---
title: Signal Desk: security news, hunting, AI security, playbooks
url: https://signal-desk-d5t.pages.dev/
---

# Signal Desk

Exploited-now security news, threat hunting, AI security and practical playbooks.

## [Cybersecurity News](/news)

confirmed

2026-10-13

### Windows Shell zero-day CVE-2026-96951 exploited; on CISA KEV, due Oct 16

Microsoft's October Patch Tuesday marks this Windows Shell security feature bypass (CVSS 8.8) as 'Exploitation Detected'. CISA added it to KEV on Oct 13 (listed as a Windows command injection) with an Oct 16 federal due date. Patch Windows endpoints first.

Sources: [MSRC](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951) · [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

confirmed

2026-10-13

### Ivanti Connect Secure CVE-2026-104935 added to KEV, due Oct 16

Authentication bypass by spoofing leading to remote command execution (CVSS 8.6). Listed in CISA KEV on Oct 13 with an Oct 16 due date. Apply Ivanti's fix and review appliance integrity.

Sources: [Ivanti advisory](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935) · [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

confirmed

2026-10-13

### October 2026 Patch Tuesday: criticals to prioritize after the zero-day

Not known exploited, but high-value: Exchange Server RCE CVE-2026-70571 (8.1) and AD Domain Services RCE CVE-2026-70229 (8.1), both 'Exploitation More Likely'; Outlook RCEs at 9.8 such as CVE-2026-70242; Message Queuing RCE CVE-2026-100202 (9.8); DHCP Server RCE CVE-2026-96934 and QUIC RCEs. Severity and exploitability labels are Microsoft's.

Sources: [MSRC release notes](https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct) · [NVD CVE-2026-70571](https://nvd.nist.gov/vuln/detail/CVE-2026-70571) · [NVD CVE-2026-70229](https://nvd.nist.gov/vuln/detail/CVE-2026-70229) · [NVD CVE-2026-70242](https://nvd.nist.gov/vuln/detail/CVE-2026-70242) · [NVD CVE-2026-100202](https://nvd.nist.gov/vuln/detail/CVE-2026-100202)

## [Threat Hunting](/hunting)

hunt idea

2026-10-13

### Hunt: AhsayCBS / REDCap post-exploitation (webshell → miner)

Both campaigns end in web-server-spawned shells and miners. Look for the web service process spawning cmd/powershell/sh, new script files in web roots, and outbound connections to mining pools.// KQL (Defender) sketch DeviceProcessEvents | where InitiatingProcessFileName in~ ("java.exe","w3wp.exe","httpd","php-fpm") | where FileName in~ ("cmd.exe","powershell.exe","sh","bash") | project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLineTune the parent list to your stack. Sketch only; validate before alerting.

Sources: [Huntress](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) · [Unit 42 (via X)](https://x.com/Unit42_Intel/status/2109811397617992120)

hunt idea

2026-10-13

### Hunt: SonicWall SMA1000 SSRF abuse

Review SMA1000 access logs for unauthenticated requests to unusual Work Place paths, and investigate unexpected connections from the appliance to internal services. Rotate credentials for anything reachable through the appliance's trust context.

Sources: [SonicWall PSIRT](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017)

## [AI](/ai)

tool, community

2026-10-13

### Agentic Bug Hunter (community bug-bounty toolkit)

Built around Claude Code: recon, known-CVE scanning and attack-surface ranking. Caveats: third-party community project, not audited by us; needs Claude Code or API access and won't run fully on local models without changes; only point it at targets you're authorized to test.

Sources: [GitHub](https://github.com/awarexone/Agentic-Bug-Hunter)

tool

2026-10-11

### GitHub Security Lab Fuzzing Taskflow

Open-source taskflows for the seclab-taskflow-agent framework that use an LLM to plan, build and triage fuzzing harnesses. Caveats: needs model API access and real compute; LLM-written harnesses still need human review, and crashes are not vulnerabilities until triaged.

Sources: [seclab-taskflows-fuzzing](https://github.com/GitHubSecurityLab/seclab-taskflows-fuzzing) · [seclab-taskflow-agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent)

## [Playbooks](/playbooks)

[Patch Tuesday Triage](/playbooks/patch-tuesday-triage): A six-step path from release-notes day to verified rollout. Work top to bottom; each step ends with a checklist.

## [Tips & Guides](/tips)

guide

2026-10-13

### Track CISA KEV yourself in one command

KEV is a public JSON feed. Pull the latest additions with: curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | jq '.vulnerabilities | sort_by(.dateAdded) | .[-5:][] | {cveID, dateAdded, dueDate}'

Sources: [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## [Industry News](/industry)

Nothing verified yet.