TL;DR for CISOs: Cisco confirmed attackers are exploiting an ASA/FTD flaw that reloads firewalls running SSL VPN with secondary authentication; researchers detailed how Volt Typhoon hides intrusions behind compromised U.S. home and office devices; DHS says it is addressing the Icepick leak of 41,000+ personnel records; and Coinbase customer contact data was exposed through its analytics vendor.
- Check your Cisco ASA/FTD tunnel groups for secondary authentication today. The flaw is exploited and the fix is a version upgrade.
- Location-based controls will not catch Volt Typhoon-style access from U.S. residential addresses. Lock down and log management interfaces.
- Two of today's stories are third-party or identity exposures. Know which vendors and consoles can export your user data.
Today's slate at a glance
| Story | Severity | Who is exposed | First action |
|---|---|---|---|
| Cisco ASA/FTD zero-day CVE-2026-76418 | Critical | ASA/FTD with SSL VPN and secondary authentication | Check tunnel groups and upgrade |
| Volt Typhoon Silent Train | High | Government, defense, MSPs, utilities and IT firms | Restrict and log management interfaces |
| DHS Icepick leak | High | DHS personnel; any organization with an exportable SSO directory | Audit SSO export rights |
| Coinbase via Amplitude | High | Coinbase and other Amplitude customers | Inventory analytics SDKs and data shared |
Lead story: Cisco firewall zero-day exploited to crash SSL VPN devices
CRITICAL · ACTIVELY EXPLOITED / PERIMETERCisco has confirmed attackers are exploiting a flaw that can knock its firewall VPNs offline. We are checking whether our configuration is exposed, applying the fix, and confirming our remote-access failover works.
Key facts
| Item | Detail | Status |
|---|---|---|
| Vulnerability | CVE-2026-76418 in Cisco Secure Firewall ASA and FTD software. An unauthenticated remote attacker can force the device to reload | Confirmed by Cisco (as reported) |
| Exposed configuration | SSL VPN (webvpn) enabled on at least one interface, plus secondary authentication configured on a tunnel group, including DefaultWEBVPNGroup | Confirmed by Cisco (as reported) |
| Exploitation | Cisco PSIRT says it became aware of active exploitation in October 2026. No indicators, targets or attackers have been disclosed | Confirmed exploitation; details open |
| Fixes | Fixed ASA releases include 9.18.4.96, 9.20.4.50, 9.22.3.200 and 9.24.1.27; fixed FTD releases include 7.2.13, 7.4.9, 7.6.7 and 10.1.1. Check the advisory for your train | Per Cisco advisory, as reported by Cyber Security News |
| Workaround | BleepingComputer reports Cisco offers no workaround. Temporary mitigation is to disable secondary authentication on affected tunnel groups | Reported |
| Exposure | Shadowserver tracks more than 51,000 internet-exposed Cisco ASA SSL VPN devices. It is not known how many use secondary authentication | Third-party count |
| Context | This is separate from CVE-2026-20349, another ASA/FTD denial-of-service zero-day exploited in August | Reported |
What happened
Cisco disclosed CVE-2026-76418 on October 28 and confirmed in-the-wild exploitation. The flaw is a logic error in how ASA and FTD handle secondary authentication on SSL VPN tunnel groups. Sending crafted traffic causes the firewall to reload, which drops every VPN session and, on a single perimeter device, interrupts traffic through it.
The flaw causes denial of service, not code execution, according to the reporting reviewed. Cisco has not said who is exploiting it or why. Repeated reloads of an edge device can be used to disrupt remote access or to mask other activity during an intrusion.
Evidence
- BleepingComputer: Cisco warns of firewall zero-day exploited to crash SSL VPN devices
- Cyber Security News: Cisco Secure Firewall 0-day exploited in the wild to crash SSL VPN devices
What this means for your team
This is the second exploited ASA/FTD availability flaw since August. For organizations whose remote workforce depends on one VPN head-end, a repeatable unauthenticated reload is an outage risk, not just a patching item. It also tests whether your monitoring would tell a crash-by-attack apart from an ordinary failure.
The exposed condition is configuration-specific. Teams that know exactly which tunnel groups use secondary authentication can scope this in an hour; teams that do not will spend longer, which is itself a finding worth fixing.
Action checklist
- Identify every ASA and FTD with SSL VPN enabled and check each tunnel group, including DefaultWEBVPNGroup, for secondary authentication.
- Upgrade to the fixed release for your train. Where you cannot, disable secondary authentication on affected tunnel groups as a temporary measure.
- Alert on unexpected ASA/FTD reloads and VPN session drops, and review crash logs since October 1.
- Confirm a tested failover or secondary remote-access path for critical staff.
Supporting story: Volt Typhoon ran a hidden relay network after the 2024 takedown, researchers say
HIGH · NATION-STATE / CRITICAL INFRASTRUCTUREKey facts
| Item | Detail | Status |
|---|---|---|
| Finding | Lumen's Black Lotus Labs published research on October 28 on "Silent Train," a relay framework it attributes to China-linked Volt Typhoon and says it has tracked for three years | Researcher attribution |
| How it works | Traffic is routed through overseas VPS and compromised home and small-office devices, then chained SSH sessions. Tooling is typically removed within about eight hours, and access windows averaged about four hours | Reported (BleepingComputer, Nextgov) |
| Devices | More than 27 classes of devices, including TP-Link routers, Netgear equipment and Fortinet appliances. Some compromised devices had no known vulnerabilities | Per Lumen, via Nextgov |
| Zero-days | BleepingComputer reports at least four zero-days observed, including flaws in Cisco Catalyst SD-WAN (CVE-2026-20127), VeloCloud Orchestrator, N-able N-central and Versa Director | Reported |
| Targets | Mostly U.S. government entities, defense contractors and defense-linked universities; IT firms and MSPs also prominent. California, Texas and Hawaii were most targeted | Reported |
| Persistence | Since early 2025 the framework also kept compromised enterprise systems for one to three months alongside disposable relays | Reported (BleepingComputer) |
What happened
Black Lotus Labs says Volt Typhoon rebuilt its covert infrastructure after the FBI disrupted the KV botnet in early 2024. The new framework uses short-lived sessions through compromised edge devices, which makes the traffic look like it comes from ordinary U.S. home and business connections.
Nextgov reports, citing unnamed sources, that Energy Department facilities were targeted over the last year and that multiple utility providers were affected. That detail is not confirmed by a named official.
Evidence
- BleepingComputer: Volt Typhoon hides zero-day attacks using Silent Train framework
- Nextgov: China's Volt Typhoon quietly built another hacking network
What this means for your team
Geolocation and IP reputation rules will not catch this: the connections arrive from U.S. residential and small-business addresses. Detection has to rest on behavior at your management plane, such as an admin login at an unusual hour from an unfamiliar device.
The zero-days listed sit in centralized management systems: SD-WAN controllers, RMM platforms and orchestrators. One compromise there reaches many downstream networks, which is why MSPs and IT firms feature heavily in the target list.
Action checklist
- Remove internet access to administrative interfaces of SD-WAN, RMM and network management systems, or put them behind a dedicated access path.
- Centralize logs from edge and management systems and keep them long enough to investigate a short-session intrusion months later.
- Review trust relationships with MSPs and partners that have standing access to your network.
Supporting story: DHS says it is addressing the Icepick leak of 41,000+ personnel records
HIGH · PUBLIC SECTOR / IDENTITYKey facts
| Item | Detail | Status |
|---|---|---|
| What was published | On October 28, DDoSecrets published "Icepick," a dataset on more than 41,000 DHS employees and contractors that it says came from a group calling itself the Department of Peace | Reported |
| Scope | Help Net Security reports the site indexed 41,191 people and 55,603 internal groups, including 21,329 CBP and 6,598 ICE personnel. Operators said the list is incomplete and may contain errors | Reported |
| DHS response | DHS told the BBC it is aware of a potential breach and is working to address it | Agency statement |
| Entry point | The group and DDoSecrets say the data came from DHS's Okta single sign-on system. Okta says it has no evidence its data or systems were compromised | Unverified claim; vendor denial |
| Verification | Reuters matched six named employees against other data and confirmed three by phone | Partially verified |
| Status | The searchable site was taken offline on the morning of October 29, per CyberScoop as cited by CyberWire | Reported |
What happened
The release includes names and internal group memberships, which reveal roles and access. Help Net Security calls it the third major federal data exposure in about a month.
The Okta question is unresolved. A claim that data came from a customer's SSO tenant does not establish that the identity provider itself was breached; an administrator account, a token or an integration could fit the same facts.
Evidence
- Help Net Security: Hacktivists leak 41,000 DHS staff records
- CyberScoop: Leak site publishes data on more than 41,000 DHS employees
What this means for your team
Group membership data is an access map. Any organization that can export its full directory and group listing from an SSO console should know who can do that and whether it is logged.
Action checklist
- Review who can export users and groups from your identity provider, and alert on bulk exports.
- Inventory SSO admin accounts, API tokens and service accounts, and remove any without a named owner.
Supporting story: Coinbase customer contact data exposed through analytics vendor Amplitude
HIGH · THIRD-PARTY SAASKey facts
| Item | Detail | Status |
|---|---|---|
| What happened | Coinbase said on October 27 that an incident at Amplitude, its product analytics provider, affected a small subset of Coinbase customer contact data, among other Amplitude customers | Confirmed by Coinbase |
| Coinbase systems | Coinbase says there is no evidence of unauthorized access to its systems and customer funds were not affected | Company statement |
| Data | Contact data. A Coinbase spokesperson told Unchained limited transaction data was also involved, but not home addresses or anything allowing account access | Company statement; details differ by outlet |
| Count | No figure confirmed. A circulating claim of about 70,000 customers is unverified, and Coinbase called it false | Disputed claim |
| Other customers | Coinbase says other Amplitude customers were affected; none have been named | Open |
What happened
Coinbase disclosed the exposure through its support account and confirmed it to reporters on October 28. It is notifying affected customers and regulators.
Evidence
- Unchained: Coinbase ties customer contact data exposure to vendor Amplitude
- Cyber Security News: Coinbase customer data exposed via Amplitude
What this means for your team
Product analytics SDKs receive user identifiers and event data from production apps, often with less contract scrutiny than core vendors. Contact data tied to a known crypto account is enough for targeted phishing.
Action checklist
- List every analytics and telemetry SDK in your apps and the user fields each one receives.
- Confirm breach-notification terms with those vendors, and if you use Amplitude, ask for your exposure status in writing.
- Warn customer support teams about follow-on phishing that cites real account details.
Also notable
- GitLab CVE-2026-97229 (CVSS 10.0), covered here on October 12 and 21, was added to CISA KEV on October 29 with a November 1 federal deadline. Fixed releases are 19.2.8 and 19.4.2; confirm the 19.3 fix version in GitLab's advisory. Source: Cyber Security News
- CISA also added a VMware ESX audit logging flaw (CVE-2026-41709, deadline November 11) and the Linux kernel "Fragnesia" privilege escalation (CVE-2026-46300, deadline October 31) to KEV. Source: Security Affairs
- PHP2Shell update: researchers report an attacker rooted 25 servers, three at a U.S. government-affiliated organization, then tunneled toward Active Directory. Source: The Hacker News
- Hive and Nefilim affiliate Artem Stryzhak was sentenced to 70 months in U.S. federal prison. Source: CyberWire
Frequently asked questions
Is the Cisco ASA/FTD zero-day remote code execution?
No. Per the reporting, CVE-2026-76418 lets an unauthenticated attacker force the firewall to reload. It affects devices with SSL VPN and secondary authentication configured on a tunnel group.
Is there a workaround for CVE-2026-76418?
BleepingComputer reports Cisco offers no workaround. Disabling secondary authentication on affected tunnel groups is a temporary mitigation until you upgrade.
What is Silent Train?
A relay framework that Lumen's Black Lotus Labs attributes to Volt Typhoon. It routes intrusions through compromised home and small-office devices using short-lived SSH sessions.
Was Okta breached in the DHS Icepick leak?
Not established. The group claims the data came from DHS's Okta SSO; Okta says it has no evidence of compromise. DHS says it is working to address a potential breach.
Was Coinbase breached?
Coinbase says its systems were not accessed. Customer contact data was exposed through its analytics vendor, Amplitude.
Where can I follow more breach analysis?
The CISO Platform Breach Intelligence hub carries each edition, and the weekly newsletter summarizes the week.
Curated by Pritha Aash, Community Head, CISO Platform
Subscribe to the weekly newsletter
More from the Breach Intelligence hub, including the BeyondTrust Remote Support zero-day, PHP2Shell technical analysis and Breach Watch Weekly: vendor access was the way in, plus vulnerability management coverage.
Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.
Comments