Daily DefSec Brief·Oct 15, 2026·5m

Cisco email gateway exploited, PAN-OS zero-day, Zimbra send-as flaw | Cyber Security News Oct 15

Show notes

1. Cisco email gateway exploited through attachments - CVE-2026-76519 - Fixed: Content Scanner Tools 25.3.0.5525; AsyncOS 15.5.5-014 or 16.5.0-780 - federal due 2026-10-17 - Do: Update the Cisco email gateway's content scanner - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

2. PAN-OS management interface zero-day exploited - CVE-2026-0322 - Fixed: 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12 - federal due 2026-10-17 - Do: Patch PAN-OS and lock down management access - https://security.paloaltonetworks.com/CVE-2026-0322

3. Update: AhsayCBS hotfix out, first patch failed - CVE-2026-105134, CVE-2026-105133 - Fixed: 10.3.4.45 (v10); 9.15.2.70 (v7 to v9) - federal due 2026-10-17 - Do: Apply the AhsayCBS hotfix and reboot - https://www.huntress.com/blog/ahsaycbs-flaws-exploit

4. Nextcloud's built-in Collabora app exploited - CVE-2026-110447 - Fixed: 26.4.303 - Do: Update or remove Nextcloud's built-in Collabora app - https://cveawg.mitre.org/api/cve/CVE-2026-110447

5. Linux vhost flaw: local root, and a VM escape - CVE-2026-74580 - Fixed: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 - Do: Update and reboot your Linux hosts - https://cloud.tencent.com/announce/detail/2483

6. Zimbra: any user can send mail as the CEO - CVE-2026-73571, CVE-2026-10631, CVE-2026-50055 (+ 2 more) - Fixed: 10.1.17 (CVE-2026-73571); 10.1.20 (CVE-2026-10631, CVE-2026-50055) - Do: Upgrade Zimbra - https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1

7. curl fixes its first High flaw since 2023 - CVE-2026-92392 - Fixed: 8.23.0 - Do: Update curl - https://curl.se/docs/CVE-2026-92392.html

8. Claude Code Desktop's preview pane read SSH keys - Fixed: 1.30096.1 - Do: Get long-lived secrets off developer laptops - https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data

9. AI built a Chrome exploit in six days - CVE-2026-85045 - Fixed: 152.0.7977.82 - Do: Force Chrome relaunches after updates - https://xbow.com/blog/xbow-built-a-chrome-full-chain-exploit

10. Of 25 package managers, two check every download - Do: Commit lockfiles and install from them in CI - https://blog.trailofbits.com/2026/10/14/package-managers-have-an-integrity-problem/

← Previous

Ivanti VPN zero-days, exploited Windows flaw, Docker Hub token mix-up | Cyber Security News Oct 14

Attackers are getting root on Cisco Secure Email Gateways with a crafted attachment, and the fix is a month old. Also: a PAN-OS zero-day, Ahsay's failed patch, Nextcloud, Zimbra, curl, Claude Code Desktop, and which package managers check their downloads. Every version number and every fix in this episode was checked against the vendor, the CVE record or the researcher who found it before it aired. Today's question: Have you ever turned on a package manager's integrity checks on purpose, and what made you do it? Reply in the comments or at [email protected] . 1. Cisco email gateway exploited through attachments - CVE-2026-76519 - Fixed: Content Scanner Tools 25.3.0.5525; AsyncOS 15.5.5-014 or 16.5.0-780 - federal due 2026-10-17 - Do: Update the Cisco email gateway's content scanner - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp 2. PAN-OS management interface zero-day exploited - CVE-2026-0322 - Fixed: 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12 - federal due 2026-10-17 - Do: Patch PAN-OS and lock down management access - https://security.paloaltonetworks.com/CVE-2026-0322 3. Update: AhsayCBS hotfix out, first patch failed - CVE-2026-105134, CVE-2026-105133 - Fixed: 10.3.4.45 (v10); 9.15.2.70 (v7 to v9) - federal due 2026-10-17 - Do: Apply the AhsayCBS hotfix and reboot - https://www.huntress.com/blog/ahsaycbs-flaws-exploit 4. Nextcloud's built-in Collabora app exploited - CVE-2026-110447 - Fixed: 26.4.303 - Do: Update or remove Nextcloud's built-in Collabora app - https://cveawg.mitre.org/api/cve/CVE-2026-110447 5. Linux vhost flaw: local root, and a VM escape - CVE-2026-74580 - Fixed: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 - Do: Update and reboot your Linux hosts - https://cloud.tencent.com/announce/detail/2483 6. Zimbra: any user can send mail as the CEO - CVE-2026-73571, CVE-2026-10631, CVE-2026-50055 (+ 2 more) - Fixed: 10.1.17 (CVE-2026-73571); 10.1.20 (CVE-2026-10631, CVE-2026-50055) - Do: Upgrade Zimbra - https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1 7. curl fixes its first High flaw since 2023 - CVE-2026-92392 - Fixed: 8.23.0 - Do: Update curl - https://curl.se/docs/CVE-2026-92392.html 8. Claude Code Desktop's preview pane read SSH keys - Fixed: 1.30096.1 - Do: Get long-lived secrets off developer laptops - https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data 9. AI built a Chrome exploit in six days - CVE-2026-85045 - Fixed: 152.0.7977.82 - Do: Force Chrome relaunches after updates - https://xbow.com/blog/xbow-built-a-chrome-full-chain-exploit 10. Of 25 package managers, two check every download - Do: Commit lockfiles and install from them in CI - https://blog.trailofbits.com/2026/10/14/package-managers-have-an-integrity-problem/