Good morning, and happy Columbus Day to those who have it off. Attackers did not take the weekend. Here is what changed between Friday evening and this morning, in the order we would fix it.
Lead Story
Ransomware crews are logging in through GlobalProtect VPNs without passwords. ReliaQuest says Qilin and Settra are using the Palo Alto bug fixed in May to open VPN sessions that look like remote work. Check the cookie setting →
Also Worth Your Attention
SonicWall SMA1000 appliances are drawing attack traffic three days after the fix. A no-login bug rated 10.0 started drawing probes on October 9. Get the hotfix builds →
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
AhsayCBS backup servers need a second patch. Ahsay says its first fix fell short; hotfix 10.3.4.45 is the one to install. Hunt for web shells →
Citrix has a new NetScaler SAML fix, and September builds are not enough. CVE-2026-107406 is a follow-up to the flaws we flagged on October 5. Check your build →
Slack paste: Mon Oct 12: (1) GlobalProtect: upgrade every portal/gateway, then kill all sessions. (2) SonicWall SMA1000 to 12.4.3-03670 / 12.5.0-03082. (3) AhsayCBS hotfix 10.3.4.45 + reboot, lock console to trusted IPs. (4) NetScaler with SAML to 14.1-73.46 / 13.1-64.29.
Go Deeper
- Identity and access management: VPN sign-in, MFA and session control
- Cybersecurity tools for checking your own internet-facing devices
Get this in your inbox every weekday morning: subscribe to the Daily Brief.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
