A help desk technician starts a remote session to fix a laptop, and the tool does its job. Behind that session sits one appliance that holds the access for everything the help desk can reach. Mandiant says root on it gives an attacker access to every credential the appliance stores or brokers, and both Mandiant and BeyondTrust say this actor deleted logs. The box is the last place to ask what happened. BeyondTrust published advisory BT26-05 on 15 October 2026 for CVE-2026-102

Cisco ISE CVE-2026-76460 is on CISA KEV with a 19 September deadline, and the API it abuses never asked for an admin session. Patch the branch, then hunt the access logs for what arrived before you did: unauthenticated API calls, root, and credentials that moved.

The process tree still sitting on the box is not a closed Chrome patch ticket. It is chrome.exe (or msedge.exe / brave.exe) spawning cmd.exe, which spawns curl.exe, which writes %TEMP%\msgbox.exe or %TEMP%\ChromeUpdate.exe and runs it. Proofpoint tracks that default BlueMoon breakout, and the follow-on loaders are what operators actually keep. A hot stable build does not rewrite a curl stub that already ran from the broker. This hunt shop is not a second CVSS recap, and it is

A recent MIT Technology Review Report revealed that 66 zero-day attacks in 2021 were recorded in 2021, nearly double the attacks in 2020. For example, security researchers discovered a security flaw in Fortinet's web application firewall that permits attackers to run arbitrary malicious codes on severs and devices protected using the security solution. Attackers can compromise the vulnerability to compromise devices, escalate privileges, and control them. For example, they