CYBER THREATCAST

Upgrade Cisco Secure Email Gateway appliances running AsyncOS earlier than 16.5 and Content Scanner Tools earlier than 25.3.0.5525 immediately. Attackers are actively exploiting CVE-2026-76519, and a crafted attachment can let an unauthenticated attacker write arbitrary files and execute commands as root. CISA added the flaw to its Known Exploited Vulnerabilities catalog and directed federal agencies to remediate by October 17.

Apply BeyondTrust’s remediation for CVE-2026-102764 to hosted and self-hosted Remote Support deployments, prioritizing internet-facing appliances and versions through 26.2.3. Investigate affected systems for persistent control, stolen credentials, downstream access, and erased evidence rather than treating patching alone as sufficient. China-linked ARMORY CASTLE exploited the flaw as a zero-day and could gain full appliance control and escalate to root.

Patch Fortinet infrastructure against CVE-2024-47575 and CVE-2025-61624, then examine FortiManager environments for the memory-resident PEERSTITCH implant and connections involving 23.240.77[.]233:8085. Managed service providers should prioritize this review: a suspected advanced actor compromised a telecommunications MSP’s FortiManager, exposed data for more than 500 managed FortiGate firewalls, and used CVE-2025-61624 to deploy PEERSTITCH.

Install fixed PAN-OS releases for CVE-2026-0322 and restrict network access to PAN-OS management interfaces. Palo Alto Networks has reported limited active exploitation, and an authenticated attacker with management-interface access can execute arbitrary code as root on affected PA-Series firewalls, Panorama M-Series appliances, and other PAN-OS devices. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.

Remove Danfoss, Copeland, and Dixell refrigeration controllers from direct internet exposure, require secure VPN access, and replace vulnerable end-of-life equipment as CERT-FR recommends. Attackers manipulated internet-exposed controllers at roughly 700 French supermarkets, extending defrost cycles to as long as eight hours and setting temperatures as high as 50°C; the incidents caused equipment failures, food losses, delayed alarms, and some fires.