Date saved: 2026-10-24 18:01 (PDT)
Sources: CISA, Palo Alto Networks, The Hacker News, Security Affairs, Cyber Security News, SecureResearch, CISA KEV, Microsoft, Citrix, Quest Diagnostics
Key findings
Emergency CVEs and active exploitation
- CISA added CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support (CVSS 9.3), to its Known Exploited Vulnerabilities catalog after a China-linked espionage group exploited it for initial access and lateral movement. The flaw allows unauthenticated code writing, device takeover, and lateral movement. CISA mandated immediate patching for FCEB agencies. (Source)
- Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on the CVSS v4.0 scale, triggered an out-of-band release from the PHP security team. CISA alerted organizations that the flaws allow unauthenticated remote code execution, and Palo Alto Networks confirmed the vulnerabilities affect PAN-OS and previously impacted two cloud services. (Source)
- Palo Alto Networks confirmed that CVE-2026-109618 and CVE-2026-109619 affect PAN-OS and previously impacted two cloud services, prompting planned firewall hotfixes and guidance to restrict access. (Source)
- CISA added eight new exploited CVEs across five vendors in one week, including Collabora, Arista, EG Secure Solutions, and Siemens, according to Senserva's updated catalog. (Source)
Ransomware and critical infrastructure
- The ransomware groups Qilin and INC are exploiting CVE-2026-0257, an authentication bypass in the PAN-OS GlobalProtect portal and gateway that lets an attacker establish an unauthorized VPN connection when Authentication Override cookies use a reused or shared certificate. Palo Alto patched it in May 2026, and CISA added it to KEV on May 29 with known ransomware use. (Source)
- The SafePay ransomware group has hit more than 600 critical infrastructure organizations, according to a CISA advisory that prompted urgent patching. (Source)
- The Warlock ransomware group, deployed by China-based threat actor Storm-2603, has now been confirmed to have targeted at least four U.S. critical infrastructure organizations, including water utilities and telecommunications providers, using old SharePoint vulnerabilities. The campaign previously hit Europe, Africa, and Latin America. (Source)
- Osaka Metropolitan University in Japan is experiencing widespread disruption from a suspected ransomware attack impacting around 500 servers and potentially compromising the personal data of over 130,000 individuals. (Source)
Supply chain and credential theft
- ConnectWise credential theft hit Microsoft 365 tenants as part of a supply-chain attack in which a China-linked actor used AI agents, according to SecureResearch. The PHP2Shell vulnerabilities are being exploited before patches as the actor uses ConnectWise access for initial compromise. (Source)
- PwC is the subject of an Everest ransomware group claim that the group stole 590.69 GB of data including human resources records, training materials, and internal documents. The claims are unverified, and PwC has not confirmed the breach. (Source)
- Quest Diagnostics disclosed a patient data breach, according to SecureResearch's daily briefing. (Source)
- The Defense Manpower Data Center experienced a data breach between October 2025 and July 16, 2026, after unauthorized users exploited a security vulnerability in a file-sharing system to access unencrypted personally identifiable information, affecting approximately 3.05 million people including 2.76 million living individuals. (Source)
Additional critical vulnerabilities
- Citrix disclosed CVE-2026-107406, a critical memory overflow vulnerability in NetScaler ADC and Gateway products with a CVSS score of 9.5 that could lead to remote code execution or denial of service, impacting appliances configured as a SAML Service Provider or Identity Provider. CISA urged customers to apply patches immediately. (Source)
- CISA urged immediate Ivanti Connect Secure updates after honeypots logged 105 exploit attempts against CVE-2026-104935, an authentication bypass (CVSS 8.6) impacting versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, allowing remote unauthenticated execution of arbitrary commands. CISA added the flaw to KEV, requiring FCEB agencies to apply fixes by October 16, 2026. (Source)
- Oracle issued an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates, with a CVSS 3.1 score of 9.1. (Source)
- Denmark's Central Register of Persons (CPR) breach exposed 8.8 million records including names, addresses, and national ID numbers through a compromise at a private third-party supplier, according to Check Point Research. (Source)
- The Everest ransomware group claimed to have stolen 590 GB of data from PwC, and separately claimed 1.4 terabytes from Iron Mountain, though the Iron Mountain claim turned out to be far less than advertised. (Source)
The week of October 20-24, 2026 brought a cascade of actively exploited vulnerabilities moving from disclosure to emergency patching at a pace that is now routine. CISA added at least eight new exploited CVEs to its Known Exploited Vulnerabilities catalog in a single week, across vendors including BeyondTrust, Citrix, Arista, Collabora, EG Secure Solutions, and Siemens. The headline is not any one flaw. It is that multiple zero-day authentication bypasses in remote access, VPN, and support tools are being weaponized by both ransomware groups and state-linked espionage actors simultaneously, and federal agencies are being ordered to patch under binding deadlines while the same flaws are already showing up in critical infrastructure outside government.
Three developments define the week. First, a pair of critical PHP remote code execution vulnerabilities rated 9.2 on the CVSS v4 scale triggered an out-of-band release from the PHP security team and forced Palo Alto Networks to confirm the flaws affect PAN-OS and multiple network products. Second, a China-linked espionage group exploited a BeyondTrust Remote Support zero-day authentication bypass rated CVSS 9.3, giving unauthenticated attackers code-writing and device-takeover capability. Third, ransomware groups Qilin and INC are actively exploiting a PAN-OS GlobalProtect authentication bypass that was patched in May but never universally applied, and CISA confirmed ransomware use. The ConnectWise supply-chain credential theft that hit Microsoft 365 tenants, and the SafePay ransomware group's tally of more than 600 critical infrastructure organizations, mark the supply-chain and scale dimensions of the same week.
Source links
- CISA KEV catalog additions via Senserva
- Cyber Security News: Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS
- SecureResearch: PHP2Shell Exploited Before Patches, China-Linked Storm-0940, ConnectWise Supply Chain
- What Got Pwned: Qilin and INC ransomware exploit PAN-OS GlobalProtect bypass
- The Hacker News: CISA Urges Immediate Ivanti Connect Secure Updates
- Cyber.netsecops: Healthcare and Government Data Breaches, Exploited Vulnerabilities
- Cyber.netsecops: Data Breaches and Critical Vulnerabilities Dominate Cybersecurity News
- Security Affairs: CISA Archives
- Hacking News Ep. 61: State Hackers Hit 37 Countries, BeyondTrust CVSS 9.9 RCE
- Cyber Threat Brief - October 05, 2026