What this means for your clients: any client website that switched on a Rank Math PRO 3.0.123 copy downloaded or updated during the affected window on October 15 or 16 should be treated as hacked, and installing the newer version alone does not clean it up. Picture a small agency that looks after a stack of client sites, every one running the same premium WordPress plugin, with updates switched on. On a Thursday afternoon, the agency's scheduled update job pulls the latest bu

A small office runs Nextcloud on one server, and staff edit spreadsheets in the browser without asking how. It works because of one optional app, added from the app store long ago, that downloads a copy of a document server and runs it on the same box. Most days nobody thinks about it. When the machine restarts, there is a short stretch before that bundled server is back, and during it the app's plain PHP file tries to start the server again with each request that comes in. C

Picture an admin opening the Microsoft Entra sign-in logs on a Friday evening and finding a sign-in from an app the company approved long ago. There is no user, no device and no MFA prompt. The source is a hosting provider address, not Microsoft's network. Nobody in the tenant clicked anything, and nobody in the tenant held the credential that signed in. ConnectWise says it identified unauthorized access to application identities associated with its Cloud Backup environment,

A help desk technician starts a remote session to fix a laptop, and the tool does its job. Behind that session sits one appliance that holds the access for everything the help desk can reach. Mandiant says root on it gives an attacker access to every credential the appliance stores or brokers, and both Mandiant and BeyondTrust say this actor deleted logs. The box is the last place to ask what happened. BeyondTrust published advisory BT26-05 on 15 October 2026 for CVE-2026-102

A mail gateway reads every inbound attachment so nobody else has to. Cisco says one crafted attachment passing through an affected gateway can give an unauthenticated sender root. Nobody has to open it. That same root access can tidy the logs on the box, so the box is the last place to ask what happened. Cisco published advisory cisco-sa-esa-afw-zqYJkjxp on 14 October 2026 for CVE-2026-76519, a Critical Secure Email Gateway arbitrary file write bug in the Advanced Malware Pro

Picture someone in finance opening a file that arrived in a chat message. There is no yellow bar, no "this file came from the internet" prompt and no SmartScreen warning. If something runs next, nothing on the screen tells them, and nothing tells you either. Microsoft released CVE-2026-96951 on 13 October 2026 as a Windows Shell Security Feature Bypass Vulnerability, marked Exploited: Yes and Publicly disclosed: No. CISA added it to the Known Exploited Vulnerabilities catalog

Picture a Connect Secure box, fully patched at the time, passing a clean Integrity Checker run after its AD service account has been used to search for LAPS passwords and BitLocker recovery keys. Based on what Volexity found on the device it investigated, that outcome is realistic on this chain. Volexity reported on 13 October 2026 that a previously unknown actor it tracks as UTA0576 chained three bugs in Ivanti Connect Secure to get unauthenticated root. Two are tracked as C

Picture a platform engineer finding a new workflow called Security Audit on the default branch, committed under a longtime maintainer's real name, with no pull request and a run that already finished. The cloud key someone committed years ago and deleted the next morning was in the history it read. StepSecurity reports that on 8 October 2026 two hijacked maintainer accounts pushed a fake "Security Audit" workflow to 345 repositories in two sweeps that each took minutes. It se

Picture an agency developer poking around a client's WordPress server and finding, in a folder that should only hold photos, a file named like an admin login page. The extension is PHP, it lives under wp-content/uploads, and nobody on the team put it there. On 8 October 2026, Patchstack published active exploitation attempts against Bricksforge, a commercial add-on for Bricks Builder, tracked as CVE-2026-85097. It first saw the traffic at 21:47:17 UTC on 7 October (2:47 PM PT

Picture an MSP technician checking the backup server on a Thursday morning because the fans are loud. Task Manager opens, CPU looks normal, and the window closes. An hour later the box is pinned again. The process doing the work is called edge.exe, it lives in a Temp folder, and the service that keeps it alive is called MicrosoftEdgeUpdateSvc. Nobody on the team installed Edge on that server. On 8 October 2026, Huntress reported threat actors chaining two AhsayCBS flaws, CVE-

Chinese state-linked hackers are disguising VPN backdoors as legitimate Windows processes. Here is how to hunt for them in your environment.

CVE-2026-21589 lets unauthenticated attackers read files from eight Atlassian Data Center products. Patch now, block with the WAF regex, and hunt your access logs for the two-dot pattern.

Rejetto HFS CVE-2026-61500 lets attackers forge an admin cookie from a weak Math.random() signing key, then reach remote code execution. Versions 3.0.0 through 3.2.0 are affected; 3.2.1 fixes it. Four hunts to find the activity in your logs.

Zammad CVE-2026-102489 and CVE-2026-102490 chain a session hijack into root. CISA's deadline is today. Recheck the patch status, then run these four hunts.

FortiMail CVE-2026-104286 lets an unauthenticated attacker write files onto the appliance. Fortinet shipped the fixes on Oct 5. Patch now, then run these four hunts.

CVE-2026-76504 lets an unauthenticated attacker reach the Cisco SD-WAN Manager admin API with a single encoded request. Here is how the bypass works, how to mitigate it, and four hunts (Splunk, Kibana, Falcon, KQL) to find encoded logins in your logs.

CVE-2026-73570 turns a crafted SMTP message into command execution on a Zimbra mail server, through the optional zimbra-snmp notification path. CVSS 8.9, on CISA KEV, and Shadowserver counts 270-plus compromised instances. The fix landed three weeks before disclosure, so start your lookback at the patch date.

Star Blizzard's RedFlick chain needs one click, then runs entirely on binaries that ship with Windows: conhost.exe, ssh.exe, control.exe, curl. It ends in three scheduled tasks named like maintenance. Over 100 organisations hit. Four hunts in Defender KQL, Falcon CQL, Splunk and Kibana.

Identity and access management is no longer just an enterprise challenge. With hybrid work, cloud adoption, and the rise of generative AI, small and mid-sized businesses (SMBs) are facing the same risks — often with fewer resources. Microsoft’s Secure Employee Access Report 2025 highlights the problem: “58% of security leaders expect the number of identities in their organization to grow in the next year.” “61% reported an increase in identity- and network-related incidents d