The Security Brief: Windows, firewalls and email filters attacked before fixes arrived

What happened: Microsoft released its October 2026 security update on October 13, 14, 2026, confirming one actively exploited flaw in Windows Shell that allows an attacker to bypass a built-in security control. CyberScoop, SecurityWeek, Cisco Talos, and the SANS Internet Storm Center all reported on the release.

What to do: The CIO or IT leadership should confirm that October 2026 Windows security updates have been applied across all endpoints and servers, and that no systems are awaiting scheduled maintenance windows that would leave them unpatched.

Microsoft's October 2026 Patch Tuesday addressed a reported 1,413 to 1,417 vulnerabilities across its product range, depending on the source's counting method. Of those, sources report 76 to 85 were rated critical. One flaw stands apart: a confirmed, actively exploited weakness in Windows Shell that bypasses a security feature designed to warn users about files downloaded from the internet. According to the SANS Internet Storm Center, an attacker can deliver a malicious file by email or instant message, and the flaw activates when the recipient opens it. Microsoft confirmed exploitation is underway. Researchers at Tenable noted this is the third Windows Shell vulnerability exploited in 2026, and that 26 such flaws have been patched in Windows Shell this year alone, compared to three in all of 2025. The remaining vulnerabilities in this release, while numerous, are not reported as actively exploited at this time.

Who is affected: Any organization running Microsoft Windows on its endpoints or servers is potentially exposed. Given Windows is the dominant operating system in corporate environments, exposure is broad across industries and company sizes.

For your security team: CVE-2026-96951: Windows Shell Security Feature Bypass Vulnerability. CWE: Improper Neutralization of Special Elements used in a Command (Command Injection). CVSS base score: 8.8 (Cisco Talos). Exploited in the wild: confirmed. Attack vector: user must open a malicious file delivered via email or IM; bypasses Mark of the Web (MotW) protections. Prioritize patching all Windows endpoints and servers with October 2026 Patch Tuesday updates. Also assess CVE-2026-108398 (.NET framework security feature bypass, publicly disclosed pre-patch, not observed exploited) and CVE-2026-70571 (Exchange Server RCE, high attack complexity, triggered via email content conversion).

What happened: On October 16, 2026, Mandiant and Google Threat Intelligence reported that a suspected Chinese government-backed espionage group had been actively exploiting a critical security flaw in BeyondTrust Remote Support software, with attacks traced back to late August 2026.

What to do: The CIO should confirm whether the organization runs BeyondTrust Remote Support, verify that the October 8 patch has been applied or that cloud versions updated automatically, and commission a review of access logs for activity since late August.

A suspected Chinese state-backed espionage group, referred to by Mandiant as Armory Castle and previously tracked as UNC5221, reportedly exploited a critical flaw in BeyondTrust Remote Support software beginning in late August 2026. The flaw was used as a zero-day, meaning attackers exploited it before a fix existed. According to Mandiant and Google Threat Intelligence, the group escalated privileges, moved through compromised networks, and deleted logs to avoid detection. BeyondTrust says it released a patch for self-hosted customers on October 8 and automatically updated cloud-hosted versions the same day, coordinating with Mandiant on an investigation involving at least one confirmed self-hosted customer compromise. Google Threat Intelligence noted awareness of only a small number of affected organizations at the time of disclosure but cautioned that additional victims may exist given the stealth of the activity. Mandiant warned organizations to prepare for potentially wider exploitation, noting this group and others have historically conducted broad opportunistic attacks after vulnerability details become public. The group has a reported history of long-duration intrusions, including a prior campaign with an average dwell time of 400 days.

Who is affected: Mid-size and large enterprises that run BeyondTrust Remote Support, whether self-hosted or cloud-based, particularly those that had not applied the October 8 patch before the public disclosure triggered broader attention to the vulnerability.

For your security team: CVE-2026-102764 (CVSS 9.3) is an improper origin validation flaw in an internal messaging component of BeyondTrust Remote Support (formerly Bomgar). Armory Castle (UNC5221 / Warp Panda) used it for initial access, then deployed custom tooling for privilege escalation, lateral movement, and defense evasion including log deletion. The patch for self-hosted instances was released October 8, 2026; cloud instances were auto-updated the same day. Mandiant notes IoCs rotate per victim, so behavioral detection is required. Threat intelligence blog: https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/. Hunt for suspicious activity in BeyondTrust logs from late August onward.

What happened: Security firm Volexity reported on October 13, 2026 that attackers had chained three previously unknown flaws in Ivanti Connect Secure, a widely used remote-access gateway, to gain full control of affected devices without logging in. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its known-exploited list the same day.

What to do: The CIO should confirm whether the company runs Ivanti Connect Secure and verify that the patches Ivanti released for two of the three flaws have been applied, while tracking Ivanti's advisory for the status of the third, still-unpatched flaw.

Attackers chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance used for remote access, to bypass authentication, execute code remotely, and escalate to root-level privileges, according to Volexity. The earliest confirmed exploitation was October 1, 2026, and Volexity noted activity could potentially have begun in late September. Ivanti said it had discovered part of the vulnerability chain internally in June but did not issue an emergency patch because exploitation had not been observed at that time. A patch covering two of the three flaws has been released. A fix for the third flaw is still pending. Ivanti confirmed that a limited number of customers were compromised before disclosure. CISA added the flaw to its known-exploited vulnerabilities catalog on October 13. Volexity observed post-exploitation activity that included credential theft, extraction of directory metadata, and deployment of custom tools on a compromised customer device. This is reported to be the sixth Ivanti vulnerability confirmed exploited in 2026.

Who is affected: Mid-size and large companies that use Ivanti Connect Secure as a remote-access or VPN gateway, particularly those that had not applied the latest patches at the time of exploitation.

For your security team: CVE-2026-104935 affects Ivanti Connect Secure. Volexity (tracking the actor as UTA0576) observed a three-vulnerability chain enabling unauthenticated RCE with root/elevated privileges on fully patched appliances. Post-exploitation activity included credential dumping from the device, Active Directory metadata exfiltration, and deployment of custom malware. Ivanti has patched the authentication bypass and RCE components; the privilege escalation zero-day remains unpatched as of October 13, 2026. CISA KEV listing confirmed same date. Apply available patches immediately, monitor Ivanti's advisory for the third fix, and review appliance logs for activity from October 1 or earlier. Volexity blog post contains IOCs and TTPs.

What happened: Palo Alto Networks disclosed and released security updates for a high-severity remote code execution flaw in its PAN-OS firewall software that has been exploited in attacks, as reported by BleepingComputer on October 14, 2026.

What to do: The CIO should confirm whether the organization runs PAN-OS-based firewalls and verify that the vendor-issued security updates have been applied.

Palo Alto Networks has confirmed a high-severity flaw in its PAN-OS operating system, which powers its firewall products. The flaw allows a remote attacker to execute code on an affected device without requiring physical access. The vendor confirmed the flaw has been exploited in real attacks targeting firewalls before a patch was available, making it a zero-day. Security updates have now been released. The scope of exploitation, the identity of the attackers, and the number of organizations affected have not been confirmed by an authoritative source. Companies that rely on Palo Alto firewall products for network perimeter security should treat this as a confirmed, active threat requiring prompt attention from their technology and security leadership. No secondary effect on end-user data or financial systems has been confirmed at this time, though perimeter compromise can enable broader network access.

Who is affected: Mid-size and large organizations that deploy Palo Alto Networks firewall appliances or software running PAN-OS as part of their network perimeter or security infrastructure.

For your security team: The vulnerability is tracked as CVE-2026-0322, a high-severity RCE zero-day in PAN-OS. Exploitation has been confirmed in the wild targeting firewalls. Security teams should immediately apply vendor-released patches, review firewall logs for indicators of compromise, and assess whether management interfaces are exposed to untrusted networks. Refer to the Palo Alto Networks security advisory and BleepingComputer coverage for specific affected PAN-OS versions, patch versions, and any available IOCs. Unit 42 has published related threat intelligence on third-party risk that may provide supplementary detection context.

What happened: ConnectWise reported on October 17, 18, 2026, that unknown attackers used a compromised credential tied to its cloud backup service to gain unauthorized access to 173 Microsoft 365 customer environments. ConnectWise subsequently disabled the service and seven associated application identities.

What to do: The CIO or IT lead should confirm with the company's managed service provider whether ConnectWise Cloud Backup was used to manage the company's Microsoft 365 environment, and if so, determine whether that tenant appears in the list of 173 affected accounts.

ConnectWise Cloud Backup, a cloud-based backup and recovery service sold through managed service providers, was compromised when attackers gained access to a Microsoft 365 credential belonging to ConnectWise. Researchers reported on October 17, 2026, that this credential was used to sign in to 173 distinct Microsoft 365 customer tenants. ConnectWise confirmed the incident and disabled seven application identities associated with the service. The service was previously known as SkyKick Cloud Backup before ConnectWise acquired it. Because the backup service holds delegated access to customer Microsoft 365 environments, a single compromised credential at the service-provider level can expose multiple end-customer organizations simultaneously. The identity of the attackers and the full scope of what data, if any, was accessed within those tenants has not been confirmed. The investigation was described as ongoing as of the dates of reporting.

Who is affected: Mid-size and large companies whose managed service providers used ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) to manage or protect their Microsoft 365 environments. Because the service is sold through managed service providers, end customers may be unaware their Microsoft 365 tenant was connected to this platform.

For your security team: Attackers abused a compromised M365 OAuth application identity (service principal) belonging to ConnectWise Cloud Backup to authenticate into 173 downstream customer M365 tenants via delegated permissions. ConnectWise disabled seven app identities including ConnectWise Cloud Backup (app ID: 506e08f9-6e9a-4da4-942b-a099a03644ae). Security teams should audit M365 Entra ID enterprise applications and OAuth consent grants for any ConnectWise or SkyKick application identities, review sign-in logs for access originating from those app IDs, and check for anomalous access to SharePoint, Exchange, or OneDrive data during the incident window. Revoke any remaining delegated permissions tied to disabled identities. The attack vector is consistent with supply-chain compromise via MSP tooling.

What happened: Cisco disclosed on October 14, 2026, in a published advisory, that attackers are actively exploiting a critical flaw in its Secure Email Gateway appliance.

What to do: The CIO should confirm whether the organization operates Cisco Secure Email Gateway appliances and verify that Cisco's remediation guidance has been applied.

Cisco confirmed in an October 14, 2026 advisory that a critical vulnerability in its Secure Email Gateway is being actively exploited. The flaw allows an unauthenticated sender to deliver a specially crafted email attachment through the gateway that, if successful, writes files to the appliance's underlying operating system. According to Cisco, a successful exploit could allow an attacker to execute commands with root-level privileges on the device. The Secure Email Gateway is widely used by mid-size and large organizations to filter inbound and outbound email for spam and malware. Because the attack vector is an ordinary email, no credentials or prior access to the organization's network are required to attempt exploitation. The full scope of confirmed intrusions has not been publicly detailed. Organizations relying on this appliance as a primary email security control should treat this as an active threat requiring prompt attention from technical teams.

Who is affected: Mid-size and large organizations that deploy Cisco Secure Email Gateway appliances to filter organizational email traffic.

For your security team: The vulnerability affects Cisco Secure Email Gateway (SEG) and is described as a critical unauthenticated arbitrary file write flaw triggered via a malicious email attachment, enabling post-exploitation remote code execution (RCE) as root. No CVE number or specific version range was available in the provided source text. Cisco's advisory should be consulted for affected versions, fixed releases, and any available indicators of compromise. Patch or mitigate per Cisco's advisory guidance. Review appliance logs for anomalous file write activity or unexpected process execution. Active exploitation is confirmed by Cisco.

What happened: On October 14, 2026, Microsoft reported that its Digital Crimes Unit, working with Japan's National Police Agency and Health-ISAC, obtained a U.S. federal court order to seize and redirect domains supporting a Chinese-language phishing marketplace and its associated tools.

What to do: The CIO should confirm whether the security team has reviewed authentication logs and cloud environment access records from the past year for signs of phishing-linked credential compromise, particularly for Microsoft or Google cloud accounts.

Microsoft's Digital Crimes Unit, alongside industry partner Resecurity, Japan's National Police Agency, and Health-ISAC, disrupted an interconnected Chinese-language cybercriminal ecosystem that sold phishing tools and infrastructure through an underground marketplace. The marketplace, which Microsoft tracks as Storm-3119, offered at least three phishing kits. Microsoft tracks the developers of those kits as Storm-2990. Since January 2026, the ecosystem reportedly facilitated more than one billion phishing emails and SMS messages sent to more than 75,000 organizations across 150 countries. Targeted sectors include healthcare, financial services, wholesale distribution, and information technology. The tools provided access to compromised or fraudulent Microsoft and Google cloud environments. The disruption was achieved through a U.S. court order that seized and redirected domains underpinning the marketplace and its kits. Microsoft assesses with high confidence that the developers are Chinese-speaking, though the full scope of downstream criminal activity remains under investigation.

Who is affected: Organizations in healthcare, financial services, wholesale distribution, and information technology with a presence in the United States, Japan, Australia, or India are most directly identified as targets. Given that the reported reach spans 150 countries and more than 75,000 organizations, exposure is not limited to those regions.

For your security team: Three phishing kits sold via the YAM Store underground marketplace (tracked as Storm-3119) are attributed to developer cluster Storm-2990: CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. Infrastructure included compromised or fraudulent Microsoft and Google cloud tenants used for phishing delivery. The DCU, with Health-ISAC and Japan NPA, executed a court-ordered domain seizure and sinkhole. Teams should hunt for Storm-2990 and Storm-3119 IOCs published in Microsoft's October 14, 2026 security blog. Review Entra ID and Google Workspace sign-in logs for adversary-in-the-middle or token-theft patterns consistent with these kits. Microsoft Defender detections are noted in the source blog.

What happened: On the night of October 11, 2026, attackers took remote control of refrigeration units at roughly 700 French supermarkets and forced temperatures up, causing food spoilage; several affected retail chains, including Les Mousquetaires, reported the incident, and SecurityWeek covered it on October 13 and October 15.

What to do: The COO or head of facilities should confirm whether refrigeration or other building-control equipment at company sites can be accessed remotely by outside maintenance firms, and ask those firms how that access is protected and whether any controllers cannot receive security updates.

Attackers remotely hijacked refrigeration controllers at roughly 700 French supermarkets overnight on October 11, 2026, ordering units to heat up and remain hot rather than completing the brief, normal overnight defrost cycle. One affected supermarket chain reported temperatures reached 50°C (120°F). Stores were forced to discard spoiled food. The controllers targeted are made by Danish manufacturer Danfoss and are designed to let maintenance companies manage all of a store's refrigeration remotely. The attack later reportedly widened to controllers made by other manufacturers. Danfoss stated that the affected units were older models whose security software could not be updated to address a risk the company had already identified. No group has claimed responsibility for the attack. Authorities have not publicly named suspects or confirmed the attack vector.

Who is affected: Supermarkets, grocery chains, food distributors, cold-storage operators, and any facility that uses internet-connected refrigeration or building-control equipment managed remotely by outside maintenance firms, particularly those running older controller hardware that cannot receive security updates.

For your security team: Attackers exploited remote-management interfaces on Danfoss refrigeration controllers (older models confirmed by Danfoss as unpatchable against an already-identified risk). The attack reportedly widened to Copeland and Dixell controllers. Attack vector not publicly confirmed; remote access used by third-party HVAC/refrigeration maintenance firms is the suspected entry point. No CVE published at time of reporting. No threat actor has claimed responsibility. Mitigations to assess: network segmentation of OT/BMS devices, restriction or monitoring of third-party remote-access sessions, inventory of unpatchable controllers for replacement, and review of vendor remote-access credentials and session controls.

What happened: Citizen Lab at the University of Toronto reported on October 15, 2026, that devices at the Al Jazeera media network were infected with Candiru spyware through ordinary online advertisements that required no click or any other action from the user.

What to do: The CIO should confirm whether the organization's ad-blocking and network monitoring controls would detect or block outbound connections triggered by ad content loading in the background.

Citizen Lab researchers reported that Israeli spyware maker Candiru infected devices at Al Jazeera through ads served by an Israeli company called Discover-Tech, which Citizen Lab describes as presenting itself as a legitimate advertising firm while reportedly facilitating spyware delivery for mercenary spyware vendors. The attack is described as zero-click: the malicious code ran the moment an ad loaded, and in some cases the ad loaded out of sight in the background. Discover-Tech was registered in 2020 and reportedly has facilitated mercenary spyware activity since at least 2024, though Citizen Lab links a broader campaign it calls DARK CARTOGRAPHER to activity dating to 2019. Ad security firm Confiant, a partner in the investigation, reported that Discover-Tech ads have appeared on networks belonging to the U.S. Department of Defense, NATO, the International Atomic Energy Agency, and cybersecurity agencies, though infections at those organizations have not been confirmed. Citizen Lab called on regulators to investigate Discover-Tech and consider sanctions. The researchers described the advertising industry's failure to detect the operation for years as, in their words, 'disastrous.'

Who is affected: Organizations in media, government, defense, and civil society whose employees browse the web on managed or personal devices; companies that rely on programmatic advertising networks, either as publishers or advertisers, face reputational and liability questions about ad content they carry or fund.

For your security team: Citizen Lab's campaign is labeled AdFection. The delivery mechanism is zero-click spyware via programmatic display ads served through Discover-Tech (registered 2020), acting as a front for Candiru. Ads covertly redirect devices to Candiru C2 infrastructure upon render, including off-screen or background ad slots. Confiant identified Discover-Tech ad tags appearing on DoD, NATO, IAEA, and cybersecurity agency networks. DARK CARTOGRAPHER is the broader threat cluster, active since 2019, involving Discover-Tech and an unnamed U.S. intelligence contractor. Mitigations to review: DNS-layer blocking of known Candiru infrastructure, strict Content Security Policy headers on owned web properties, network egress monitoring for ad-initiated outbound connections, and restricting third-party ad JavaScript execution in high-security environments.

What happened: The U.S. Department of Justice announced on October 14, 2026, charges against 14 people and the seizure of roughly 187 computers tied to a scheme in which North Korean nationals, using stolen or fabricated identities, held remote jobs at more than 70 U.S. companies. Investigators searched more than 40 locations in Texas where facilitators maintained employer-issued laptops so the overseas workers could appear to be based in the United States.

What to do: The chief human resources officer, working with legal counsel, should confirm that the company's remote hiring process includes identity verification steps that go beyond reviewing a resume and conducting a video call.

Federal prosecutors in the Northern District of Ohio unsealed an indictment charging two U.S. citizens and 10 Chinese nationals, along with two unnamed defendants, for allegedly holding remote technology jobs at more than 70 companies from 2019 through 2025 under stolen or fabricated identities. The group reportedly collected about $3 million in pay that was directed to North Korea. Two arrests have been made. Investigators executed searches at more than 40 residences in Texas that were operating, or were suspected to be operating, as so-called laptop farms, where local facilitators kept employer-issued computers running so that North Korean engineers working from abroad could log in and perform the jobs remotely. The Justice Department framed the enforcement action as part of a continuing effort to cut off a revenue stream that the North Korean government allegedly uses to fund its weapons programs. Multiple indictments on similar schemes have been filed since 2024, and U.S. and allied governments have previously warned that the broader scheme has persisted despite those actions.

Who is affected: Companies of any size that hire remote technology workers are exposed. The scheme targeted firms broadly enough that more than 70 U.S. companies were reportedly affected over roughly six years, suggesting no particular industry or company size is excluded.

For your security team: The scheme relied on laptop farms at U.S. residential addresses to proxy RDP or similar remote-access sessions, making the worker's IP appear domestic. Indicators to review: employer-issued devices registered to residential addresses in clusters, login patterns inconsistent with declared time zones, payroll accounts routing to money-transfer services or third-party intermediaries, and identity documents that do not survive reverse-image or cross-database checks. OSINT on device geolocation during onboarding and liveness checks during video interviews are mitigations cited in prior FBI and CISA guidance on this threat category. No specific CVEs or malware families are associated with this particular enforcement action.