This brief covers developments from October 11–13, 2026, drawn from primary advisories and original sources wherever available.

GitLab patches CVSS 10.0 unauthenticated code-execution flaw in CI/CD regex compiler

GitLab · October 12, 2026

GitLab released 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler rated CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It affects self-managed GitLab CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. No in-the-wild exploitation has been reported and the CVE is not reported as a CISA KEV entry; GitLab.com is already patched.

“…could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration…” — GitLab patch release notes

Source: GitLab patch release 19.4.2; BleepingComputer.

Attackers hijack Danfoss refrigeration controllers at French supermarkets

CERT-FR · October 12, 2026

CERT-FR issued alert CERTFR-2026-ALE-012 citing numerous compromises of Danfoss AK-SM and AK-SC devices exposed to the internet. Press reports say the attack began the night of October 11 and forced freezers and fridges into defrost at hundreds of stores. No CVE has been tied to the attack; the entry point is unknown. The AK-SM 800 (end of life since 2021) and AK-SC 355 receive no patches, and Danfoss fixed three earlier AK-SM 800A flaws (CVE-2025-41450/41451/41452) in 2025. CERT-FR advises disconnecting or filtering access and, if compromise is suspected, a factory reset, patching, and rotating all secrets.

“…aware of incidents in France affecting a limited number of refrigeration management systems.” — Danfoss, to Reuters (as reported by The Hacker News)

Source: CERT-FR alert; The Hacker News; BleepingComputer.

Ledger confirms hardware implant in wallets sold via a Southeast Asian reseller

Ledger · October 11, 2026

Ledger confirmed that a device bought through reseller CryptoBilis contained an unauthorized hardware implant, tied to reported crypto thefts. Ledger says a limited number of devices are affected and all confirmed cases came through that reseller. It paused sales via CryptoBilis and advised recent buyers not to set up devices, or to move funds to a new signer with a new seed. Loss estimates (above $86 million, from a pseudonymous analyst) are unverified. No CVE applies.

“…to not initiate set up if you have not done so yet” — Ledger, on X

Source: Ledger statement; The Hacker News; BleepingComputer.

Still developing

SonicWall SMA 1000 CVSS 10.0 SSRF under active exploitation

Previdian / SonicWall · October 9, 2026

CVE-2026-102255 is a pre-authentication SSRF in the SMA1000 Work Place interface (CVSS 10.0). Patched in 12.4.3-03670 and 12.5.0-03082; versions 12.4.3-03526 and 12.5.0-02952 and older are affected. Previdian observed 135 exploitation attempts from two US IPs between October 9 and 10. It is not listed in CISA KEV per Previdian.

“A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface” — SonicWall PSIRT, as quoted by Previdian

Source: Previdian; SonicWall advisory SNWLID-2026-0017; The Hacker News.

Bricksforge WordPress plugin file-upload RCE exploited in the wild

Patchstack · October 8, 2026

CVE-2026-85097 (CVSS 10.0) is an unauthenticated arbitrary file upload in Bricksforge 3.1.8.9 and earlier, fixed in 3.1.8.10. Patchstack first saw exploitation October 7 and recorded 63 unique source IPs, with attackers uploading GIF/PHP polyglots.

“Bricksforge validates a file’s MIME type when it is first uploaded.” — Patchstack

Source: Patchstack; The Hacker News.

This brief covers the trailing ~48 hours (October 11–13, 2026).

Primary sources:

• GitLab patch release 19.4.2
• CERT-FR CERTFR-2026-ALE-012
• Ledger statement
• Previdian CVE-2026-102255
• Patchstack Bricksforge

This brief covers the trailing ~48 hours ending October 12, 2026. It was a quieter window for new advisories, so the items below are drawn from vendor, researcher and company disclosures and checked against primary pages. Active campaigns that began slightly earlier are listed at the end.

Ledger confirms hardware implant in wallets sold by reseller CryptoBilis

Ledger · October 11, 2026

Ledger said an affected device contained an unauthorized hardware implant, and that the incident involves a “limited” number of devices, all sold through the reseller CryptoBilis in Southeast Asia. CryptoBilis has paused sales of its hardware wallet inventory while the investigation continues. Ledger told buyers from this reseller in the last 90 days not to begin setup, and advised anyone who already set up a device to move assets to a new signer with a new seed. Blockchain investigator Specter estimated losses above $86 million (an estimate, not a Ledger figure). No CVE applies; this is a supply-chain tampering case.

“Also, we strongly advise users not to purchase from unauthorized resellers” — Ledger, October 11 update

Source: Ledger update, Oct 11 · Ledger implant disclosure · The Hacker News

Daiichi Kosho: malware at contractor Nippon Columbia exposes about 8.7 million records

Daiichi Kosho / BleepingComputer · October 11, 2026

Japan’s largest karaoke operator, Daiichi Kosho, disclosed that malware on an employee’s computer at its contractor, Nippon Columbia Group, exposed 8,631,000 customer records and 93,000 employee records. Exposed fields include names, genders, dates of birth, email addresses and phone numbers; the company says passwords are not included. NCG reported the infection on October 5 and isolated the system the next day. Data theft has not been confirmed. No CVE or KEV entry applies.

Daiichi Kosho “has not confirmed any data theft or leaks” — as reported by BleepingComputer

Source: BleepingComputer, citing Daiichi Kosho’s website notices

CrowdStrike: attacker used ARTEX AI and Claude agents against South Korean banks

CrowdStrike / BleepingComputer · October 10, 2026

CrowdStrike confirmed that a Chinese-speaking actor used the ARTEX AI penetration-testing suite together with Claude agents in attacks on South Korean financial institutions, including Shinhan Bank, KB Kookmin Bank and Hana Bank. The intrusions exposed client personal and credit card data and caused outages in some cases. CrowdStrike found open directories holding Claude Code session histories and ARTEX configuration files, and saw no clear plan to monetize the stolen data. The ARTEX developer has since closed the source and stopped updates, though derivatives exist. No CVE is involved.

“The threat actor likely accessed DeepSeek via the likely LLM API proxy/reseller xcai[.]pro,” — CrowdStrike, as reported by BleepingComputer

Source: BleepingComputer

Still developing

SonicWall SMA 1000 SSRF (CVE-2026-102255) draws exploitation attempts

SonicWall / Help Net Security · patched October 6–7, 2026; exploitation attempts reported October 8–12

A pre-authentication server-side request forgery in the Appliance Work Place interface affects SMA 1000 models 6210, 7210 and 8200v. It is fixed in hotfixes 12.4.3-03670 and later, and 12.5.0-03082 and later. The Hacker News reports a CVSS of 10.0 and 135 exploitation attempts seen by Previdian; Defused Cyber also reported attempts beginning October 8. It is unknown whether any succeeded, and no KEV listing has been confirmed. SMA 100 Series and SonicWall firewalls are not affected.

Unauthenticated attackers could “direct the appliance to issue requests on their behalf” — SonicWall, via Help Net Security

Source: SonicWall PSIRT SNWLID-2026-0017 · Help Net Security · BleepingComputer · The Hacker News

Bricksforge WordPress plugin file upload (CVE-2026-85097, CVSS 10.0) exploited

Patchstack · October 8, 2026

An unauthenticated arbitrary file upload in Bricksforge versions 3.1.8.9 and earlier allows remote code execution. Patchstack first saw exploitation on October 7 at 21:47 UTC; the fix is version 3.1.8.10. No KEV listing has been confirmed.

“Our telemetry shows active exploitation attempts targeting Bricksforge installations” — Patchstack

Source: Patchstack · The Hacker News

P7 DarkSword: new iOS spyware variant steals crypto-wallet data

iVerify · October 8, 2026

iVerify identified P7 DarkSword during an August investigation of an infected customer device. It leaves a smaller on-device footprint, extracts keychain data, steals crypto-wallet data (including from imToken), and supports two-way command-and-control with a configurable beacon. The iVerify post names no CVEs; module names reference iOS 18.4 through 18.7.

“P7 DarkSword improves on earlier variants in three areas:” — iVerify

Source: iVerify · The Hacker News

This brief covers the trailing ~48 hours (October 10–12, 2026).

Primary sources:

• Ledger (X)
• Daiichi Kosho disclosure via BleepingComputer
• CrowdStrike findings via BleepingComputer
• SonicWall PSIRT
• Patchstack
• iVerify

This brief covers security developments disclosed between October 1 and October 3, 2026. Every item below was checked against its primary source: the vendor advisory, the CISA KEV alert, or the original research.

Fortinet FortiMail zero-day lets unauthenticated attackers write arbitrary files (CVE-2026-104286)

Fortinet PSIRT · October 1, 2026

Fortinet disclosed CVE-2026-104286 (CVSS 9.8), a path traversal and NULL-byte handling flaw in FortiMail. An unauthenticated attacker can use crafted HTTP/HTTPS requests to write arbitrary files on the system, which can lead to code execution. FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9 are affected. The bug is actively exploited and the fixed releases (8.0.2, 7.6.7, 7.4.9) are still listed as “upcoming.” Until they ship, Fortinet’s workaround is to disable IBE or keep the webmail interface off the internet. CISA added it to KEV on October 1 with an October 4 deadline for federal agencies. Fortinet also published IOCs, including the IPs 79.141.169[.]187 and 45.129.0[.]192.

“This has been reported to be exploited in the wild, customers are urged to apply the workaround below.” — Fortinet, FG-IR-26-175

Source: Fortinet FG-IR-26-175 · CISA KEV alert · The Hacker News

Zammad zero-days used in AI-agent breach of DIVD added to KEV (CVE-2026-102489, CVE-2026-102490)

DIVD CSIRT / CISA · October 2, 2026

CISA added two Zammad helpdesk flaws to KEV on October 2. Both were exploited as zero-days in the September 21 breach of the Dutch Institute for Vulnerability Disclosure (DIVD), which DIVD describes as an agentic-AI-driven attack. CVE-2026-102489 (CVSS 9.4) is a session fixation/hijack bug that leads to RCE as the zammad user. It affects Zammad 6.3.0–6.5.4. Versions 7.0.0–7.1.3 contain the bug, but it isn’t exploitable there because of environment conditions. CVE-2026-102490 (CVSS 9.4) is a local privilege escalation to root that affects all versions. Neither flaw had a fix at disclosure. DIVD has published an IOC log-check script.

“We advise all users of Zammad to upgrade to version 7 of Zammad or to take it offline.” — DIVD CSIRT

Source: DIVD-2026-00015 · CISA KEV alert · SecurityWeek

Fortra patches three critical BoKS flaws, including AD service-account auth bypass

Fortra · October 1, 2026

Fortra fixed eight vulnerabilities in Core Privileged Access Manager (BoKS). Three of them are critical:

• CVE-2026-79901 (CVSS 9.9): AD service-account passwords are generated from a predictable sequence seeded with the Unix timestamp, which allows an authentication bypass.
• CVE-2026-79898 (CVSS 9.1): command injection in crlserver that runs as root on the BoKS Master.
• CVE-2026-12627 (CVSS 9.8): a stack overflow in autoregistration.

Patches are available. Fortra has not reported in-the-wild exploitation, and none of the three is in KEV.

“An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.” — Fortra

Source: Fortra product security advisories · SecurityWeek

Still developing

Cisco Catalyst SD-WAN Manager auth bypass exploited as zero-day (CVE-2026-76504)

Cisco PSIRT · September 30, 2026

CVE-2026-76504 (CVSS 9.8) is an API authentication bypass caused by improper URI-encoding handling. It gives unauthenticated attackers admin-level API access to Catalyst SD-WAN Manager. All deployments are affected regardless of configuration, and there is no workaround. Fixes are in 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2 and 20.9.10.1. CVE-2026-76504 is actively exploited and in KEV, with a federal deadline of October 3. Cisco published IOCs for serviceproxy-access.log and vmanage-server.log.

“In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” — Cisco

Source: Cisco advisory · CISA KEV alert · SecurityWeek

Citrix NetScaler exploitation: post-exploitation payloads create superuser and hide web shells (CVE-2026-88771)

LevelBlue SpiderLabs · October 1, 2026

LevelBlue documented exploitation of CVE-2026-88771 (CVSS 9.5), a pre-auth command injection in NetScaler ADC and Gateway that is already in KEV, across multiple customer environments. In some cases a Perl payload added a “sec_monitor” superuser and exfiltrated /flash/nsconfig. Attackers also planted PHP web shells mapped to URLs that look like CSS resources. Separately, Mandiant/GTIG reported dozens of victims of the companion bug, CVE-2026-88772.

“Taken together, the observed commands demonstrate activity extending beyond basic vulnerability validation.” — LevelBlue

Source: LevelBlue · CISA alert · The Hacker News

Microsoft: Zimbra SNMP command injection was probed before public disclosure (CVE-2026-73570)

Microsoft Threat Intelligence · September 30, 2026

CVE-2026-73570 (CVSS 8.9) is an unauthenticated OS command injection in Zimbra Collaboration Suite. It can be triggered through crafted SMTP traffic when zimbra-snmp is installed and SNMP notifications are enabled. Microsoft says scanning of the vulnerable code path started between the July 20 patch (ZCS 10.1.20) and the August 13 public disclosure. Later attacks deployed JSP web shells, escalated to root and stole credentials. The fix is ZCS 10.1.20 or later.

Source: Microsoft Security Blog · SecurityWeek

This brief covers the trailing ~48 hours (October 1–3, 2026).

Primary sources:

• Fortinet PSIRT FG-IR-26-175
• CISA: Adds One KEV (Oct 1, 2026)
• CISA: Adds Two KEVs (Oct 2, 2026)
• DIVD CSIRT case DIVD-2026-00015
• Fortra product security advisories
• Cisco advisory cisco-sa-sdwan-webauth-xr8beuuU
• LevelBlue SpiderLabs: NetScaler CVE-2026-88771
• Microsoft Security Blog: CVE-2026-73570