CyberNews: 15/10/2026 Edition

Today’s roundup

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts

curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

U.K. Sanctions Cryptomus for RU Money Laundering

Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool

Summary

Cisco warned that attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets an unauthenticated sender write files to the appliance's operating system through an email with a crafted attachment and then potentially run commands as root.

Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), an actively exploited remote code execution flaw in the PAN-OS management interface.

Attackers exploited a flaw in Collabora Online - Built-in CODE Server, an optional Nextcloud app, to plant web shells on Nextcloud servers. Three administrators reported the attacks on GitHub, the first logged on September 10.

Previdian reported exploitation of CVE-2026-105740 (CVSS 9.9), a critical authenticated remote code execution flaw in Langflow, the open-source platform for building AI applications and agentic workflows, with 1,423 exploit attempts recorded by honeypots.

curl 8.23.0, released on October 14, fixes an HTTP/2 upload flaw that lets a malicious receiving server corrupt the client's memory. The reporting researcher turned it into code execution on the uploading machine, although an attack requires exact knowledge of the client's build and memory layout.

The U.S. Department of Justice charged 14 people, both U.S. citizens and Chinese nationals, shut down more than 40 laptop farms and seized about 187 computers and KVM devices in its effort to disrupt North Korea's fraudulent remote IT worker scheme, which affected more than 70 U.S. companies.

Microsoft, Health-ISAC, Japan's JC3 and private partners including Cloudflare, Oracle, Proofpoint and TRM Labs disrupted three phishing kits, CoGUI, Haozi and Iron Man System, whose operators have been linked to more than one billion scam messages since January 2026.

GitGuardian said the GhostAction credential-theft campaign ramped up on October 8 and 9, compromising the GitHub accounts of about 1,900 users, targeting more than 30,000 repositories across 3,000 users and organizations and attempting to extract 3,174 secrets from public repositories' CI.

The United Kingdom sanctioned Cryptomus, a cryptocurrency platform formerly known as Certa Payments and Xeltox Enterprises, which experts say is a major conduit for payments tied to ransomware, narcotics, darknet markets and cybercrime services that help Russia circumvent financial restrictions.

Researchers warned of two high-risk vulnerabilities, CVE-2026-35029 and CVE-2026-59823, in LiteLLM, a gateway widely used by enterprises to connect their AI applications to providers such as OpenAI and Anthropic.

Want to dig deeper?

Vulnerabilities

CVE-2026-0322	High
CVE-2026-105740	Critical
CVE-2026-35029	High
CVE-2026-59823	Medium