Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS

Good morning. Cisco says attackers are getting root on Secure Email Gateways with nothing more than a crafted attachment. Palo Alto has a PAN-OS admin bug under limited attack, Nextcloud servers with one office app have been quietly backdoored since September, and the AhsayCBS backup bugs we covered Monday are now on CISA’s exploited list. Here is the order we would work through it.

Lead Story

Cisco Secure Email Gateway flaw is exploited: one crafted attachment gives root. Gateways with File Reputation on and old Content Scanner Tools are exposed; CISA wants it fixed by Saturday. Check your gateway →

Also Worth Your Attention

Palo Alto PAN-OS admin bug gives root to anyone with a login, and it is under limited attack. Upgrade path →

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Nextcloud’s Collabora Built-in CODE Server app was used to plant web shells. Disabling it is not enough. Update or remove →

AhsayCBS backup bugs join CISA’s exploited list, and version 9 finally has a hotfix. Find your hotfix →

Also on the radar: JPCERT/CC and IPA say attackers are exploiting a redirect bug in the EC-CUBE AmazonPay plugin, used by Japanese online stores, to send shoppers to phishing pages (JVN).

Slack paste: Thu Oct 15: (1) Cisco SEG: contentscannerstatus, update to CST 25.3.0.5525+, check System Security log; CISA due Sat. (2) PAN-OS CVE-2026-0322 upgrade + jump-box-only admin. (3) Nextcloud richdocumentscode to 26.4.303 or remove; hunt shx*.php. (4) AhsayCBS hotfix 10.3.4.45 / 9.15.2.70.

Go Deeper

Get this in your inbox every weekday morning: subscribe to the Daily Brief.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].