What this means for your clients: attackers are using a flaw in Cisco's remote-access firewalls to force them to restart. The fix is a software upgrade, plus checking each VPN connection profile for one setting. The VPN login page on a Cisco ASA or FTD can be used to crash the firewall. A device is exposed when secondary authentication is set on a tunnel group it serves: with the login page's group list on, that is any tunnel group, including the default group, DefaultWEBVPNG

Update, 30 October: CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26. On October 28 it added the Linux kernel flaw CVE-2026-46300, and CISA's KEV entry says that flaw can be chained with both PHP bugs to implant PHP webshells and run commands as root. Dream Research, which calls the kernel flaw Fragnesia, reports a campaign that did exactly that: a custom PHP2Shell exploit plus Fragnesia rooted 25 Palo Alto Networks P

Cisco ISE CVE-2026-76460 is on CISA KEV with a 19 September deadline, and the API it abuses never asked for an admin session. Patch the branch, then hunt the access logs for what arrived before you did: unauthenticated API calls, root, and credentials that moved.

A software repository sits between the people who build software and the systems that run it. When that repository is compromised, the investigation needs to answer more than whether someone accessed a server. It needs to establish whether the company can still trust the identities, credentials, and artifacts passing through it. Recent Artifactory exploitation illustrates why. Two vulnerabilities allow an attacker to obtain a token and escalate its authority. A separate vulne

Hunt GitLab CVE-2026-85706: unauth commits API path traversal. POST /repository/commits with file.path. watchTowr ITW Sep 11. CISA KEV due Sep 14.