GreyNoise: Proxyjacking Campaign Hijacks D-Link, Ubiquiti Devices
October 16, 2026
GreyNoise found a proxyjacking campaign that compromised at least 143 edge devices in 34 countries, installing Pawns.app to resell victims’
Network Security
GreyNoise: Proxyjacking Campaign Hijacks D-Link, Ubiquiti Devices
GreyNoise found a proxyjacking campaign that compromised at least 143 edge devices in 34 countries, installing Pawns.app to resell victims' bandwidth.
Cisco Secure Email Gateway Zero-Day CVE-2026-76519 Exploited
Cisco confirms attackers are exploiting CVE-2026-76519, a CVSS 9.8 Secure Email Gateway flaw that gives root access, the second such zero-day since September.
Palo Alto Patches PAN-OS RCE Zero-Day CVE-2026-0322 Under Attack
Palo Alto Networks patched CVE-2026-0322, a PAN-OS management interface RCE giving root access that is under limited exploitation, and CISA added it to KEV.
JPCERT/CC Warns SiteGuard WAF Flaw CVE-2026-106931 Is Exploited
JPCERT/CC warns attackers are exploiting CVE-2026-106931, an OS command injection in SiteGuard Server Edition WAF that grants root or SYSTEM privileges.
Ivanti Connect Secure Zero-Day Chain Gives Root on Patched VPNs
Volexity found actor UTA0576 chaining three Ivanti Connect Secure zero-days to gain root on a fully patched VPN appliance; one flaw remains unpatched.
Fortinet, Citrix, Ivanti Patch 29 Flaws, Including Critical FortiSIEM
Fortinet, Citrix and Ivanti released patches for 29 vulnerabilities, including critical bugs in FortiSIEM, FortiSandbox and Ivanti Neurons Patch for Intune.
Dutch Police and Shadowserver Dismantle 178,000-Device Proxy Network
Dutch police, prosecutors and the Shadowserver Foundation took down servers behind a proxy service of 178,000 infected devices; more takedowns are planned.
Attackers Hijack Three Country TLDs to Forge Google Certificates
Google says attackers compromised the .gh, .sl and .as registries, altered DNS records and obtained fraudulent HTTPS certificates for Google and other domains.
SonicWall Patches CVSS 10.0 Pre-Auth SSRF in SMA1000 Appliances
SonicWall fixed four SMA1000 flaws, led by CVE-2026-102255, a CVSS 10.0 unauthenticated SSRF in the WorkPlace portal. No exploitation has been reported.
FBI, Secret Service: FortiBleed Attackers Lock Victims Out of Fortinet
An FBI and Secret Service advisory says a Russian initial access broker is using stolen credentials to lock organizations out of Fortinet FortiGate devices.
Cisco Secure Email Gateway Zero-Day CVE-2026-76519 Exploited
October 15, 2026
Cisco confirms attackers are exploiting CVE-2026-76519, a CVSS 9.8 Secure Email Gateway flaw that gives root access, the second such
Palo Alto Patches PAN-OS RCE Zero-Day CVE-2026-0322 Under Attack
October 15, 2026
Palo Alto Networks patched CVE-2026-0322, a PAN-OS management interface RCE giving root access that is under limited exploitation, and CISA
JPCERT/CC Warns SiteGuard WAF Flaw CVE-2026-106931 Is Exploited
October 15, 2026
JPCERT/CC warns attackers are exploiting CVE-2026-106931, an OS command injection in SiteGuard Server Edition WAF that grants root or SYSTEM
Ivanti Connect Secure Zero-Day Chain Gives Root on Patched VPNs
October 14, 2026
Volexity found actor UTA0576 chaining three Ivanti Connect Secure zero-days to gain root on a fully patched VPN appliance; one
Fortinet, Citrix, Ivanti Patch 29 Flaws, Including Critical FortiSIEM
October 14, 2026
Fortinet, Citrix and Ivanti released patches for 29 vulnerabilities, including critical bugs in FortiSIEM, FortiSandbox and Ivanti Neurons Patch for
Dutch Police and Shadowserver Dismantle 178,000-Device Proxy Network
October 13, 2026
Dutch police, prosecutors and the Shadowserver Foundation took down servers behind a proxy service of 178,000 infected devices; more takedowns
Attackers Hijack Three Country TLDs to Forge Google Certificates
October 8, 2026
Google says attackers compromised the .gh, .sl and .as registries, altered DNS records and obtained fraudulent HTTPS certificates for Google
SonicWall Patches CVSS 10.0 Pre-Auth SSRF in SMA1000 Appliances
October 8, 2026
SonicWall fixed four SMA1000 flaws, led by CVE-2026-102255, a CVSS 10.0 unauthenticated SSRF in the WorkPlace portal. No exploitation has
FBI, Secret Service: FortiBleed Attackers Lock Victims Out of Fortinet
October 8, 2026
An FBI and Secret Service advisory says a Russian initial access broker is using stolen credentials to lock organizations out
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.