🔴 SonicWall SMA1000 CVSS 10.0 SSRF exploited within a day of patch, 🕳️ Public PoC for AnyPwn AnyDesk pre-auth root RCE, 🏛️ FBI ties ShinyHunters FBIjobs breach to unpatched contractor PeopleSoft, 🎤 Nippon Columbia breach exposes 8.6M karaoke fans, 🔐 GitLab CVSS 10.0 unauthenticated RCE, 📅 Let's Encrypt moves to 64-day certificates

[REVISIT] Honeypot networks caught attackers exploiting SonicWall's maximum-severity SMA1000 flaw within a day of the October 6 patch, with Previdian and Defused both reporting live exploitation attempts against CVE-2026-102255, a CVSS 10.0 pre-authentication SSRF in the Appliance WorkPlace interface of models 6210, 7210 and 8200v. This is the third maximum-severity SMA1000 vulnerability of 2026 after the July and September zero-day clusters, and Shadowserver still counts more than 400 appliances exposed online. The October advisory itself flags the SSRF as an entry point that can chain toward command injection for full unauthenticated RCE, the same pattern as the earlier chains. Fixed builds are 12.5.0-03082 and 12.4.3-03670: if your appliance is unpatched and internet-facing, treat it as compromised and hunt for requests coerced to internal-only services.

[NEW] Public proof-of-concept code has landed for AnyPwn, a heap buffer overflow in AnyDesk for Linux 8.0.2 that allows remote command execution before the user approves a desktop-control session. Because the AnyDesk service typically runs as root, a successful exploit hands the attacker root on the host, which makes this about as bad as remote-access-tool bugs get. The PoC disclosure is today, so in-the-wild use is a matter of time: replace or update AnyDesk on Linux hosts now and watch for exploitation reports.

[NEW] Let's Encrypt announced it will issue 64-day certificates by default starting February 10, 2027, an intermediate step toward 45-day defaults planned for 2028 under the CA/Browser Forum Baseline Requirements, with staging tests opening October 14 and the last 90-day certificate expected to expire around May 11, 2027. Authorization reuse shrinks from 30 days to 10 now and to seven hours in 2028. The operational risk is your own renewal glue: cron jobs and runbooks with hardcoded 60, 80 or 83-day renewal windows will break, so audit for static thresholds, verify your ACME client supports ARI, and test against staging before February.

[NEW] The FBI has attributed the ShinyHunters intrusion that stole data on thousands of FBI agents via FBIjobs.gov to an unpatched Oracle PeopleSoft HR platform run by a contractor, with the root cause a missed security patch rather than any Oracle zero-day. Coming a day after the Cypfer extortion arrest in the same investigation, the attribution underscores that ShinyHunters keeps succeeding through mundane maintenance gaps on third-party-managed systems. If you rely on vendor-operated HR or identity platforms, verify patch status independently instead of trusting vendor-management paperwork.

[NEW] A malware infection on an employee computer at a Nippon Columbia Group contractor was discovered October 5 and isolated October 6, but exposed records for 8.63 million Daiichi Kosho customers plus 93,000 employees across Japan's largest karaoke operator, which runs 521 venues including Big Echo and Karaoke CLUB DAM. The company says no data theft is confirmed, passwords are not in the exposed set, and no unauthorized loyalty-point use has been seen, but the gap between infection and isolation leaves an unmeasured exfiltration window. Venue operators should check endpoint coverage on contractor systems, and the watch item is any appearance of this dataset on breach markets or unusual loyalty-point redemptions.

[NEW] A critical GitLab vulnerability, CVE-2026-97229, carries a CVSS 10.0 score for unauthenticated arbitrary code execution, with the advisory directing upgrades to GitLab 19.4.2. Unauthenticated RCE in the platform that builds your software means potential repository injection and build-artifact poisoning, so internet-exposed instances should upgrade immediately. Caveat: reporting so far rests on a single source without the vendor advisory text, so confirm against GitLab's official security release before scheduling fleet-wide emergency patching.

[NEW] The open-source WuKong_HRM human-resources system has a critical authentication bypass, CVE-2026-108707 at 9.8: on commit 186115e and earlier, simply omitting the AUTH-TOKEN header grants full HR admin access with zero credentials. A second flaw, CVE-2026-108708 at 8.8, lets any authenticated employee escalate privileges. No patch timeline is published, and an HR system holds exactly the PII that makes payroll-fraud and phishing follow-ups trivial, so exposed instances should be taken offline or shielded until a fix ships.

[NEW] Microsoft will block MSIX and MSIXBundle attachments in Outlook and Exchange Online starting November 2026, closing a channel attackers used to slip installers and scripts past attachment filters inside the Windows app-package format. It is a structural fix rather than a detection tweak, but legitimate vendors who ship MSIX by email need alternate delivery before the cutoff, and the predictable attacker response is migration to whatever container format is not yet blocked.

[NEW] UAT-11985 is a reminder that AI now shapes lure quality, not just malware: the actor builds spear-phishing invitations from real public event details with altered QR codes, then uses adversary-in-the-middle interception to steal Google credentials and bypass MFA in real time against research organizations. Fresh follow-up reporting today adds technical detail on the phishing kit. The pairing of AI-generated lures with live session theft defeats both user skepticism and phishing-resistant assumptions, so treat unexpected calendar or event invitations that route through QR-based login flows as hostile.

[NEW] Ransomware actor The Gentlemen has listed MoneyGram and Barcelona's Hospital de la Santa Creu i Sant Pau on its leak site, per threat-intelligence tracking rather than any victim statement. Both claims are unverified: no confirmation from either organization on compromise, exfiltration or system impact. A breach at a money-transfer network operating in 200-plus countries would be significant, so watch for official disclosures or regulatory notifications before treating either as fact.

[CATCH-UP] One disclosure from last week that this digest missed and should not have: Cycode detailed an OAuth flaw in Anthropic's official MCP Python SDK, where releases 1.9.1 through 2.1.1 fail to validate the authorization-server issuer during discovery over HTTP transport. A malicious MCP server returns a 404 to force an unsafe fallback, feeds the client attacker-controlled OAuth metadata, and harvests client secrets, authorization codes and PKCE proof keys while the victim still sees a legitimate Okta, Google or Entra ID login page, enabling account takeover. The disclosure points to 1.30.0 or later as the fixed line, no CVE is assigned yet; if you run MCP clients against non-trusted servers, upgrade and restrict HTTP transport to known endpoints.

Watchlist: whether exploitation of CVE-2026-102255 chains into command injection or the flaw lands in the CISA KEV catalog, where it is not yet listed; whether the AnyPwn PoC graduates into in-the-wild AnyDesk exploitation; whether GitLab publishes an official advisory confirming CVE-2026-97229; how staging behaves when Let's Encrypt's 64-day certificates open on October 14; and whether MoneyGram or the Barcelona hospital confirm The Gentlemen's claims.

Generated by zai/glm-5.3-flash. Input tokens: 55,941, output tokens: 22,668, cache read: 1,176,128, cache write: 0.