Daily Cyber Brief, October 19, 2026

Unauthenticated bypass takes over the support server. Exploited since August.

Self-hosted Remote Support on 24.3.1 through 26.2.3: apply the BT26-05-RS patch. On older versions, upgrade first. Check whether automatic updates are on; BeyondTrust advises manual patching for self-hosted instances that are not subscribed to them.

Ransomware confirmed. Files with personal information stolen; phones and family portal down.

Any school board or public body: map which records establish identity or residency and which hold health or support-needs information, and who can reach them.

Names, addresses and birth dates accessed in a 3.5-million-member loyalty database.

Any organization holding customer loyalty data: list which personal fields are collected as optional, and whether each is needed.

Three-flaw chain to root on the VPN appliance. Two patched. Honeypots logged 105 attempts.

Upgrade to the fixed version, as Ivanti advises; the CVE record lists 22.8R2.5, 25.1.3.0 and 25.1.3.1 as unaffected. These builds do not yet fix the privilege escalation flaw. Version 22.8 reaches end of life on 31 January 2027, and CISA points customers to Ivanti's Connect Secure Upgrade and Migration Compatibility Guide.

Security-feature bypass, exploited zero-day in a record 1,413-fix Patch Tuesday.

Install the October 2026 Windows updates, starting with the fix for CVE-2026-96951. The US federal due date (CISA KEV) was 16 October 2026.

Arbitrary file write to root command execution. Exploited in attacks.

Update Content Scanner Tools to 25.3.0.5525 or later with contentscannerupdate, or turn on automatic updates, then confirm the version with contentscannerstatus. Cisco's full fix is in AsyncOS 15.5.5-014 and 16.5.0-780. A 16.0 gateway has no fixed build and must migrate.

Auth bypass plus command injection on the backup server. First patch was incomplete.

Apply the AhsayCBS 10.3.4.45 hotfix on v10, or the 9.15.2.70 hotfix on v7, v8 or v9, then reboot the server, as Ahsay says.

Authenticated remote code execution in the management interface. Active exploitation.

Upgrade to the fixed release for your PAN-OS train listed in Palo Alto's advisory. The US federal due date (CISA KEV) was 17 October 2026.