Threat Digest — October 15, 2026: PAN-OS & Cisco Zero-Days

Top Stories#

Actively exploited PAN-OS vulnerability requires emergency review

Palo Alto Networks warned that a PAN-OS remote-code-execution vulnerability is being exploited in attacks. Organizations should identify exposed firewalls, confirm affected versions, apply the vendor’s emergency guidance, and review telemetry for suspicious activity. For background, see our zero-day glossary.

Source: BleepingComputer

Cisco patches exploited Secure Email Gateway zero-day

Cisco patched a zero-day affecting its Secure Email Gateway that was exploited in attacks. Email security appliances warrant immediate attention because they sit on critical mail flows and often have broad network visibility.

Administrators should verify appliance versions, apply the relevant Cisco remediation, restrict management access, and review administrative, network, and mail-processing logs for anomalous activity.

Source: BleepingComputer

UK Legal Aid Agency reports theft of decades of records

Hackers stole records from the UK Legal Aid Agency dating back to 1978. Older records can remain operationally and legally significant even when they are no longer part of daily business workflows.

Organizations should identify legacy data stores, reduce unnecessary retention, validate access controls, and ensure breach-response plans account for historical personal information. Review the guidance on when to report a cyberattack as part of that process.

Source: BleepingComputer

FBI raids alleged DPRK IT-worker laptop farms

The FBI raided alleged North Korean IT-worker laptop farms in Texas, and U.S. nationals were arrested. Remote-worker and contractor arrangements can be abused to conceal identity, location, or unauthorized access.

Security teams should reassess remote onboarding, identity verification, device provenance, privileged access, endpoint monitoring, and controls on unmanaged workstations.

Source: BleepingComputer

Ledger halts sales after supply-chain attack

Ledger asked sellers across Asia to halt sales following a supply-chain attack. A compromise at a supplier, reseller, hardware, firmware, or distribution layer can affect downstream customers.

Organizations should require suppliers to disclose compromise indicators, validate product provenance, review software and firmware update paths, and document which downstream systems depend on affected vendors.

Source: BleepingComputer

UK sanctions Cryptomus over alleged Russian money laundering

The UK sanctioned Cryptomus over alleged Russian money laundering activity. Cryptocurrency businesses and financial institutions should review sanctions screening, transaction monitoring, wallet-risk analysis, and escalation procedures in response to the action.

Source: Krebs on Security

Microsoft fixes Windows black-screen and Explorer crashes

Microsoft fixed a Windows issue associated with black screens and Explorer crashes. Administrators should include the relevant update in routine endpoint maintenance while keeping reliability remediation separate from emergency security patching.

Source: BleepingComputer

Cohere reportedly moves to acquire AISLE

Cohere is reportedly moving to buy AI cybersecurity startup AISLE. The reported transaction adds to the current activity around AI-focused security capabilities.

Source: Reuters via Google News

Analyst’s Take: The two actively exploited network-security flaws should drive the first response cycle: identify exposed systems, apply the vendor guidance, and check telemetry for evidence of access. The other incidents broaden the review, but they do not displace emergency remediation of internet-facing PAN-OS and Cisco Secure Email Gateway assets.

Critical Vulnerabilities#

The supplied vulnerability data lists the following issues at CVSS 9.8. None is identified as a CISA Known Exploited Vulnerability in the supplied data. Their severity and potential exposure still justify rapid, risk-based triage.

CVE-2026-107424: Frontend Dashboard for WordPress

CVE-2026-107424 affects Frontend Dashboard through version 3.0.7. The issue is an incorrect privilege-assignment vulnerability that can enable privilege escalation.

Update the plugin if a fixed release is available. If the plugin is not required, disable and remove it. Review administrator accounts, role changes, scheduled tasks, and recently modified WordPress files.

CVE-2026-108291: Affiliates for WordPress

CVE-2026-108291 affects the Affiliates plugin through version 7.0.1. The vulnerability involves deserialization of untrusted data and can enable PHP object injection.

Update or remove the plugin. Check web-server and PHP logs for unusual requests, errors associated with object deserialization, unexpected file writes, and outbound connections from the web server.

CVE-2026-16740 and CVE-2026-16741: TR7 ASP appliances

CVE-2026-16740 and CVE-2026-16741 affect specified TR7 ASP virtual and physical appliance versions before 1.0.1554.2331 and 1.6.1554.2331.

CVE-2026-16740 involves missing authentication for a critical function that allows OS command injection. CVE-2026-16741 involves improper neutralization of special elements that also allows OS command injection.

Identify all virtual and physical deployments, restrict management interfaces, apply the specified fixed versions, and review appliance administration and process-execution telemetry.

CVE-2026-108065: WebAlliance eCommerce SQL injection

CVE-2026-108065 is an unauthenticated SQL injection in Channel Software WebAlliance eCommerce. The affected SOAP GetUser method is located at /preapproval.asmx; a crafted sUserID value can potentially enable database read and write activity and command execution.

Restrict access to the SOAP endpoint, apply the vendor’s available remediation, and review web, application, database, and operating-system logs for suspicious requests or command execution.

What Defenders Should Do Today#

1. Inventory PAN-OS and Cisco Secure Email Gateway systems immediately. Record versions, internet exposure, management interfaces, recent administrative changes, and available vendor mitigations.

2. Patch or mitigate the actively exploited network-security flaws first. Do not rely solely on deployment records. Confirm the installed version and validate that the mitigation changed the exposed condition.

3. Review logs for exploitation indicators. Prioritize firewall, appliance, authentication, process-execution, email, DNS, proxy, and outbound-connection telemetry.

4. Find exposed WordPress plugins. Search all WordPress sites for Frontend Dashboard and Affiliates installations. Update, disable, or remove vulnerable versions.

5. Investigate WordPress compromise signals. Look for unexpected administrator accounts, privilege changes, modified plugin files, web shells, unusual scheduled tasks, and outbound connections from PHP processes.

6. Identify TR7 ASP and WebAlliance eCommerce deployments. Restrict appliance management and SOAP interfaces from the public internet, apply fixes, and review database and command-execution activity.

7. Hunt for new privileged access. Search identity systems and endpoint telemetry for unexpected administrators, newly created service accounts, suspicious token use, and unusual remote access. A password manager such as Try 1Password → can help standardize credential handling for privileged accounts.

8. Assess legacy data exposure. Identify retained personal records, map access paths, remove unnecessary copies, and confirm that breach-notification workflows cover historical data.

9. Review supplier and reseller dependencies. Ask vendors and distributors for compromise indicators, affected product or firmware versions, update-path validation, and remediation status.

10. Strengthen remote-worker and contractor controls. Verify identities, inspect device provenance, enforce managed-device requirements, limit privileges, and monitor anomalous access patterns.

11. Apply Windows reliability fixes through normal change management. Keep endpoint stability work moving, but do not let routine maintenance delay emergency remediation for actively exploited vulnerabilities.

12. Assign owners and deadlines. Every exposed system should have a remediation owner, an evidence-based completion status, and a documented risk decision if immediate patching is not possible.

Technical Notes#

Prioritize exposed assets

Start with an inventory query or configuration-management search that identifies affected products, versions, internet exposure, and business owners. The following commands are generic examples and should be adapted to the tools available in each environment.

# Search exported asset data for likely affected products
grep -Ei 'PAN-OS|GlobalProtect|Secure Email Gateway|TR7 ASP|WebAlliance|WordPress' assets.csv

# Identify externally exposed services from a local inventory export
awk -F',' '$3 == "internet-facing" {print $1 "," $2 "," $4}' assets.csv

Do not use banner data as the only source of truth. Confirm versions from authenticated management consoles, package inventories, configuration-management records, or vendor-supported inventory methods.

Check WordPress plugin exposure

A site owner or administrator can inspect installed plugins with WP-CLI:

wp plugin list --fields=name,status,version,update --format=table
wp plugin list --status=active --format=csv

Prioritize sites where the affected plugins are installed and active. Preserve relevant logs before making disruptive changes if compromise is suspected.

Review web and SOAP request telemetry

Search web-server and application logs for requests to the WebAlliance SOAP endpoint and unusual input patterns. Exact log formats vary by deployment.

# Example Apache or Nginx search
grep -RInE 'preapproval\.asmx|GetUser|sUserID' /var/log/nginx /var/log/apache2 2>/dev/null

# Review recent PHP or web-process errors
grep -RInE 'object injection|unserialize|fatal error|permission denied' \\
  /var/log/php* /var/log/nginx /var/log/apache2 2>/dev/null

Treat a matching request as a triage lead, not proof of exploitation. Correlate timestamps with database writes, new files, child processes, outbound connections, and account changes.

Hunt for suspicious process execution

On Linux-based appliances or application hosts, review process and service activity around the suspected incident window:

# Recent service and authentication activity
journalctl --since "24 hours ago" --no-pager

# Recently modified files in common web roots
find /var/www /srv/www -type f -mtime -7 -printf '%TY-%Tm-%Td %TH:%TM %p\n' 2>/dev/null

# Review current network connections
ss -plant

Preserve evidence according to the organization’s incident-response procedures. Avoid deleting files or resetting systems before collecting the data needed for scoping.

Validate remediation

After applying a patch or mitigation:

• Confirm the installed version or configuration state.
• Re-run the asset and exposure inventory.
• Verify that public access to management and SOAP interfaces is restricted as intended.
• Compare authentication, process, web, database, and outbound-network activity before and after remediation.
• Rotate credentials or tokens if unauthorized access cannot be ruled out.
• Record evidence, owner, timestamp, and remaining residual risk.

Bottom Line#

Start by assigning owners to every exposed PAN-OS and Cisco Secure Email Gateway system, then verify the installed versions, apply the available remediation, and review the relevant telemetry. That sequence addresses the confirmed exploitation risk before the team moves through the other exposed products, historical data stores, supplier dependencies, and identity controls.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.