ITsecurity Daily
Daily Briefing
Three actively exploited flaws hit CISA's KEV list — Palo Alto, Microsoft and Ivanti all need patching
Good morning. CISA's Known Exploited Vulnerabilities catalog lists three vulnerabilities as known to be exploited. CVE-2026-0322 in Palo Alto Networks PAN-OS carries a CVSS base score of 7.2; the advisory lists PAN-OS as affected up to the fix in 10.2.0. CVE-2026-96951 in Microsoft Windows Server carries a CVSS base score of 8.8; Microsoft's advisory lists versions affected up to the fix in 10.0.14393.9612, and the CVSS vector requires user interaction. CVE-2026-104935 in Ivanti Connect Secure carries a CVSS base score of 8.6; the Ivanti advisory lists version 22.8 as affected. Match these versions against your estate and apply the fixed releases the vendor advisories name, in line with CISA BOD 26-04 patching guidance.
Two Progress MOVEit Transfer flaws, CVE-2026-89073 and CVE-2026-89068, each carry a CVSS base score of 9.8; the Progress bulletin lists MOVEit Transfer as affected up to the fix in 2025.1.6. Neither is on the KEV list. Google's Chrome advisory lists CVE-2026-110916, CVSS base score 9.6, as fixed in 155.0.8059.84.
On supply-chain compromise: Help Net Security and The Record report ConnectWise suspended its Cloud Backup service after attackers abused a compromised credential belonging to the Cloud Backup application to reach organisations' Microsoft 365 accounts; The Record notes ConnectWise confirmed the unauthorised access on Saturday. BleepingComputer reports some downloads of the Rank Math PRO WordPress plugin from the vendor's official site carried malware that planted backdoors last week, and that attackers hijacked AOMEI's servers to push malware through a promotional feature in its backup software before restoring the files to hide the activity. SecurityWeek reports attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures. The Hacker News reports threat actors are exploiting a chain of Plex Media Server flaws to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept went public, citing a researcher using the alias boredhackerblog.
Zoom out: The Register reports Terra found a sharp rise in GitHub security fixes reported broken within 90 days, under the headline that security patches need patches now that attackers have AI.
Vulnerability in focus
CVE-2026-0322 — Palo Alto Networks. CVSS 7.2 CISA lists it as known to be exploited.
Affected: panos.
What to do: Follow the vendor advisory for the fixed release and any interim mitigation.
Elsewhere
- The Hacker News: Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge Read it
- Help Net Security: EasyDMARC and GMO GlobalSign connect email authentication with verified branding Read it
- Help Net Security: Cybersecurity jobs available right now: October 20, 2026 Read it
- The Register: Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline Read it
- The Record: Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users Read it
- BleepingComputer: Hackers hijack AOMEI update servers to secretly spread malware Read it
- The Record: Two more Serbian opposition figures targeted with spyware, researchers say Read it
- BleepingComputer: Bullhorn takes staffing platform offline to contain cyberattack Read it
- The Hacker News: Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor Read it
- The Register: Security patches need patches now that attackers have AI Read it
- SecurityWeek: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks Read it
- The Hacker News: Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor Read it
Sources
- Nikkei discloses third data breach in a month, 1.8M records exposed BleepingComputer
- Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline The Register
- Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users The Record
- Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks SecurityWeek
- Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor The Hacker News
- Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site Krebs on Security
- ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access Help Net Security
- Training AIs to Solve CAPTCHAs Schneier on Security
- WordPress SEO plugin Rank Math compromised to backdoor websites BleepingComputer
- ConnectWise suspends Cloud Backup service after supply chain attack The Record
- Hackers hijack AOMEI update servers to secretly spread malware BleepingComputer
- Bullhorn takes staffing platform offline to contain cyberattack BleepingComputer
- Two more Serbian opposition figures targeted with spyware, researchers say The Record
- Security patches need patches now that attackers have AI The Register
Share this issue
Facebook · X · Reddit · LinkedIn · WhatsApp · Email · Bluesky
Every briefing is on the site, with the advisory record behind it. All briefings