Friday’s brief: Cisco VPN firewalls under attack, then GitLab, Synology NAS ransomware and Cisco SD-WAN spyware

By George Bailey   Published: 10/30/26   2 min read
Cyber News

Good morning. Cisco says attackers are rebooting ASA and Secure Firewall devices through the VPN login, and CISA wants them fixed by Sunday. GitLab’s 10.0 bug we flagged on October 13 is now on CISA’s exploited list, Synology NAS owners who skipped September’s update are getting ransomware, and Talos found spyware in Cisco SD-WAN controllers.

Lead Story

Cisco ASA and FTD firewalls can be rebooted through the VPN login, and attackers are doing it. CISA wants them fixed by November 1. See the fixed releases →

Also Worth Your Attention

The GitLab 10.0 flaw is on CISA’s exploited list, and upgrading GitLab alone did not fix Alpine Linux’s server. Check your Ruby →

Ransomware is locking Synology NAS boxes that skipped the September 18 update. Check your DSM version →

Talos found KeyDrift malware in Cisco SD-WAN controllers, copying the keys that protect traffic between sites. Look inside the controller →

Also on the radar: Palo Alto Networks says the remaining PAN-OS hotfixes for PHP2Shell are due October 29 and 30, and that attackers are hitting management interfaces exposed to the internet (The Hacker News). Progress published CVE records for 15 WS_FTP Server flaws, including a 10.0 that exposes administrator credentials, fixed in 2024.0.7 and 2025.0.4, with no exploitation reported (Rescana). Langflow OSS 1.13.0 fixes an unauthenticated code execution flaw in versions 1.0.0 through 1.12.8 (IBM bulletin).

Reviewing logs after an incident? Our CySA+ exam guide covers the triage and log-review skills behind the hunt steps in these stories.

Source: CISA KEV addition; Cisco advisory; Alpine Linux incident report; Synology advisory; Cisco Talos on KeyDrift

Go Deeper

Get this in your inbox every weekday morning: subscribe to the Daily Brief.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].