All Articles

TL;DR for CISOs: Cisco confirmed attacks on a critical Secure Email Gateway flaw, Palo Alto Networks fixed an exploited PAN-OS management interface zero-day, Microsoft and Health-ISAC disrupted phishing kits tied to more than one billion messages, and attackers backdoored Nextcloud servers through the Collabora CODE app.

Lead story: Cisco Secure Email Gateway flaw CVE-2026-76519 is exploited for root access

What happened

Cisco published the advisory this week and confirmed attacks against the email gateway, a device that sits in the path of inbound mail. The fixed software had been available since September 14, so the exploitation window overlaps a period when a fix existed.

The Hacker News reports Cisco's own check is a log search for "System Security" entries on each cluster member, and that a clean result does not rule out compromise. Cisco's guidance for confirmed compromise on virtual appliances is to preserve forensic data, deploy a new VM on a fixed release, rebuild configuration without importing old files and renew credentials and cryptographic material.

Evidence

Verified against independently fetched sources:
1. The Hacker News, Cisco warns of active attacks on a critical Secure Email Gateway flaw
2. SecurityWeek, Cisco warns of exploited Secure Email Gateway vulnerability

What this means for your team

An email gateway sees every inbound message and usually holds directory and mail-flow credentials. Root on that box is a position from which to read mail, pivot to identity systems and tamper with the logs that would show it.

The timing is the planning lesson. A fix existed for about a month before the advisory described attacks. Treat the date a patch ships as the start of your exposure clock for internet-facing appliances, not the date the vendor publishes an advisory.

Two exploited flaws in the same product within a month is a pattern worth a line in your risk register, even though Cisco has not tied them together.

Action checklist

1. Inventory every Secure Email Gateway, including virtual and cloud-managed units, and record both the AsyncOS release and the Content Scanner Tools version. Check whether File Reputation is enabled in any mail policy.
2. Install Content Scanner Tools 25.3.0.5525 or later now. It is the fastest fix and, per The Hacker News, needs no restart. Migrate any release 16.0 gateway to a fixed build.
3. Run Cisco's log check on every cluster member, then review firewall and network logs for unexpected traffic to and from external addresses, because root access may have altered local logs.
4. If compromise is suspected, preserve forensic data and rebuild virtual appliances on a fixed release. Send physical devices to Cisco TAC, and renew credentials the gateway held.

Palo Alto Networks fixes PAN-OS management interface zero-day CVE-2026-0322

What happened

Palo Alto Networks published the advisory for a flaw it says it found internally and has seen used in limited attacks. The vulnerable component is the management interface, not the traffic-handling data plane.

The vendor's required privilege level means the flaw matters most where management access or administrator credentials are reachable. The advisory does not describe how the observed attacks obtained access.

Evidence

Verified against independently fetched sources:
1. Palo Alto Networks, CVE-2026-0322 security advisory
2. SecurityWeek, Palo Alto Networks patches PAN-OS zero-day exploited for remote code execution
3. The Hacker News, Palo Alto Networks patches PAN-OS authenticated RCE flaw amid active exploitation

What this means for your team

With no workaround, the one control you own before patching is who can reach the management interface. If it is reachable from the internet or from broad internal ranges, the patch is only part of the fix.

CISA listed this flaw and the Cisco flaw with the same federal deadline. If your remediation tiers follow KEV dates, both belong in the same sprint this week, owned by whoever runs perimeter infrastructure.

Action checklist

1. List every PAN-OS firewall and Panorama instance, then map each version to the advisory's fixed builds and confirm the build is released before scheduling.
2. Confirm the management interface is reachable only from a small set of trusted addresses, ideally through a single jump host.
3. Review management logins, administrator account changes and configuration commits, and search for the three addresses in the advisory.
4. Where SSL decryption is in place, enable Threat IDs 510046 and 510047, and treat them as partial coverage.

Microsoft and Health-ISAC disrupt phishing kits tied to more than one billion messages

What happened

Microsoft announced the action on October 14. The investigation began in late 2025 after Japan's National Police Agency raised campaigns targeting people in Japan. Health-ISAC joined the civil case because the infrastructure was repeatedly used against hospitals and healthcare organizations.

The notable detail is the supply chain. The marketplace sold access to real cloud tenants and storage, so many of the phishing links came from legitimate-looking infrastructure.

Evidence

Verified against independently fetched sources:
1. SecurityWeek, Microsoft disrupts Chinese-language phishing market behind 1B+ messages
2. The Hacker News, Microsoft and partners disrupt three phishing kits tied to over one billion scam messages

What this means for your team

A takedown raises the cost for the operators but does not remove the demand. When stolen tenants are a product, your cloud tenant can be either a target or a free hosting platform for someone else's phishing.

Filtering on sender reputation is weaker against mail and links that originate from real Microsoft or Google tenants. Identity controls and tenant monitoring carry more of the load.

Action checklist

1. Review third-party application consents and Microsoft Graph permissions in your tenant, and remove any you cannot tie to a business owner.
2. Check for unusual SharePoint and OneDrive sharing and for mass outbound link activity from your own accounts.
3. Require phishing-resistant authentication for administrators and anyone with tenant-level roles.
4. If you are in healthcare, share what you find through Health-ISAC. Peers in other sectors can compare notes in the CISO Platform community.

Attackers backdoor Nextcloud servers through the Collabora CODE app, CVE-2026-110447

What happened

An administrator who runs several Nextcloud servers filed the first public report, and two others described similar compromises. The attacks reportedly ran with web service privileges, which on a file collaboration server still reaches the documents users store there.

The fix shipped a day after the first logged attack, but the formal advisory and CVE came about a month later. Administrators who did not update in that gap had little reason to treat it as urgent.

Evidence

Verified against independently fetched sources:
1. The Hacker News, Attackers backdoor Nextcloud servers through a critical flaw in Collabora's CODE app
2. SecNews.gr, CVE-2026-110447: Collabora CODE flaw under active exploitation

What this means for your team

Self-hosted collaboration platforms hold contracts, board material and credentials, and they often sit outside the standard patch pipeline. A silent fix followed by a late advisory is exactly the case where inventory is the control that works.

Embedded components inherit the trust of the host application. A bundled document server is an attack surface even if no one on your team chose to deploy it.

Action checklist

1. Find every Nextcloud instance, including ones run by business units, and check whether richdocumentscode is installed and at what version.
2. Update to 26.4.303 or later or remove the app. Disabling it is not enough. If you run Nextcloud 29 or older, plan an upgrade rather than trusting the app store build.
3. Search web roots for shx*.php files and review access logs back to September 10. Treat any match as a breach and start incident response.
4. Review what the web service account can read, and rotate any secrets stored on the server.

Also notable

• DPRK IT worker laptop farms: The Department of Justice charged 14 people, and two U.S. nationals were arrested. Raids reportedly shut down more than 40 laptop farms in Texas and seized about 187 computers. The scheme ran from about 2019 to July 2025, reached more than 70 U.S. employers and generated roughly $3 million, per the outlets. The control gap is remote-hire identity verification. Sources: SecurityWeek and The Hacker News.
• curl: CVE-2026-92392 is a high-severity use-after-free in HTTP/2 upload handling in curl and libcurl 8.12.0 through 8.22.0. Fixed in 8.23.0, released October 14, with backports to 8.14.3, 8.16.2 and 8.20.2. No attacks are reported and the researcher's code execution demonstration required strict conditions. Embedded copies in third-party software are the inventory problem. Source: The Hacker News (single source reviewed).
• Booz Allen AI test in an OT lab: In an isolated lab, AI agents given no prior knowledge reportedly met all objectives in eight scenarios and moved from a perimeter compromise to actions inside an industrial control network in just over 16 minutes. The lab may not match enterprise OT. Source: SecurityWeek (single source reviewed).
• Ivanti Connect Secure follow-up: CISA added CVE-2026-104935 to the KEV catalog with an October 16 federal deadline, per SC Media. Honeypot exploitation counts differ by outlet (105 in one headline, 108 in the SC Media report). See yesterday's briefing for the full chain. Source: SC Media.
• H&M: ShinyHunters claims it accessed H&M internal databases covering inventory, logistics and sales analytics. H&M told The Times it is aware of the claims, is investigating and has found no sign so far that its data environment was compromised. The claim is unverified. Reported October 13. Source: Cybernews (single source reviewed).

Frequently asked questions

What is CVE-2026-76519?

A critical flaw (CVSS 9.8) in Cisco Secure Email Gateway that lets an unauthenticated attacker write files and run commands as root through a crafted email attachment. Cisco confirmed active attacks. Gateways with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525 are exposed.

How do I fix the Cisco Secure Email Gateway flaw?

Install Content Scanner Tools 25.3.0.5525 or later, or move to AsyncOS 15.5.5-014 or 16.5.0-780. Release 16.0 has no fixed build and requires migration. Cisco reports no workaround, and a clean log check does not rule out compromise.

What is CVE-2026-0322 in PAN-OS?

An authenticated remote code execution flaw in the PAN-OS management interface that gives root on the firewall. Palo Alto Networks reports very limited exploitation. It affects PA-Series, VM-Series and Panorama. The vendor recommends restricting management access to trusted internal addresses and upgrading.

What did Microsoft and Health-ISAC disrupt?

Three phishing kits, CoGUI, Haozi and Iron Man System, and the YAM Store marketplace. Microsoft says they sent more than one billion phishing messages since January 2026 to more than 75,000 organizations in over 150 countries.

How do I check for the Nextcloud Collabora CODE compromise?

Confirm the richdocumentscode app version, update to 26.4.303 or later or remove it, search for shx*.php files in web directories and review access logs back to September 10, 2026.

What should a CISO do first this week?

Patch the Cisco gateways and PAN-OS firewalls ahead of the October 17 federal deadline, restrict management interfaces, inventory self-hosted Nextcloud servers, and review third-party application permissions in your cloud tenant.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.