2026-10-15: Ivanti Connect Secure faces active zero-day attacks with 105 honeypot hits logged

Show Notes - 2026-10-15

Stories Covered: - Today: - Ivanti Connect Secure Zero-Day (CVE-2026-104935) (https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog) - Palo Alto Networks PAN-OS Authenticated RCE (CVE-2026-0322) (https://www.securityweek.com/palo-alto-networks-patches-pan-os-zero-day-exploited-for-remote-code-execution/) - Cisco Secure Email Gateway RCE (CVE-2026-76519) (https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog) - Microsoft Windows Shell Zero-Day (CVE-2026-96951) (https://cyberscoop.com/microsoft-patch-tuesday-october-2026/) - Ahsay AhsayCBS Authentication and Command Injection (CVE-2026-105133, CVE-2026-105134) (https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html) - n0n Extortion Group Targets Maritime and Logistics Sector (https://databreaches.net/2026/10/14/shipping-firms-and-ports-caught-in-mass-cyber-extortion-claim/) - Japan Faces Ransomware Wave (https://databreaches.net/2026/10/14/japan-on-cyberattack-alert-as-ransomware-wave-hits-major-brands-and-exposes-millions-of-records/) - Hirudo Android Banking Trojan (https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html) - BYOVD Technique Now Default in 48% of Intrusions (https://www.sentinelone.com/blog/bring-your-own-vulnerable-driver-how-edr-killing-became-an-industry/) - PEERSTITCH: FortiGate Memory-Resident ARM64 Malware (https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/) - TAG-193/UAT-6275 Targets CIS Government Organizations (https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/) - Langflow Critical RCE Under Active Exploitation (CVE-2026-105740) (https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html) - GhostAction GitHub Credential Theft Campaign Escalates (https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html) - Nextcloud Collabora CODE App Backdoor (CVE-2026-110447) (https://thehackernews.com/2026/10/hackers-backdoor-nextcloud-servers.html) - French Grocers Lose Millions to Refrigeration Controller Attacks (https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware) - North Korean IT Worker Scheme Disruption (https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html) - Microsoft and Partners Disrupt Chinese Phishing Ecosystem (https://thehackernews.com/2026/10/microsoft-disrupts-3-phishing-kits.html) - Microsoft October 2026 Patch Tuesday: Record 1,413 CVEs (https://cyberscoop.com/microsoft-patch-tuesday-october-2026/) - ICS Patch Tuesday (https://www.securityweek.com/ics-patch-tuesday-siemens-issues-17-advisories-rockwell-fixes-armorblock-takeover-flaw/)

CVEs Referenced: CVE-2024-47575, CVE-2025-41450, CVE-2025-41451, CVE-2025-41452, CVE-2025-61624, CVE-2025-8088, CVE-2026-0322, CVE-2026-104935, CVE-2026-105133, CVE-2026-105134, CVE-2026-105740, CVE-2026-110447, CVE-2026-76519, CVE-2026-96951

Indicators of Compromise: Domains: 72[.]14, 239[.]114, 47[.]234. IPs: 25.1.1.1, 25.1.2.2, 9.15.2.59, 10.3.4.0

Full brief: https://carolinacleartech.com/brief/2026-10-15/