Daily brief: Friday 30 October 2026
Attackers are hitting exposed Palo Alto management pages and Cisco SSL VPNs, the US government orders Acronis out of federal systems, and researchers find holes in the browsers built into AI coding tools.
Palo Alto firewalls with exposed management pages are being attacked through PHP2Shell
Palo Alto Networks warned on 28 October that the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, are being exploited against PAN-OS management interfaces that can be reached from the internet. The risk covers the HTTPS web UI and XML API, and dataplane interfaces only where a management profile is attached. Fixed PAN-OS hotfixes are out for the 12.2, 12.1, 11.2, 11.1 and 10.2 branches, though some were due on 29 or 30 October. Separately, the firm Dream reported a suspected China-nexus group chaining PHP2Shell with the Linux flaw Fragnesia (CVE-2026-46300) to get root on 25 servers. Dream did not name the firewall vendor, so the link to Palo Alto is not confirmed.
Source: The Hacker News · Help Net Security
Cisco warns of an exploited ASA and FTD flaw that reboots SSL VPN devices
Cisco says CVE-2026-76418, a high-severity denial-of-service flaw in ASA and Firewall Threat Defense (FTD) software, has been exploited. An attacker with no login can send a crafted request to the SSL remote access VPN and make the device reload. It affects devices with SSL VPN enabled and secondary authentication configured on a tunnel group. Cisco has not shared indicators of compromise, and there is no workaround that fully fixes it.
Source: BleepingComputer
US Homeland Security orders Acronis products out of federal civilian systems
The US Department of Homeland Security has issued an exclusion and removal order against Acronis AG. US federal civilian agencies must stop buying its products and remove them within 180 days. The order's summary of risks says Acronis's cyber and backup tools have "privileged or root access to customer security systems", but it gives no more detail. Acronis said the order was expected, applies only to US federal agencies and "does not affect our customers and partners".
Source: Federal News Network · ExecutiveGov
VMware ESX logging flaw used by a China-linked group is added to CISA's list
CISA added CVE-2026-41709, an insufficient logging flaw in VMware ESX, to its Known Exploited Vulnerabilities catalog on 28 October. CrowdStrike says the China-nexus group Warp Panda used it as a zero-day in an intrusion early this year to cut down what the audit trail recorded. Broadcom fixed it in July 2026.
Source: Help Net Security
Researchers find flaws in the browsers built into AI coding tools
Forever Security tested the built-in browsers in Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop. In Cursor, a web page and one press of Enter let the agent run an attacker's command. In Codex, VS Code and Claude Desktop, a single local HTML file could read files elsewhere on the disk, including SSH keys and .env files. Cursor and Copilot have fixed their issues. Microsoft declined the VS Code report, and as of 29 October no fix was available for Codex or VS Code.
Source: Help Net Security
Binance says a hacked engineer's laptop led to a huge crypto theft
Binance said a security incident affected about $6.3 billion in assets, and nearly $3 billion had been frozen so far. Its early investigation points to a compromised DevOps engineer's laptop, which let the attacker reach a service container and submit unauthorised withdrawals. Binance said it has seen no evidence that wallet private keys leaked. This is a developing story and the figures may change.
Source: The Hacker News
Windows policy-based app removal now works on multi-session devices
Microsoft says policy-based removal of built-in apps now supports multi-session environments. It works on Windows 11 Enterprise and Education, version 24H2 and later, and covers preinstalled Microsoft Store apps and other MSIX and APPX packaged apps.
Source: Microsoft Windows message center
Weather
Live forecastLoading the forecast…