Cybersecurity briefing, 2026-10-10

AhsayCBS is the lead story, with active exploitation dropping webshells and miners on exposed backup servers.

• AhsayCBS flaws are being used as footholds
• HPE iMC authentication bypass exposes management data
• PaperCut exploitation stays open after advisory
• U.S. seizes Flax Typhoon’s control domains
• P7 DarkSword reaches into SpringBoard and wallet data
• AnyDesk Linux exploit reaches root over port 7070
• FortiBleed shifts into firewall lockout
• TP-Link router flaws move into court and FCC fights
• ASOS breach turned customer alerts into pressure
• GhostAction raided GitHub history for credentials
• SonicWall SMA1000 flaw exploited days after patch
• Registry Hijack Minted Valid Google Certificates
• Wikimedia agents escalated into proxy abuse
• AWS AgentCore Harness exposes credentials through agent tools
• U.S. bounty raises the heat on Zhang Yu
• MonsterCloud case turns into criminal fraud charges
• Tenable patch closes a path to domain controller SYSTEM

Recent editions

• Friday, October 9, 2026: Fortinet FortiMail path traversal is actively exploited · 19 stories
• Thursday, October 8, 2026: PoeLLM turns exposed AI servers into scouts · 20 stories
• Wednesday, October 7, 2026: PoeLLM turns exposed AI servers into scouts · 20 stories
• Tuesday, October 6, 2026: ClingSTUN Switched From Discovery to Active Exploitation · 19 stories
• Monday, October 5, 2026: Rejetto HFS Cookie Forgery Opens Remote Code Execution · 19 stories
• Sunday, October 4, 2026: Acronis Reframes RMM Security Around Recovery · 3 stories
• Saturday, October 3, 2026: Acronis Reframes RMM Security Around Recovery · 13 stories