2026-10-10: Flax Typhoon is exploiting eight known flaws (Exchange password spraying, VPN persistence

Show Notes - 2026-10-10

Stories Covered: - Today: - AhsayCBS Auth Bypass and Command Injection Exploited, No Effective Patch (CVE-2026-105133, CVE-2026-105134) (https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html) - Flax Typhoon Exploits Eight Known Flaws; CISA Adds Five to KEV (CVE-2015-3306, CVE-2021-3199, CVE-2023-22894, CVE-2016-3081, CVE-2015-5477) (https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html) - Citrix NetScaler: New Critical SAML Flaw Patched, Three Others Exploited (CVE-2026-107406, CVE-2026-88771, CVE-2026-88772, CVE-2026-88779) (https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html) - Working Exploit Published for Pre-Auth AnyDesk Linux RCE (https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html) - IDC Frontier Ransomware Attack Disrupts 495 Customers (https://databreaches.net/2026/10/09/cyberattack-at-idc-frontier-disrupts-services-around-nation/) - Silent Ransom Group Disputes "Luna Moth Files" Leak (https://databreaches.net/2026/10/09/silent-ransom-group-claims-luna-moth-files-are-fake-the-data-suggest-otherwise/) - FBI Arrests Another ShinyHunters Suspect (https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html) - AhsayCBS exploitation (source: Huntress, via The Hacker News) - Credential-Stealing GitHub Actions Workflows Pushed via Compromised Maintainer Accounts (https://thehackernews.com/2026/10/credential-stealing-github-actions.html) - Hijacked ccTLDs Used to Obtain Certificates for Google Domains (https://www.securityweek.com/google-domains-impacted-by-recent-cctld-domain-hijacks/) - ASOS Breach Shows Single-Identity Risk in Customer-Facing SaaS (https://www.darkreading.com/cyberattacks-data-breaches/asos-breach-risks-customer-facing-saas) - Exchange password spraying - AI Agents as the New BEC Target (https://www.darkreading.com/cybersecurity-operations/social-engineering-ai-agents-bec-2026) - Pwn2Own Ireland: Fully Patched Pixel 10 Compromised by Three Teams (https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html) - GoBalance Flaw Allows .onion Address Takeover (https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html) - TP-Link Sued by Five States (https://thehackernews.com/2026/10/tp-link-sued-by-four-more-us-states.html)

CVEs Referenced: CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, CVE-2023-22894, CVE-2026-105133, CVE-2026-105134, CVE-2026-107406, CVE-2026-88771, CVE-2026-88772, CVE-2026-88779

Full brief: https://carolinacleartech.com/brief/2026-10-10/