https://signal-desk-d5t.pages.devExploited-now security news, threat hunting, AI security and practical playbooks.https://signal-desk-d5t.pages.dev/news#cve-2026-96951https://signal-desk-d5t.pages.dev/news#cve-2026-96951Tue, 13 Oct 2026 00:00:00 +0000confirmedMicrosoft's October Patch Tuesday marks this Windows Shell security feature bypass (CVSS 8.8) as 'Exploitation Detected'. CISA added it to KEV on Oct 13 (listed as a Windows command injection) with an Oct 16 federal due date. Patch Windows endpoints first.https://signal-desk-d5t.pages.dev/news#cve-2026-104935https://signal-desk-d5t.pages.dev/news#cve-2026-104935Tue, 13 Oct 2026 00:00:00 +0000confirmedAuthentication bypass by spoofing leading to remote command execution (CVSS 8.6). Listed in CISA KEV on Oct 13 with an Oct 16 due date. Apply Ivanti's fix and review appliance integrity.https://signal-desk-d5t.pages.dev/news#pt-2026-10https://signal-desk-d5t.pages.dev/news#pt-2026-10Tue, 13 Oct 2026 00:00:00 +0000confirmedNot known exploited, but high-value: Exchange Server RCE CVE-2026-70571 (8.1) and AD Domain Services RCE CVE-2026-70229 (8.1), both 'Exploitation More Likely'; Outlook RCEs at 9.8 such as CVE-2026-70242; Message Queuing RCE CVE-2026-100202 (9.8); DHCP Server RCE CVE-2026-96934 and QUIC RCEs. Severity and exploitability labels are Microsoft's.https://signal-desk-d5t.pages.dev/news#redcaphttps://signal-desk-d5t.pages.dev/news#redcapTue, 13 Oct 2026 00:00:00 +0000exploited (researcher), not on KEVUnit 42 reports attacks dropping a webshell then a fileless XMRig miner. Fixed in 16.0.49, 17.3.10 and 17.4.4. Not in CISA KEV as of Oct 13; NVD has no entry yet.https://signal-desk-d5t.pages.dev/news#vcenter-rumorhttps://signal-desk-d5t.pages.dev/news#vcenter-rumorTue, 13 Oct 2026 00:00:00 +0000unconfirmedA dark-web monitor claims an exploit is for sale at $10k. No confirmed in-the-wild use. Make sure vCenter is patched and not internet-facing.https://signal-desk-d5t.pages.dev/news#ahsayhttps://signal-desk-d5t.pages.dev/news#ahsayMon, 12 Oct 2026 00:00:00 +0000exploited (vendor/researcher), not on KEVAuth bypass chained with Replication Receiver RCE gives SYSTEM. Huntress observed webshells and a disguised crypto miner. The first fix was incomplete: install hotfix 10.3.4.45 (v10) or 9.15.2.70 (v7-v9), reboot, then hunt for compromise. Not in CISA KEV as of Oct 13.https://signal-desk-d5t.pages.dev/news#bricksforgehttps://signal-desk-d5t.pages.dev/news#bricksforgeMon, 12 Oct 2026 00:00:00 +0000exploited (Patchstack), not independently re-verifiedPatchstack reports first exploitation on Oct 7. Update the plugin or remove it. We could not reach a primary advisory page today, so treat details as preliminary. Not in KEV as of Oct 13.https://signal-desk-d5t.pages.dev/news#sonicwallhttps://signal-desk-d5t.pages.dev/news#sonicwallFri, 09 Oct 2026 00:00:00 +0000exploitation reported, not on KEVPre-auth SSRF in the Work Place interface (advisory SNWLID-2026-0017). Upgrade to 12.4.3-03670 or 12.5.0-03082; note 12.5.0-02952, the September zero-day fix, is now listed as affected. Canada's Cyber Centre cites open-source reports of exploitation. Not in KEV as of Oct 13.