weekly digest / 2026-W42
Weekly digest 2026-W42: 12-18 Oct 2026
complete · Monday-Sunday, Pacific time (America/Los_Angeles), counted by the date each incident was first seen · updated
breach 6 · actively-exploited vuln 5 · critical vuln 1
Actively exploited
-
BeyondTrust Remote Support authentication bypass exploited (CVE-2026-102764)
BeyondTrust Remote Support is software that IT help desks use to control computers remotely. A flaw lets an attacker on the internet, without logging in, tamper with files on the server that runs it. BeyondTrust has released a fix, and the US cybersecurity agency CISA confirms the flaw is being exploited.
-
Cisco Secure Email Gateway arbitrary file write via email attachment exploited (CVE-2026-76519)
Cisco Secure Email Gateway is a device companies use to filter incoming email for spam and malware. A flaw lets an outsider take full control of the device just by sending an email with a specially crafted attachment, if a malware-checking feature called file reputation is turned on. Cisco has released a fix, and the US cybersecurity agency CISA confirms it is being exploited.
-
Atlassian Data Center arbitrary file access CVE-2026-21589 (CVSS 9.3) exploited, in CISA KEV
A serious flaw in Atlassian's self-hosted Jira, Confluence, Bitbucket and several related tools lets anyone on the internet, without logging in, read certain files on the server if they know where those files are. The US cyber agency CISA lists it as being exploited in real attacks. Atlassian has released fixes; its cloud-hosted versions are already patched.
-
Ivanti Connect Secure authentication bypass to RCE exploited (CVE-2026-104935)
Ivanti Connect Secure is a VPN gateway, the device employees use to connect to their company network from outside. A flaw in versions before 25.1.3.0 lets an attacker on the internet run commands on the device without a password. The US cybersecurity agency CISA confirms it is being exploited.
-
Palo Alto Networks PAN-OS management interface RCE exploited (CVE-2026-0322)
Palo Alto Networks makes widely used firewalls, the devices that guard company networks. A flaw in the firewall's admin web page lets an attacker who can reach that page and log in to it take complete control of the firewall. Palo Alto has released fixes and CISA confirms it is being exploited, though Palo Alto says it has seen only very limited attacks.
Highest CVSS (9.0+)
-
Rank Math SEO PRO 3.0.123 downloads shipped malware (CVE-2026-111862)
Rank Math is a popular plugin that helps WordPress websites rank in search engines. For about 11 hours on 15-16 October, some downloads of its paid PRO version 3.0.123 contained malware that can take over a website once the plugin is turned on. The company confirms this; the free version from WordPress.org is not affected.
Confirmed breaches & ransomware
-
OpenCode Console security breach affects 1.4% of users with external AI providers
OpenCode, which makes an AI coding assistant, says its hosted Console service was breached on the night of 16 October. It says 1.4% of Console users were affected, all of them people who had connected outside AI providers. OpenCode confirmed the breach on its official X account and emailed those affected.
-
ILITY cross-chain bridge drained of 4,121,791 ILY tokens; bridge suspended
ILITY, a cryptocurrency network, says an attacker broke into servers it runs and drained about 4.1 million of its ILY tokens from its bridge, the service that moves tokens between blockchains, then sold them on exchanges. ILITY says tokens held in users' own wallets were not touched. The bridge and ILY deposits and withdrawals on exchanges are paused while the attack is investigated.
-
ETS breach copied California public-school student testing data, state confirms
A testing company that runs California's statewide school exams, ETS, says someone used a stolen login to copy student records from a file-sharing server between May and September 2026. It covers students in California public schools over the past three school years, including names, birth dates, addresses and disability status. California's Department of Education has confirmed the breach and is sending notices to families.
-
ConnectWise Cloud Backup (formerly SkyKick) app credentials abused to access Microsoft 365 tenants; services suspended
ConnectWise, a company whose tools IT providers use to back up their clients' Microsoft 365 email and files, says attackers got hold of the login credentials its backup app uses to connect to those Microsoft 365 accounts. ConnectWise has confirmed the unauthorized access and switched off its Cloud Backup, SaaS Security and Cloud Management services while it fixes things. It says stored backups show no sign of being touched.
-
Zeabur confirms attacker read 3.2M environment-variable records and 321,810 accounts
Zeabur is a service developers use to host their apps online. The company confirmed that an attacker got into its systems on 14-15 October and read customers' stored app settings, including passwords and access keys, plus details of 321,810 accounts. It was Zeabur's second incident since August, and the company has announced it is shutting down by 31 December.
Every incident this week (12)
- critical vuln Rank Math SEO PRO 3.0.123 downloads shipped malware (CVE-2026-111862)
- actively-exploited vuln Ivanti Connect Secure authentication bypass to RCE exploited (CVE-2026-104935)
- actively-exploited vuln Palo Alto Networks PAN-OS management interface RCE exploited (CVE-2026-0322)
- actively-exploited vuln BeyondTrust Remote Support authentication bypass exploited (CVE-2026-102764)
- actively-exploited vuln Cisco Secure Email Gateway arbitrary file write via email attachment exploited (CVE-2026-76519)
- breach OpenCode Console security breach affects 1.4% of users with external AI providers
- breach ILITY cross-chain bridge drained of 4,121,791 ILY tokens; bridge suspended
- breach ETS breach copied California public-school student testing data, state confirms
- breach ConnectWise Cloud Backup (formerly SkyKick) app credentials abused to access Microsoft 365 tenants; services suspended
- breach Zeabur confirms attacker read 3.2M environment-variable records and 321,810 accounts
- actively-exploited vuln Atlassian Data Center arbitrary file access CVE-2026-21589 (CVSS 9.3) exploited, in CISA KEV
- breach Burger King Japan: unauthorized access exposes about 11.18 million official app member records