Today's outlook

Palo Alto Networks patches an exploited PAN-OS zero-day as CISA flags four actively attacked flaws

By The IT Security Desk

Good morning. Palo Alto Networks released security updates for a PAN-OS remote code execution zero-day, tracked as CVE-2026-0322, that BleepingComputer reported has been exploited in attacks targeting firewalls. The flaw carries CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H and a base score of 7.2. CISA lists CVE-2026-0322 as known to be exploited and has added it to its KEV catalog. Palo Alto Networks' advisory lists the fix in PAN-OS 10.2.0, with earlier versions affected; CISA directs defenders to apply mitigations per the vendor and follow BOD 26-04 patching guidance.

The same day, The Hacker News reported that Cisco's advisory warns of active attacks on a critical Cisco Secure Email Gateway flaw. According to The Hacker News, a sender with no login emails a crafted attachment through the gateway and, if it succeeds, can write files to the appliance's operating system and run commands as root. The Register reported that both Cisco and CISA sounded the alarm over the bug, exploited as a zero-day by unknown criminals. CISA records the Cisco flaw as a relative path traversal vulnerability now in its KEV catalog.

CISA states its 14 October additions total four vulnerabilities, all on evidence of active exploitation: the Palo Alto Networks PAN-OS code injection flaw, the Cisco Secure Email Gateway relative path traversal flaw, and two Ahsay AhsayCBS flaws that CISA lists as an improper authentication vulnerability and a command injection vulnerability. CISA ties the catalog to BOD 26-04, which sets vulnerability-management requirements for Federal Civilian Executive Branch agencies.

The Hacker News separately reported that attackers exploited a flaw in an optional Nextcloud app, the Collabora Online – Built-in CODE Server, to plant web shells on Nextcloud servers. Per that report, three administrators flagged the issue on GitHub and the first logged attack was 10 September.

On the supply-chain front, BleepingComputer reported that Ledger asked resellers and distributors across Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend device sales and pull products from shelves while it investigates device tampering.

The Register reported that security researchers using Xbow spent six days building an exploit affecting a billion users and earned a $250,000 bug bounty for the Chrome work.

Law enforcement was active. The Record reported North Macedonian police arrested the suspected administrator of the OLVX market, citing the Interior Ministry alongside the FBI. BleepingComputer reported the U.S. Department of Justice disrupted the Famous Chollima group's operations, arresting two suspects, charging 14 individuals and seizing nearly 187 laptops; Help Net Security reported the DoJ attributes the scheme to North Korean IT workers who used stolen and fabricated identities to win remote jobs at more than 70 US companies. Krebs on Security reported the United Kingdom sanctioned the cryptocurrency platform Cryptomus, which experts quoted by Krebs call a major conduit for ransomware, darknet-market and fraud payments helping Russia circumvent financial restrictions. The Record also reported that the Brooklyn District Attorney's office took down servers and domains behind a crypto scam targeting Russian-speaking residents.

For context, SecurityWeek reported that in Booz Allen's isolated OT lab, AI models met every objective across eight scenarios and reached an industrial control network from a perimeter compromise in just over 16 minutes.