Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
Article Link: https://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html
- Cisco disclosed CVE-2026-76418 (CVSS 8.6), an actively exploited vulnerability affecting Cisco Secure Firewall ASA and FTD devices using SSL Remote Access VPN with secondary authentication enabled. The flaw allows an unauthenticated attacker to crash and reload vulnerable devices, resulting in a denial-of-service condition.
- Organizations are vulnerable when a susceptible ASA or FTD version is exposed to the Internet through SSL VPN services and tunnel groups are configured with secondary authentication. Successful user authentication is not required, increasing the risk to internet-facing deployments.
- The disclosure follows recent Cisco-focused attacks by threat actor UAT-11473, which exploited a separate Cisco vulnerability and deployed the KeyDrift malware. The activity underscores the continued targeting of VPN and network infrastructure platforms by sophisticated threat actors.
- Organizations should prioritize installation of Cisco’s fixed releases and review all VPN tunnel groups for affected configurations. Where immediate patching is not possible, Cisco recommends disabling impacted secondary-authentication configurations or limiting exposure of vulnerable VPN services as a temporary mitigation.
- Additional Information: https://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html
What does this mean for me?
- This highlights the importance of securing all systems, including those that are tied into system security, and the vitality of shifting from built-in default settings.
China-Linked Hackers Exploit VMware ESXi Zero-Day to Target U.S. Law Firms
Article Link: https://cyberpress.org/china-linked-hackers-exploit-vmware-esxi-zero-day/
- CrowdStrike attributed intrusions targeting U.S. organizations, including law firms, to China-linked threat actor WARP PANDA, which reportedly exploited the VMware ESXi vulnerability CVE-2026-41709.
- The attackers deployed multiple forms of malware in VMware vCenter environments, supporting espionage and intelligence collection.
- Compromised legal and enterprise environments could expose privileged communications, intellectual property, financial information, and other sensitive business data. The broader trend also highlights growing espionage and ransomware threats against law firms.
- Organizations using VMware should check vendor security advisories for affected versions and remediation guidance, review vCenter and ESXi logs for suspicious activity, and strengthen administrative access controls. Prioritize legal and professional services firms holding sensitive client information.
- Additional Information: https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-legal-threat-landscape-report/
What does this mean for me?
- This offers up insight to those in the legal industry that you are an ever-increasing target. Likewise, it highlights the importance of reporting anything and everything that seems out of the ordinary, such as an increase in account lockouts or messages from unknown personnel claiming to be IT.
Hackers Compromise Claude Code Extension in Cursor Marketplace to Install Persistent SSH Backdoor
Article Link: https://cyberpress.org/hackers-compromise-claude-code-extension/
- Hackers compromised version 2.1.313 of the Claude Code extension distributed through the Cursor Marketplace, embedding malicious JavaScript that secretly executes when the extension loads. The legitimate extension functionality remains intact, making the compromise harder to detect.
- The malicious code establishes persistent remote access by adding an attacker-controlled SSH key to affected systems and creating reverse SSH connections to attacker-controlled infrastructure. It also installs persistence mechanisms across Windows, macOS, and Linux to maintain access after system restarts.
- The malware collects system information, including usernames, hostnames, operating system details, and names of environment variables associated with credentials and cloud services. This reconnaissance can help attackers identify valuable development resources.
- Compromised developer machines could provide attackers with persistent access to sensitive source code, development environments, cloud resources, and potentially business credentials. This creates additional risks of data theft, lateral movement, and further network compromise.
- Organizations should identify and remove the affected extension, investigate unauthorized SSH keys and persistence mechanisms, isolate compromised systems, rotate potentially exposed credentials from clean devices, and consider rebuilding affected machines.
What does this mean for me?
- Be aware of how legitimate tools, such as Claude extensions, can be modified and leveraged to hide threats in plain sight.
Chrome Extensions With 13.4 Million Installs Caught Hijacking Searches
Article Link: https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/
- A campaign involving 319 Chrome extensions with a reported 13.4 million combined installs hijacked browser searches by redirecting users through operator-controlled servers to Bing or Yahoo for advertising revenue.
- Disguised as useful tools such as PDF converters, AI search assistants, and security add-ons, the extensions exploit Chrome’s search-provider settings to reroute queries and generate referral income.
- Malicious actors can change redirect destinations without updating the extensions, potentially exposing employees to phishing pages, malicious downloads, and sensitive information disclosed through search queries.
- Organizations should audit installed browser extensions against the published list from Socket, remove identified extensions, restrict installations to approved add-ons, and investigate suspicious redirects.
- Additional Information: https://socket.dev/blog/searchjacked
What does this mean for me?
- Browser extensions are great for easy access to tools that we regularly use. However, before we try to implement them, it is vital that we loop in our IT & Security Teams so that they can inspect and test the tools for potential security concerns.
Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
Article Link: https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html
- Linux kernel vulnerability CVE-2026-98432 has a CVSS score of 9.8 from the kernel CVE team and affects multiple Linux distributions, including Ubuntu and Red Hat Enterprise Linux.
- A race condition in IPv4 TCP connection handling causes a use-after-free memory error. Anthropic reported developing an exploit that could allow remote, unauthenticated attackers to execute commands as root on servers with a multipath TCP (MPTCP) listener.
- Successful exploitation could give attackers full system control, potentially exposing sensitive data, disrupting operations, or enabling further compromise. Real-world exploitation has not been reported in the supplied information.
- Organizations should prioritize affected Linux servers, install vendor-fixed kernel packages where available, and monitor Ubuntu and RHEL advisories closely, as fixes were not yet available for those distributions as of October 29, 2026.
- Additional Information: https://www.cve.org/CVERecord?id=CVE-2026-98432
What does this mean for me?
- We often focus solely on Microsoft-based systems. This TCP flaw is a perfect reminder that vulnerabilities often appear in systems with other operating systems and we should be remediating vulnerabilities with this in mind. Don’t focus solely on your Microsoft vulnerabilities at the expense of other systems.
$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
Article Link: https://www.securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor/
- Binance, the world’s largest cryptocurrency exchange, suffered an estimated $6.36 billion cryptocurrency theft across ten blockchains on October 29, making it the largest crypto heist ever recorded. Most of the funds were transferred out of Binance wallets within roughly 20 minutes.
- Binance’s preliminary investigation suggests attackers may have compromised a DevOps engineer’s laptop, gaining access to a service container and the ability to submit unauthorized withdrawal transactions. TRM Labs believes attackers gained control of Binance’s hot wallet signing system, allowing them to generate valid withdrawal transactions across multiple blockchains.
- The attackers moved the stolen cryptocurrency through large trades with market makers and lending platforms. Stablecoin issuers, including Tether and Circle, froze approximately $2.7 billion in assets, while Binance estimates the total frozen amount reached roughly $3 billion. However, attackers still reportedly control approximately $2.4 billion in ETH and BTC that cannot be frozen by stablecoin issuers.
- The incident highlights the risks of excessive employee access and inadequate separation between user devices and critical financial systems. Compromising a single employee endpoint should not provide a pathway to sensitive transaction-signing capabilities or unauthorized financial transfers.
- Additional Information: https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
What does this mean for me?
- This situation serves as an important reminder to provide users with the least amount of privileges at all times and highlights the criticality of session termination for standard users and privileged users alike. Even the most trustworthy employee can accidentally become an insider threat with a negligent click or authorization.
More Than Half of K-12 Schools Reported Cyber Incidents Amid Staffing, Funding Gaps
Article Link: https://statescoop.com/more-than-half-of-k-12-schools-reported-cyber-incidents-amid-staffing-funding-gaps/
- A new report from the Center for Internet Security (CIS), MS-ISAC, and CoSN found that the majority of surveyed K-12 schools and districts experienced a cybersecurity incident in the past year. Nearly 80% reported needing additional cybersecurity support, resources, or guidance, while 56% said their cybersecurity programs were underfunded.
- Limited staffing and budget constraints are hindering schools’ ability to defend against attacks, with 66% of affected organizations having only one or two dedicated cybersecurity staff members. Additionally, 70% said financial constraints forced them to delay cybersecurity projects, technology investments, or staffing.
- Phishing and email compromises were among the leading threats, identified by 87% of respondents. Attackers are increasingly targeting user credentials, while AI is making phishing messages and impersonation attempts more convincing.
- Organizations should strengthen identity protection and MFA, improve email security, provide regular employee security awareness training, establish incident response and recovery plans, assess third-party vendors, and develop formal AI-use policies.
- Additional Information: https://learn.cisecurity.org/state-k-12-cybersecurity-report-2026
What does this mean for me?
- Security is a life skill that impacts all facets of our lives. While there are always resource limits, we can all do our part to reduce the possibility of security incidents by remaining vigilant, keeping cyber aware, and reporting weird behavior or activity.
New Android SMS of Death Exploit Can Remotely Crash Unpatched Phones
Article Link: https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/
- An independent vulnerability researcher disclosed an Android vulnerability (CVE-2026-58882) deemed “SMS of Death” that allows attackers to remotely crash vulnerable devices using a specially crafted WAP SMS message.
- The flaw stems from improper validation of header length and can trigger an exception that crashes the process that manages cellular communication. No user interaction is required.
- Successful exploitation can disconnect ongoing calls, including emergency calls, disrupt business communications, and potentially trigger repeated crashes or reboot loops. Organizations relying on Android devices for employee communications, customer support, and remote operations could experience operational disruptions.
- Google addressed the vulnerability in its October 2026 security update for Android 14 through 17. However, Android 13 and older systems remain vulnerable. The vulnerability has not been reported as exploited in the wild yet.
- Additional Information: https://smsofdeath.com/
What does this mean for me?
- Smartphones are simply computers with smaller screens. As such, it is imperative that we treat these powerful devices like any other computer-like device. This includes ensuring that updates are sufficiently enabled to receive the latest security updates available.
