Briefing — 15 October 2026

🎧 Subscribe to the podcast feed | Direct audio link

Security News

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks (BleepingComputer) — A remote code execution vulnerability in PAN-OS is being actively exploited in the wild; patch firewalls immediately.

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant (Unit 42) — Unit 42 has identified a sophisticated persistent implant targeting FortiGate appliances, suggesting organised threat actors are maintaining long-term access on network edge devices.

Cisco make-me-root email bug exploited as a 0-day by unknown crims (The Register) — A privilege-escalation zero-day in Cisco email software is being exploited by unknown criminal actors, enabling root access via a crafted email.

Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles (Dark Reading) — Active exploitation of Ivanti ICS zero-days exposes a structural problem where customers remain exposed during lengthy vendor patch development cycles.

Yam Store: The Phishing Network Behind a Billion Messages (Dark Reading) — Research profiles a phishing-as-a-service platform responsible for over one billion malicious messages, illustrating the industrial scale of modern phishing infrastructure.

Fridge hack costing millions and sparking fires stemmed from poor security (Ars Technica) — A supply chain attack on smart home appliances pushed malicious firmware via a third-party update mechanism, causing fires and millions in damages.

NATO may redeploy anti-drone defenses as attacks sink more Black Sea shipping (Ars Technica) — NATO is considering redeploying drone defences as kinetic attacks on Black Sea shipping continue, with implications for maritime logistics and hybrid threat models.

Microsoft Defender Now Supports Linux Desktops (Slashdot) — Microsoft has extended Defender endpoint protection to Linux desktop environments, broadening enterprise security tooling coverage.

UK & Critical National Infrastructure

No new NCSC advisories have been published in the past 48 hours.

However, two actively exploited vulnerabilities warrant emergency action from UK CNI operators. The Palo Alto PAN-OS RCE and the Cisco email zero-day affect products widely deployed across UK critical infrastructure including energy, finance, government, and transport networks. Both are being actively exploited by unknown actors. Treat patching these as an emergency priority, not a scheduled maintenance task.

The PEERSTITCH FortiGate implant research from Unit 42 is also highly relevant to UK defenders — FortiGate appliances are common in UK public sector and CNI environments, and the implant may have been deployed during earlier FortiManager compromise activity. Organisations that ran FortiGate during the CVE-2024-47575 campaign window should treat their estate as potentially backdoored until proven otherwise.

On the geopolitical side, drone attacks on Black Sea shipping continue to escalate, with NATO considering repositioning air defence assets. UK maritime operators and logistics providers should be aware that adversaries are applying multi-domain pressure — physical and digital — to shipping infrastructure simultaneously.

Ransomware Victims (48h) — 49 victims · 17 groups

HaveIBeenPwned — New Breaches