{
 "site": "Signal Desk",
 "generated": "2026-10-13T20:47:42Z",
 "sections": [
  {
   "id": "news",
   "title": "Cybersecurity News",
   "nav": "News",
   "desc": "Exploited-now vulnerabilities and patch alerts, each checked against CISA KEV or the vendor."
  },
  {
   "id": "hunting",
   "title": "Threat Hunting",
   "nav": "Hunting",
   "desc": "Hunt ideas and query sketches (KQL / Sigma-style) tied to current threats, with sources."
  },
  {
   "id": "ai",
   "title": "AI",
   "nav": "AI",
   "desc": "AI security and AI for security: vuln-hunting agents and tools, with honest caveats."
  },
  {
   "id": "playbooks",
   "title": "Playbooks",
   "nav": "Playbooks",
   "desc": "Step-by-step paths with checklists you can work through."
  },
  {
   "id": "tips",
   "title": "Tips & Guides",
   "nav": "Tips",
   "desc": "Short, practical how-tos."
  },
  {
   "id": "industry",
   "title": "Industry News",
   "nav": "Industry",
   "desc": "Vendor, policy and market news that affects defenders."
  }
 ],
 "items": [
  {
   "id": "cve-2026-96951",
   "section": "news",
   "date": "2026-10-13",
   "status_label": "confirmed",
   "title": "Windows Shell zero-day CVE-2026-96951 exploited; on CISA KEV, due Oct 16",
   "body": "Microsoft's October Patch Tuesday marks this Windows Shell security feature bypass (CVSS 8.8) as 'Exploitation Detected'. CISA added it to KEV on Oct 13 (listed as a Windows command injection) with an Oct 16 federal due date. Patch Windows endpoints first.",
   "sources": [
    [
     "MSRC",
     "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951"
    ],
    [
     "CISA KEV",
     "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
    ]
   ]
  },
  {
   "id": "cve-2026-104935",
   "section": "news",
   "date": "2026-10-13",
   "status_label": "confirmed",
   "title": "Ivanti Connect Secure CVE-2026-104935 added to KEV, due Oct 16",
   "body": "Authentication bypass by spoofing leading to remote command execution (CVSS 8.6). Listed in CISA KEV on Oct 13 with an Oct 16 due date. Apply Ivanti's fix and review appliance integrity.",
   "sources": [
    [
     "Ivanti advisory",
     "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935"
    ],
    [
     "CISA KEV",
     "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
    ]
   ]
  },
  {
   "id": "pt-2026-10",
   "section": "news",
   "date": "2026-10-13",
   "status_label": "confirmed",
   "title": "October 2026 Patch Tuesday: criticals to prioritize after the zero-day",
   "body": "Not known exploited, but high-value: Exchange Server RCE CVE-2026-70571 (8.1) and AD Domain Services RCE CVE-2026-70229 (8.1), both 'Exploitation More Likely'; Outlook RCEs at 9.8 such as CVE-2026-70242; Message Queuing RCE CVE-2026-100202 (9.8); DHCP Server RCE CVE-2026-96934 and QUIC RCEs. Severity and exploitability labels are Microsoft's.",
   "sources": [
    [
     "MSRC release notes",
     "https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct"
    ],
    [
     "NVD CVE-2026-70571",
     "https://nvd.nist.gov/vuln/detail/CVE-2026-70571"
    ],
    [
     "NVD CVE-2026-70229",
     "https://nvd.nist.gov/vuln/detail/CVE-2026-70229"
    ],
    [
     "NVD CVE-2026-70242",
     "https://nvd.nist.gov/vuln/detail/CVE-2026-70242"
    ],
    [
     "NVD CVE-2026-100202",
     "https://nvd.nist.gov/vuln/detail/CVE-2026-100202"
    ]
   ]
  },
  {
   "id": "redcap",
   "section": "news",
   "date": "2026-10-13",
   "status_label": "exploited (researcher), not on KEV",
   "title": "REDCap CVE-2026-90817 unauthenticated RCE exploited via public surveys",
   "body": "Unit 42 reports attacks dropping a webshell then a fileless XMRig miner. Fixed in 16.0.49, 17.3.10 and 17.4.4. Not in CISA KEV as of Oct 13; NVD has no entry yet.",
   "sources": [
    [
     "Unit 42 (via @Unit42_Intel)",
     "https://x.com/Unit42_Intel/status/2109811397617992120"
    ]
   ]
  },
  {
   "id": "vcenter-rumor",
   "section": "news",
   "date": "2026-10-13",
   "status_label": "unconfirmed",
   "title": "Rumor: exploit for VMware vCenter CVE-2026-59310 offered for sale",
   "body": "A dark-web monitor claims an exploit is for sale at $10k. No confirmed in-the-wild use. Make sure vCenter is patched and not internet-facing.",
   "sources": [
    [
     "@ptdbugs",
     "https://x.com/ptdbugs/status/2109657410138693679"
    ],
    [
     "NVD",
     "https://nvd.nist.gov/vuln/detail/CVE-2026-59310"
    ]
   ]
  },
  {
   "id": "agentic-bug-hunter",
   "section": "ai",
   "date": "2026-10-13",
   "status_label": "tool, community",
   "title": "Agentic Bug Hunter (community bug-bounty toolkit)",
   "body": "Built around Claude Code: recon, known-CVE scanning and attack-surface ranking. Caveats: third-party community project, not audited by us; needs Claude Code or API access and won't run fully on local models without changes; only point it at targets you're authorized to test.",
   "sources": [
    [
     "GitHub",
     "https://github.com/awarexone/Agentic-Bug-Hunter"
    ]
   ]
  },
  {
   "id": "hunt-ahsay",
   "section": "hunting",
   "date": "2026-10-13",
   "status_label": "hunt idea",
   "title": "Hunt: AhsayCBS / REDCap post-exploitation (webshell \u2192 miner)",
   "body": "Both campaigns end in web-server-spawned shells and miners. Look for the web service process spawning cmd/powershell/sh, new script files in web roots, and outbound connections to mining pools.<pre>// KQL (Defender) sketch\nDeviceProcessEvents\n| where InitiatingProcessFileName in~ (\"java.exe\",\"w3wp.exe\",\"httpd\",\"php-fpm\")\n| where FileName in~ (\"cmd.exe\",\"powershell.exe\",\"sh\",\"bash\")\n| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine</pre>Tune the parent list to your stack. Sketch only; validate before alerting.",
   "sources": [
    [
     "Huntress",
     "https://www.huntress.com/blog/ahsaycbs-flaws-exploit"
    ],
    [
     "Unit 42 (via X)",
     "https://x.com/Unit42_Intel/status/2109811397617992120"
    ]
   ]
  },
  {
   "id": "hunt-sma",
   "section": "hunting",
   "date": "2026-10-13",
   "status_label": "hunt idea",
   "title": "Hunt: SonicWall SMA1000 SSRF abuse",
   "body": "Review SMA1000 access logs for unauthenticated requests to unusual Work Place paths, and investigate unexpected connections from the appliance to internal services. Rotate credentials for anything reachable through the appliance's trust context.",
   "sources": [
    [
     "SonicWall PSIRT",
     "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
    ]
   ]
  },
  {
   "id": "tip-kev-feed",
   "section": "tips",
   "date": "2026-10-13",
   "status_label": "guide",
   "title": "Track CISA KEV yourself in one command",
   "body": "KEV is a public JSON feed. Pull the latest additions with: <pre>curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | jq '.vulnerabilities | sort_by(.dateAdded) | .[-5:][] | {cveID, dateAdded, dueDate}'</pre>",
   "sources": [
    [
     "CISA KEV",
     "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
    ]
   ]
  },
  {
   "id": "ahsay",
   "section": "news",
   "date": "2026-10-12",
   "status_label": "exploited (vendor/researcher), not on KEV",
   "title": "AhsayCBS CVE-2026-105133 + CVE-2026-105134 chain exploited since Oct 7",
   "body": "Auth bypass chained with Replication Receiver RCE gives SYSTEM. Huntress observed webshells and a disguised crypto miner. The first fix was incomplete: install hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7-v9), reboot, then hunt for compromise. Not in CISA KEV as of Oct 13.",
   "sources": [
    [
     "Huntress",
     "https://www.huntress.com/blog/ahsaycbs-flaws-exploit"
    ],
    [
     "Ahsay",
     "https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update"
    ]
   ]
  },
  {
   "id": "bricksforge",
   "section": "news",
   "date": "2026-10-12",
   "status_label": "exploited (Patchstack), not independently re-verified",
   "title": "Bricksforge WordPress plugin CVE-2026-85097 unauthenticated RCE",
   "body": "Patchstack reports first exploitation on Oct 7. Update the plugin or remove it. We could not reach a primary advisory page today, so treat details as preliminary. Not in KEV as of Oct 13.",
   "sources": [
    [
     "Patchstack database",
     "https://patchstack.com/database/"
    ],
    [
     "@averyjparker summary",
     "https://x.com/averyjparker/status/2109617279910674795"
    ]
   ]
  },
  {
   "id": "fuzzing-taskflow",
   "section": "ai",
   "date": "2026-10-11",
   "status_label": "tool",
   "title": "GitHub Security Lab Fuzzing Taskflow",
   "body": "Open-source taskflows for the seclab-taskflow-agent framework that use an LLM to plan, build and triage fuzzing harnesses. Caveats: needs model API access and real compute; LLM-written harnesses still need human review, and crashes are not vulnerabilities until triaged.",
   "sources": [
    [
     "seclab-taskflows-fuzzing",
     "https://github.com/GitHubSecurityLab/seclab-taskflows-fuzzing"
    ],
    [
     "seclab-taskflow-agent",
     "https://github.com/GitHubSecurityLab/seclab-taskflow-agent"
    ]
   ]
  },
  {
   "id": "sonicwall",
   "section": "news",
   "date": "2026-10-09",
   "status_label": "exploitation reported, not on KEV",
   "title": "SonicWall SMA1000 CVE-2026-102255 pre-auth SSRF under attack",
   "body": "Pre-auth SSRF in the Work Place interface (advisory SNWLID-2026-0017). Upgrade to 12.4.3-03670 or 12.5.0-03082; note 12.5.0-02952, the September zero-day fix, is now listed as affected. Canada's Cyber Centre cites open-source reports of exploitation. Not in KEV as of Oct 13.",
   "sources": [
    [
     "SonicWall PSIRT",
     "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"
    ],
    [
     "CVE record",
     "https://www.cve.org/CVERecord?id=CVE-2026-102255"
    ],
    [
     "Cyber Centre AV26-1017",
     "https://www.cyber.gc.ca/en/alerts-advisories/sonicwall-security-advisory-av26-1017"
    ]
   ]
  }
 ],
 "playbooks": [
  {
   "slug": "patch-tuesday-triage",
   "title": "Patch Tuesday Triage",
   "summary": "A six-step path from release-notes day to verified rollout. Work top to bottom; each step ends with a checklist.",
   "audience": [
    "Security lead",
    "Sysadmin",
    "Helpdesk"
   ],
   "steps": [
    {
     "t": "Pull the facts",
     "d": "Start from primary sources, not headlines. Open the MSRC release notes and the CISA KEV catalog side by side.",
     "c": [
      "Note every CVE Microsoft marks 'Exploitation Detected'",
      "Note anything publicly disclosed",
      "Check KEV for same-day additions and their due dates",
      "Record the KB numbers for each Windows build you run"
     ]
    },
    {
     "t": "Map to what you own",
     "d": "A critical bug in a product you don't run is noise. Match the list against your asset inventory.",
     "c": [
      "List affected products present in your estate (Exchange, AD DS, Outlook, DHCP, MSMQ, QUIC, Hyper-V)",
      "Flag internet-facing systems",
      "Flag domain controllers and identity infrastructure separately"
     ]
    },
    {
     "t": "Rank by real risk",
     "d": "Order: exploited and exposed \u2192 exploited internal \u2192 'More Likely' on exposed services \u2192 everything else.",
     "c": [
      "Exploited zero-days get an emergency change",
      "Check whether features like the Outlook Preview Pane are an attack vector",
      "Write down the order and why, in one line per item"
     ]
    },
    {
     "t": "Mitigate what you can't patch today",
     "d": "Buy time where patching needs a maintenance window.",
     "c": [
      "Apply vendor workarounds where published",
      "Restrict exposure (firewall, disable unused roles like MSMQ)",
      "Turn on extra logging or detection for the affected component"
     ]
    },
    {
     "t": "Roll out in rings",
     "d": "Pilot, then broad, then the stragglers. Keep a rollback plan for domain controllers and Exchange.",
     "c": [
      "Ring 0: IT and test devices within 24 hours",
      "Ring 1: broad endpoints within the week",
      "Servers in agreed windows; DCs one at a time",
      "Track failed installs and reboots pending"
     ]
    },
    {
     "t": "Verify and close",
     "d": "A deployed patch isn't a fixed vulnerability until you've checked.",
     "c": [
      "Confirm build numbers or KBs installed via your management tool",
      "Rescan with your vulnerability scanner",
      "Hunt for signs of exploitation predating the patch on exposed systems",
      "Log exceptions with an owner and expiry date"
     ]
    }
   ]
  }
 ]
}