『Rooted by an Email Attachment: Cisco Gateway and PAN-OS Under Attack』のカバーアート

Rooted by an Email Attachment: Cisco Gateway and PAN-OS Under Attack

Rooted by an Email Attachment: Cisco Gateway and PAN-OS Under Attack

無料で聴く

ポッドキャストの詳細を見る
Rooted by an Email Attachment: Cisco Gateway and PAN-OS Under Attack Thursday, October 15, 2026: Attackers are rooting Cisco Secure Email Gateways with a crafted attachment, a PAN-OS management bug is exploited for root, Langflow's MCP server feature is being abused for code execution, a Collabora add-on is backdooring Nextcloud servers, and AI agents built a $250,000 Chrome full-chain exploit in six days. 1. Cisco's email gateway is getting rooted by email Cisco confirmed attacks on a critical Secure Email Gateway flaw that lets an unauthenticated sender write files to the OS and run commands as root via a crafted attachment. Only gateways with File Reputation (AMP) enabled and Content Scanner Tools older than 25.3.0.5525 are vulnerable. The fix shipped quietly on September 14 in a hardening release; this is the second exploited Secure Email Gateway flaw in a month. CVEs: CVE-2026-76519 (CVSS 9.8, exploited); related: CVE-2026-76461 (September SQL injection, exploited) Do this today: run contentscannerstatus on every gateway and confirm Content Scanner Tools 25.3.0.5525 or later (or AsyncOS 15.5.5-014 / 16.5.0-780), then run grep "System Security" system_logs on every cluster member. Source: The Hacker News 2. Palo Alto's firewall management page is under attack Palo Alto Networks patched an authenticated RCE in the PAN-OS management interface that gives root on PA-Series and VM-Series firewalls and Panorama, and acknowledged "very limited exploitation." Cloud NGFW and Prisma Access are not affected. CISA added it to KEV with an October 17 federal deadline. CVE: CVE-2026-0322 (CVSS 8.6, exploited) Do this today: restrict the management interface to a single jump box, block 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234, and install the fixed hotfix for your branch (for example 12.2.4 or 11.1.16-h3). Source: The Hacker News 3. Langflow lets any user plant a shell disguised as an MCP server In Langflow before 1.9.0, any authenticated user can add an MCP server with the stdio transport whose command field goes straight to bash. Previdian's honeypots logged 1,423 exploit attempts since September 19, with attackers logging in using common credentials and going after LANGFLOW_SECRET_KEY and LANGFLOW_SUPERUSER_PASSWORD. CVE: CVE-2026-105740 (CVSS 9.9, exploited) Do this today: upgrade Langflow to 1.9.0 or later, disable auto-login, remove default passwords, and review logs for requests to /api/v2/mcp/servers/. Source: The Hacker News 4. Nextcloud servers are getting web shells through an office add-on Attackers used a command injection in the optional Collabora Online - Built-in CODE Server app (richdocumentscode) to drop web shells on Nextcloud servers, starting September 10. It works only while the local CODE server is down. One attacker searched for password vaults and crypto wallets. Disabling the app does not fix it. CVE: CVE-2026-110447 (exploited) Do this today: update Built-in CODE Server to 26.4.303 or later or remove it, delete any shx*.php files in apps/richdocumentscode, and check access logs back to September 10 for suspicious proxy.php?status requests. Source: The Hacker News 5. AI agents built a quarter-million-dollar Chrome exploit in six days XBOW used AI agents running OpenAI's public GPT-5.6 Sol model to chain three Chrome bugs into a Windows full-chain exploit that escapes both sandboxes from a page load. Google fixed all three and paid its top $250,000 reward. The six-day sprint cost about $40,000 in AI charges. CVE: CVE-2026-85045 (V8); fixed in Chrome 152.0.7977.65 and 152.0.7977.82 Do this today: relaunch Chrome everywhere and confirm version 152.0.7977.82 or later. Source: The Hacker News More from Matt: https://www.mattchapman.net Kindle: https://www.amazon.com/dp/B0HHMH88H9 Apple Books: https://books.apple.com/us/book/local-ai-on-the-mac/id6807243472Barnes & Noble: https://www.barnesandnoble.com/w/books/1151622292?ean=2940185390764https://mattchSupport the show
adbl_web_anon_alc_button_suppression_t1
まだレビューはありません