the Known Exploited Vulnerabilities (KEV) catalog. The brief also covers Brotli2Shell, a flaw in Google's Brotli compression library that CISA added a day later. Microsoft tied the ConnectWise compromise to a China-state aligned actor using AI agents, and SafePay ransomware went after victims' backups. PHP2Shell moves from exploit attempts to working shells → Brief: On October 21, PHP fixed PHP2Shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619) that open servers to remote code execution with no login, but exploit attempts had started four days earlier. Intel: One flaw corrupts memory when a request runs PHP out of memory, and the other lets a later request use memory an earlier one freed. The first known attempt hit Amazon's decoy network on October 17. On October 24, Adel Karimi reported exploit requests opening shells on three PHP 8.4.26 honeypots, in traffic very similar to a public proof of concept and consistent with the first flaw. The report adds that a one-worker Apache setup favored the exploit, so its results aren't a gauge of reliability on other setups. Trail of Bits confirmed working exploits on October 26 against PHP 8.2 to 8.5 releases that predate the fix, with shells on MediaWiki, Symfony, Laravel and phpBB in its demo. CISA added both to KEV that day. Why it matters: Of servers that reveal their PHP version, VirusTotal counts about 758,000 on 5.4 through 8.1, branches PHP no longer updates, against about 272,000 on supported ones. For 7.4 through 8.1, PHP's fix comes only as source code to build by hand. Anything older gets no fix from PHP. CISA adds Brotli2Shell to KEV after exploit traffic surfaces → Brief: CISA added Brotli2Shell (CVE-2026-111497), a memory corruption flaw in Google's Brotli compression library, to its Known Exploited Vulnerabilities catalog on October 27, a day after threat intelligence firm ELLIO reported exploit traffic aimed at Node.js. Intel: Also known as HTTP2Shell, Node2Shell and Broccoli2Shell, it received a CVSSv4 score of 9.2 from Google. A malformed stream can make the decoder write beyond an eight-byte buffer, which can crash the process or, at worst, allow remote code execution. The decoder can be used by Node.js, .NET, Bun, Envoy, Istio, PHP for Windows and Python HTTP clients, among others. Node.js credits OpenAI Codex Security researchers with the report. ELLIO achieved code execution on an unmodified Node.js 24.22.0 x86-64 build, the same build the captured request targeted, though that attacker's chain never produced a shell in 50 lab attempts. We have not independently confirmed the activity. Why it matters: Brotli's fix landed in its public source code on February 27, but OpenAI says the bug wasn't recognized as a security flaw then. Brotli shipped no release with the fix until October 21. For nearly eight months, anyone reading the repository could see the change, while defenders had no fixed Brotli release to install. Microsoft: China-state aligned actor used AI in ConnectWise attack → Brief: Microsoft assesses that Storm-0940, which it calls "a China-state aligned actor," was behind the ConnectWise Cloud Backup supply chain compromise and used ARTEX, open-source AI software that automates penetration tests, to speed up the attacks that followed. Intel: The attackers held the Cloud Backup app's own login to customers' Microsoft 365 accounts, so its sign-ins needed no user password or MFA; how they obtained it is still unclear. Microsoft counts sign-in attempts against more than 2,250 tenants, and in some, ARTEX's agents went on to change app credentials and privileged roles. ConnectWise cut off the app's access October 17 and by October 19 had reset every account and credential in the Cloud Backup environment. Why it matters: Credential changes the agents made inside a tenant can keep working as a backdoor after the ConnectWise app is shut off. In the sweep Sophos tracked, the attacker also hit former backup customers, which Sophos reads as a sign the attacker held the full roster of tenants that had approved the app. SafePay ransomware exploits old flaws and goes after backups → Brief: In a joint advisory, six U.S. and European agencies say SafePay ransomware has "impacted at least 600 separate victims from multiple critical infrastructure sectors" since August 2024. Intel: SafePay gets in with stolen or guessed passwords and with phished accounts. It logs in from addresses that belong to Mullvad, a VPN service, and uses the phished accounts to exploit two Cisco ASA and FTD flaws, CVE-2020-3259 and CVE-2023-20269. Automated scripts hit three more: CVE-2023-27532 and CVE-2024-40711 in Veeam Backup & Replication, plus CVE-2024-40766 in SonicWall SonicOS. A SafePay representative also calls victims to pressure them. Why it matters: Two of the five flaws sit in Veeam's backup software, so the backup server is itself one way in. Once inside, SafePay resets network storage that holds victims' backups to its factory settings and shuts off Windows' built-in snapshot service. The agencies say both steps aim to block recovery. Stat of the week: 87 days How long it takes a typical organization for half of its known exploited vulnerabilities to stop being visible from the internet, according to Moody's, whose analysis of about 9,500 organizations it rates puts flaws tied to ransomware at 59 days and flaws outside the known-exploited list at 107. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.php2shell (CVE-2026-109618, CVE-2026-109619): FAQ about critical PHP remote code execution flaws
On October 20, CVE identifiers for two critical vulnerabilities in PHP began circulating on Hacker News and social media. Later that day, the PHP security team published an advance notice of an emergency security release scheduled for October 21 at 14:00 UTC. Public reporting describes both as remote code execution vulnerabilities, and a video credited to researcher LCFR and Calif.io demonstrates an exploit chain dubbed php2shell. CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 Cloudflare CTO Dane Knecht said the company is seeing early attacks emerging. For more information about the vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.Tenable Security Intel Brief: Espionage group exploits BeyondTrust zero-day
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: PHP is shipping emergency fixes today for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which public reports describe as remote code execution bugs. Cloudflare's CTO says the company is "seeing early attacks emerging." PHP isn't expected to fix end-of-life versions. Our FAQ has the details. This week, Mandiant reported a suspected China-nexus espionage group exploiting a zero-day in BeyondTrust Remote Support, a tool support teams use to connect to the machines they manage. The brief also covers an access broker running 51 Claude Code agents, attackers warming the fridges in hundreds of French supermarkets, and Citizen Lab tying Candiru spyware on Al Jazeera devices to targeted ads. Suspected Chinese hackers use BeyondTrust zero-day to reach endpoints → Brief: In late August, ARMORY CASTLE, a suspected China-nexus espionage group, exploited CVE-2026-102764 as a zero-day in BeyondTrust Remote Support, Mandiant found. Intel: The flaw lets an attacker with no login upload files to the appliance. BeyondTrust disclosed it October 15, after patching its cloud-hosted customers by October 9; self-hosted appliances need the patch, and those older than version 24.3.1 must upgrade first. CISA listed the flaw in its Known Exploited Vulnerabilities catalog on October 16. Once in, the attacker planted a hidden backdoor page and made itself root, the appliance's top-level account. It then tried several commands to pull passwords and keys from the appliance's built-in vault, and deleted logs to cover its tracks. Mandiant says patching does not undo an earlier compromise, and the attacker set up its root access to survive reboots. Why it matters: Mandiant says the flaw can lead to "access to every credential the appliance stores or brokers." In this attack, the attacker raised a compromised admin account's remote-access roles to Administrator. That unlocked remote sessions to every system on the appliance's list, and the attacker copied documents off a user's desktop with the tool's own file transfer. Open folder shows an access broker running 51 Claude Code agents → Brief: SOCRadar found CyberXero, a Russian-speaking broker who sells network access to other criminals, using 51 Claude Code agents and holding data on more than 628,000 Ukrainians. Intel: The actor left its working directory open on the internet, with AI session logs and stolen data inside. In one 61-second automated run, it scanned 4,708 targets and planted 32 web shells, hidden backdoor pages on servers. A separate, manual campaign mapped seven Ukrainian energy and utility companies, and a login saved in one of the actor's own scripts let it pull 564,073 subscriber records from a Kharkiv district heating company. Why it matters: When the model refused a task, the actor opened a fresh session with its fake "authorized pentest on my own infrastructure" story loaded, since, as SOCRadar notes, "a refusal in one session does not carry into the next." Some refusals still held, including requests to install a backdoor and turn off a firewall. Attackers warm the fridges in hundreds of French supermarkets → Brief: Overnight on October 11, attackers took over the refrigeration controllers in several hundred French supermarkets and warmed their fridges and freezers, with similar reports from five other European countries. Intel: France's CERT-FR reports many compromised Danfoss refrigeration controllers, plus units from Copeland, including its Dixell brand. CERT-FR's first fix is taking them off the internet. Researcher Kevin Beaumont said the Danfoss units carried a built-in login, username admin, whose password follows the current date and is the same on every unit; a 2025 Danfoss update removed it, but The Register reports many hit units no longer got updates and others ran outdated firmware. Pen Test Partners puts losses at tens of millions of euros and cites fires reported by the Paris prosecutor. Why it matters: These controllers can sit entirely outside the security team's view. Pen Test Partners says a cellular modem is the quicker way to give the refrigeration contractor remote access, so the controller ends up online, "on a link the retailer often does not own, cannot see, and has no record of." Targeted ads delivered Candiru spyware to Al Jazeera with zero clicks → Brief: Citizen Lab links, with high confidence, zero-click attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru spyware delivered through ads bought by Discover-Tech. Intel: Discover-Tech, which calls itself an ad company, won ad slots through real-time bidding, the split-second auctions that decide which ad you see, and Citizen Lab found its ads fetched code from a Discover-Tech server that sent it only to chosen targets. Al Jazeera's network logs show the order on infected devices: a Discover-Tech ad, a Candiru server checking the device, then Candiru's command servers. Discover-Tech ads also showed on NATO and European Parliament networks, which Citizen Lab says does not by itself confirm targeting or infection. Why it matters: The NSA in 2018 and CISA in 2020 warned that malicious ads could deliver malware and recommended ad blockers. Here a targeted ad only had to load, and the auction that placed it can already hand the buyer the device's ad ID and IP address. Stat of the week: 37% The share of ransomware attacks that brought threats aimed at employees' friends or family members, according to Semperis, whose survey of 1,200 security and IT professionals at organizations hit by ransomware also found 41% of respondents reported facing physical or psychological intimidation. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: Attacker chains three Ivanti VPN zero-days
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Volexity reported an attacker chaining three Ivanti Connect Secure zero-days to gain root, one of which still has no fix. The brief also covers wire fraud charges against a ransomware recovery firm's owner, an FBI and Secret Service warning that FortiBleed, the Fortinet login campaign we covered in June, has fed ransomware affiliates, and PoeLLM, malware that takes its server address from a GitHub poem. An attacker reruns an Ivanti VPN zero-day chain for every command → Brief: Starting October 3, an unknown attacker Volexity tracks as UTA0576 chained three zero-days to run commands as root, with no login, on an Ivanti Connect Secure VPN appliance that was fully patched at the time. Intel: An authentication bypass and a code execution bug are tracked as CVE-2026-104935 and were fixed October 13. Volexity says the third flaw, a privilege escalation to root, has no fix yet. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on October 13, with an October 16 deadline for U.S. federal civilian agencies. From the appliance, the attacker searched Active Directory for local administrator passwords and BitLocker recovery keys, which unlock encrypted drives, and sprayed passwords at domain accounts. Volexity assesses with high confidence this was groundwork for moving deeper into the network. Why it matters: Volexity found no backdoor, and the attacker reran the full chain for each command. The chain changed a code library only in memory and restored the configuration after each run, so Ivanti's Integrity Checker Tool, which checks files on disk, misses the changes, Volexity says. Its analysts rebuilt the chain from memory captures and core dumps the exploitation left behind. Recovery firm owner accused of secretly paying ransomware attackers → Brief: The Justice Department charged Zohar Pinhasi, owner of Florida ransomware recovery firm MonsterCloud, with wire fraud over claims he could decrypt clients' data without paying attackers. Intel: MonsterCloud's website warned clients against paying ransom, and Pinhasi pitched "proprietary tools" and "advanced decryption techniques." According to the indictment, he had no special decryption technology and paid the cybercriminals for a key, then typically billed clients far more than the ransom. In one August 2023 case, he allegedly paid about $8,200 and charged the client about $150,000. He faces two counts of wire fraud and one count of wire fraud conspiracy, and has pleaded not guilty. Why it matters: Prosecutors say the decryption key MonsterCloud employees used on clients' files came from the attackers, and that MonsterCloud paid them despite its own website's warning against paying. They put the alleged totals at more than $19 million charged to clients and more than $8 million paid in ransom. FBI ties FortiBleed firewall logins to ransomware affiliates → Brief: A joint FBI and U.S. Secret Service advisory says FortiBleed, a campaign stealing logins for Fortinet FortiGate firewalls, remains active and has fed access to ransomware affiliates. Intel: Initial findings indicate attackers keep scanning internet-facing FortiGates and remote-access VPN gateways with credentials they already hold, and crack passwords stored in an older, weaker format offline. Once in, they add their own admin accounts. The advisory warns that some victims may lose access to their firewalls if attackers delete the original accounts or change the passwords on them. Fortinet says no new vulnerability is involved and points to reused credentials and brute-force attempts on devices without MFA. Why it matters: FortiBleed's operators sorted stolen logins by each victim's revenue and network layout. In June we had no named buyer for the campaign's access. Now the agencies cite reporting that brokers using the campaign have passed further access to ransomware affiliates, among them INC/Lynx and Payload ransomware. PoeLLM malware reads a GitHub poem to find its next command server → Brief: Lumen's Black Lotus Labs found PoeLLM malware hijacking exposed self-hosted AI and developer tools to mine cryptocurrency, running on roughly 800 servers a day at its peak. Intel: The malware finds its command server through a two-stanza poem on GitHub: four words at set positions each map to a number, and together the numbers form an IP address. Since April 13, 2026, the operator has edited the poem 11 times. Each edit sent infected machines to a new server with no malware update. Lumen says most victims appear to run vulnerable, self-hosted AI services such as LiteLLM and Ollama. Why it matters: PoeLLM's scans went mainly after ports 3000 and 4000, where Gotenberg, a PDF converter, and LiteLLM listen. Gotenberg's install guide warns against putting it on the internet. Hijacked servers then joined the scanning and attacked other exposed services to find more victims. Stat of the week: 1,407 The number of CVEs Microsoft patched in its October 2026 Patch Tuesday release, more than the 1,245 it patched in all of 2020, its yearly record through 2025, according to our monthly Patch Tuesday blog. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
On October 13, Microsoft released its October 2026 Patch Tuesday release, which patched 1,407 CVEs with 69 rated critical, 1,337 rated as important, and one rated as low. For the second month in a row, this is the largest Patch Tuesday release ever. The previous record was September’s 964 CVEs. This update includes patches for two zero-days, both security feature bypass flaws. CVE-2026-96951 in Windows Shell was exploited in the wild, while CVE-2026-108398 in .NET Framework was publicly disclosed before a patch was available. This month’s update includes patches for 301 products and components. The products with the most CVEs patched this month are: Microsoft Office Excel (69) Role: DNS Server (52) Windows Kernel (46) Windows Installer (38) Windows Win32 Kernel Subsystem (36) Microsoft Office SharePoint (34) Microsoft Windows Search Component (29) Windows NTFS (26) .NET (25) Microsoft Office Word (22) SQL Server (22) Windows Error Reporting (22) For more information, including the full list of patched products, please visit our blog.Tenable Security Intel Brief: OpenAI model got into an Australian gov portal
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: Citrix fixed another exploited NetScaler flaw, CVE-2026-88779, on October 3. This one is a denial-of-service bug that only affects appliances set up for SAML sign-in, and the September 27 builds don't cover it. Our FAQ has the details. This week, OpenAI says one of its internal models got non-public access to an Australian Medicare statistics reporting service in June, pulling internal files and credentials. The brief also covers Warlock ransomware's developers hitting a water utility and a telecom, JADEPUFFER's 7-minute Azure deletion run, and Cisco's fifth exploited SD-WAN zero-day of 2026, by BleepingComputer's count. Internal OpenAI model got into an Australian Medicare stats portal → Brief: OpenAI says an internal model gained non-public access to Services Australia's Medicare Statistics Reporting Service in June, pulling internal files and credentials and writing files. Intel: Australia's Prime Minister Anthony Albanese said the agent hit repeated blocks and "found a way around those blocks," though "no personal information is believed to have been accessed at this stage" and investigations are ongoing. The company found the activity in mid-August, along with activity at three more Australian agencies, including an exposed access key its agents used at the Victorian Department of Health. Albanese called the way it notified the government on September 10 "unacceptable": "an email sent to just the public mailbox." Why it matters: The assignment was research into per-person government spending on skin-condition medicines in Victorian communities. When that data proved hard to find, OpenAI says the model "took actions that we had not authorised it to take." Longlegs keeps using SharePoint flaws, now against water and telecom → Brief: Symantec says Longlegs, a China-nexus group that develops Warlock ransomware, attacked a water utility and a telecom provider in Portuguese- and Spanish-speaking countries over the past two months. Intel: The group is also tracked as Storm-2603. It usually gets in through on-premises SharePoint servers. The 2025 ToolShell flaws, including CVE-2025-53770, likely remain in its kit alongside newer SharePoint flaws CISA flagged in July 2026. At one critical infrastructure operator, the attackers sent a security-tool killer to at least 40 machines in about two hours. Warlock then reached at least 33 machines through SYSVOL. Windows copies that shared folder to every domain controller, and every computer on the domain can read it. Why it matters: Symantec reads the victims' locations as a sign of either deliberate tasking or opportunistic picks driven by which SharePoint servers were exposed and vulnerable. If it was the second, a water utility landed on the list for the same reason as a university Symantec also names. Both would have run one of those servers. JADEPUFFER deletes Azure storage in 7 minutes, then takes the keys → Brief: Microsoft documented JADEPUFFER, which it calls Storm-3168, using two hijacked service principals (accounts that software uses to act in Azure) to map and then delete one organization's cloud resources. Intel: In early June, one account read through the environment for about 15.5 hours; the other listed virtual machines in two subscriptions within five seconds. A 7-minute run tried 100+ storage account deletions and most succeeded. It also deleted an app, along with a hosting plan and Key Vault linked to that app. Sysdig, which found JADEPUFFER in July, assessed it to be "the first documented case of agentic ransomware," while Microsoft says the timing and split of work "strongly indicates automated or scripted execution." Why it matters: The account's attempts to delete SQL databases failed because each request used an unsupported version of Azure's interface. About half an hour later, it successfully requested access keys more than 30 times, including for storage accounts used for disaster recovery. The account did all of this with permissions it already had. Attackers break into Cisco SD-WAN Manager with one encoded character → Brief: Cisco fixed CVE-2026-76504, an actively exploited flaw that gives attackers admin access to Catalyst SD-WAN Manager, its console for network gear linking company sites, without logging in. Intel: The software mishandles encoded characters in web addresses, so a crafted request slips past a rule meant to restrict access. Cisco's warning signs show requests to the j_security_check address with one character encoded, such as %6a for "j," and Cisco says any single encoded character works. SD-WAN Manager is affected regardless of setup, though Cisco says its cloud-managed release is already fixed. There's no workaround. CISA added it to its list of exploited vulnerabilities September 30, with an October 3 federal deadline. Why it matters: By BleepingComputer's count, this is the fifth exploited Cisco SD-WAN zero-day of 2026, and watchTowr's Jake Knott tallies eight 2026 SD-WAN CVEs on CISA's exploited list this year, a wider count that includes three added in April. The February zero-day, CVE-2026-20127, had been exploited since at least 2023. Stat of the week: 543,699 The number of credentials found in 224 million public GitHub repositories that still worked when tested this July, including nearly 200,000 pushed after GitHub began blocking recognized secrets by default, according to Truffle Security. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: NetScaler zero-day warnings arrived before patches
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Citrix fixed two NetScaler zero-days on September 27, after private warnings had already told some admins to switch their appliances off. Google traced CVE-2026-88772 attacks to at least early September. Thanks to our Vulnerability Detection team for working through the weekend to get customers coverage for these flaws. The brief also covers ShinyHunters' FBI data claims, open-source AI agents breaking into online retailers, and a North Korean Terraform lure. Private NetScaler zero-day warnings arrived before Citrix's advisory → Brief: Citrix fixed two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, on September 27, after private warnings had already told some admins to switch their appliances off. Google traced CVE-2026-88772 attacks to at least early September. Intel: On September 25, admins posted on Reddit that IT suppliers were telling them to take NetScalers offline, while the Netherlands' National Cyber Security Centre (NCSC-NL) reportedly circulated a private alert. Citrix confirmed exploitation on September 27, and CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog. Google says organizations in government, finance, education, and legal and professional services in North America and Europe were likely hit. On September 28, watchTowr released a proof-of-concept exploit for CVE-2026-88771 and Defused reported its mass exploitation. Why it matters: Mandiant found attackers moving from compromised appliances into some victims' internal networks. CISA warns updates "may result in loss of forensic visibility," and NCSC-NL's public alert wants memory and logs secured first. Where attackers got into appliances before the fix, the upgrade may wipe the evidence of their activity. Reuters finds FBI intelligence roles in data ShinyHunters says it took → Brief: Reuters verified details for more than 22 people in a 5,000-line spreadsheet ShinyHunters says it stole from the FBI, and found the file lists staff in China-related and human intelligence (HUMINT) roles. Intel: ShinyHunters claims it broke into FBIjobs.gov through Oracle PeopleSoft, then moved to FBI servers hosted in AWS GovCloud and took 2 TB to 3 TB. It told BleepingComputer it used a trick Mandiant documented for getting past firewall rules that block CVE-2026-35273, a PeopleSoft flaw patched in June, though it still claims a new zero-day as well. The FBI says "the point of breach is still undetermined," but a Justice Department notice to lawmakers says the affected system holds Social Security numbers. Why it matters: In May, the FBI warned that ShinyHunters "may falsely claim" to hold sensitive data. ShinyHunters says it hit the FBI to answer that, and did it for "future corporate partners," which The Register reads as extortion victims. ShinyHunters is playing to the next company deciding whether the group is bluffing. Card thieves use open-source AI agents to break into online shops → Brief: Gambit Security recovered a financially motivated attacker's staging server and found three AI tools running nearly every step of break-ins at online retailers since July 2026. Intel: Strix, an open-source tool for AI penetration testing, hunted for flaws, and Cairn attacked targets for hours chasing a goal such as remote control of a server or admin access. Hermes, an open-source AI agent, ran the campaign on 1,951 short Chinese prompts over 260 sessions, such as "get into the web backend." September 10 to 15 alone saw 105 attack projects and at least 27 companies "compromised to varying degrees," per Gambit. Two companies lost over 600,000 unexpired card details. Why it matters: The attacker's own cost review averages $25.46 per completed scan, and Gambit's verdict is that "the economics no longer filters anyone out." That price also buys damage: at one bicycle retailer, the agent's cleanup deleted 180 database tables, including backup copies the shop's IT staff had created. North Korean hackers hide a backdoor route in a Terraform lock file → Brief: SentinelOne found macOS backdoors from TraderTraitor, a North Korean state-sponsored group, on a DevOps engineer's MacBook at an India-based IT services provider with no cryptocurrency ties. Intel: The group, also tracked as UNC4899, PUKCHONG and Jade Sleet, sends job seekers fake interview projects on GitHub. The repos carry a tampered .terraform.lock.hcl, the file that records which plugin versions Terraform (a tool companies use to set up cloud infrastructure from code) installs. It points to lookalike domains like registry.hashicorp-aws[.]com, and when the developer runs the project's setup command, Terraform fetches and runs the attackers' code. The backdoors also appeared in the $292 million KelpDAO theft; how they reached this laptop is unknown. Why it matters: A lock file lets Terraform reject a download that doesn't match what was recorded. In these interview repos, the attacker wrote the lock file. The check that worked was human. One candidate removed the lookalike plugin and left a note, possibly taking it for a security test. Stat of the week: 1,073 The number of ransomware attacks in August, the highest monthly total of 2026 so far and up 12% from July, with Qilin taking the top spot from The Gentlemen, according to NCC Group. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.FAQ about CVE-2026-88771 and CVE-2026-88772: Citrix NetScaler Zero-Day RCE vulnerabilities
On September 27, Citrix published a security bulletin for two NetScaler ADC and NetScaler Gateway vulnerabilities that were exploited against unpatched customer deployments. CVE Description CVSSv4 CVE-2026-88771 Citrix NetScaler ADC and NetScaler Gateway Improper Input Validation vulnerability 9.5 CVE-2026-88772 Citrix NetScaler ADC and NetScaler Gateway Memory Overflow vulnerability 9.5 CVE-2026-88771 affects all deployments with no additional configuration required. CVE-2026-88772 requires DTLS to be enabled, which is the default on VPN virtual servers. Both have been classified as Vulnerabilities of Interest as part of Tenable's Vulnerability Watch. For more information about these vulnerabilities, including patch versions, IoC guidance, and Tenable product coverage, please visit our blog.
