A mail gateway reads every inbound attachment so nobody else has to. Cisco says one crafted attachment passing through an affected gateway can give an unauthenticated sender root. Nobody has to open it. That same root access can tidy the logs on the box, so the box is the last place to ask what happened. Cisco published advisory cisco-sa-esa-afw-zqYJkjxp on 14 October 2026 for CVE-2026-76519, a Critical Secure Email Gateway arbitrary file write bug in the Advanced Malware Pro

Picture an agency developer poking around a client's WordPress server and finding, in a folder that should only hold photos, a file named like an admin login page. The extension is PHP, it lives under wp-content/uploads, and nobody on the team put it there. On 8 October 2026, Patchstack published active exploitation attempts against Bricksforge, a commercial add-on for Bricks Builder, tracked as CVE-2026-85097. It first saw the traffic at 21:47:17 UTC on 7 October (2:47 PM PT

Picture an MSP technician checking the backup server on a Thursday morning because the fans are loud. Task Manager opens, CPU looks normal, and the window closes. An hour later the box is pinned again. The process doing the work is called edge.exe, it lives in a Temp folder, and the service that keeps it alive is called MicrosoftEdgeUpdateSvc. Nobody on the team installed Edge on that server. On 8 October 2026, Huntress reported threat actors chaining two AhsayCBS flaws, CVE-

Chinese state-linked hackers are disguising VPN backdoors as legitimate Windows processes. Here is how to hunt for them in your environment.

The firewall admin signs in on a Monday and the password is wrong. It worked on Friday. The admin list now holds an account called something like forticloud-sync that nobody remembers creating. Someone knew a password that still worked. On 6 October 2026, the FBI and the US Secret Service published joint advisory JCSA-20261006-01 on FortiBleed, "an active, global credential-compromise campaign" against internet-facing FortiGate firewalls and SSL VPN gateways. SOCRadar, cited

CVE-2026-21589 lets unauthenticated attackers read files from eight Atlassian Data Center products. Patch now, block with the WAF regex, and hunt your access logs for the two-dot pattern.

Rejetto HFS CVE-2026-61500 lets attackers forge an admin cookie from a weak Math.random() signing key, then reach remote code execution. Versions 3.0.0 through 3.2.0 are affected; 3.2.1 fixes it. Four hunts to find the activity in your logs.

Zammad CVE-2026-102489 and CVE-2026-102490 chain a session hijack into root. CISA's deadline is today. Recheck the patch status, then run these four hunts.

FortiMail CVE-2026-104286 lets an unauthenticated attacker write files onto the appliance. Fortinet shipped the fixes on Oct 5. Patch now, then run these four hunts.

Star Blizzard's RedFlick chain needs one click, then runs entirely on binaries that ship with Windows: conhost.exe, ssh.exe, control.exe, curl. It ends in three scheduled tasks named like maintenance. Over 100 organisations hit. Four hunts in Defender KQL, Falcon CQL, Splunk and Kibana.

A WAF denial is not proof the request failed. See how attackers used /%50SEMHUB/ to exploit CVE-2026-35273—and run four practical hunts.