Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler

Good morning, and happy Columbus Day to those who have it off. Attackers did not take the weekend. Here is what changed between Friday evening and this morning, in the order we would fix it.

Lead Story

Ransomware crews are logging in through GlobalProtect VPNs without passwords. ReliaQuest says Qilin and Settra are using the Palo Alto bug fixed in May to open VPN sessions that look like remote work. Check the cookie setting →

Also Worth Your Attention

SonicWall SMA1000 appliances are drawing attack traffic three days after the fix. A no-login bug rated 10.0 started drawing probes on October 9. Get the hotfix builds →

AhsayCBS backup servers need a second patch. Ahsay says its first fix fell short; hotfix 10.3.4.45 is the one to install. Hunt for web shells →

Citrix has a new NetScaler SAML fix, and September builds are not enough. CVE-2026-107406 is a follow-up to the flaws we flagged on October 5. Check your build →

Source: Mon Oct 12: (1) GlobalProtect: upgrade every portal/gateway, then kill all sessions. (2) SonicWall SMA1000 to 12.4.3-03670 / 12.5.0-03082. (3) AhsayCBS hotfix 10.3.4.45 + reboot, lock console to trusted IPs. (4) NetScaler with SAML to 14.1-73.46 / 13.1-64.29.

Go Deeper

• Identity and access management: VPN sign-in, MFA and session control
• Cybersecurity tools for checking your own internet-facing devices

Get this in your inbox every weekday morning: subscribe to the Daily Brief.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].