Five security and network products were attacked before their makers had a fix, and SonicWall’s flaw was exploited three days after its patch.
Five protective products became the way in
Companies buy firewalls, remote-access gateways and email filters to keep attackers out. In the first half of October, five of those products were attacked through flaws their makers did not yet know about. Fortinet, Citrix, Ivanti, Palo Alto Networks and Cisco each had to release fixes while attacks were already under way. The US cybersecurity agency urged organisations to update the Ivanti product immediately.
A flaw in a SonicWall remote-access product was fixed on a Tuesday and was being attacked by Friday. Microsoft released fixes for a record 1,413 flaws in a single monthly update, more than any team can apply at once.
Story 01 · Protective products attacked
Five makers of protective equipment were attacked before they had a fix
When attackers use a flaw that the maker has not yet fixed, defenders have had no time to prepare. That happened to Fortinet and Cisco email filters, Citrix and Ivanti remote-access gateways, and a Palo Alto Networks firewall. In the Ivanti case, attackers gained full control of gateways that were fully up to date, because an earlier fix in July had only partly closed the gap.
Story 02 · A short window
SonicWall’s fix was exploited within three days
SonicWall released a fix for a remote-access product on 6 October. Attackers were using the flaw by 9 October, and a security firm counted 135 attempts by 12 October. A month of testing before applying a fix like this leaves the product exposed for the whole month.
Story 03 · Japan
Four Japanese companies lost customer data or had services shut down
Times Car, Lawson and skyticket disclosed thefts of customer records covering millions of people. IDC Frontier, a cloud provider owned by SoftBank, was hit by ransomware that shut down servers for 495 organisations. Headlines claimed that artificial intelligence was behind the attacks and that Japan declared a national emergency. No source reviewed supports either claim. The full analysis is in our Advisory SW-A003.
Story 04 · Machines finding flaws
AI tools are finding serious software flaws
Researchers used a publicly available AI model to build a working attack on the Chrome web browser in six days. An AI tool also found a flaw in a widely used file-sharing program that attackers are now exploiting. A security trade publication separately argued that most serious attackers barely use AI. The AI findings are reported by researchers. The claim that criminals use AI widely rests on commentary, and no measurement supports it yet.
Story 05 · Russia
Drone strikes hit Russian data centres, and a popular claim about bots is disputed
Ukrainian drones damaged three data centres belonging to Yandex, a large Russian technology company, and many of its services went offline. Automated web traffic from Yandex’s network fell sharply, and Ukraine’s president said social media became less hostile as a result. Analysts who looked at the data say the drop reflects Yandex’s own systems going offline, and that malicious bots moved to other networks. The claim that the strikes silenced Russian propaganda accounts is unproven.
What this means for you
Six questions to put to your IT team and your suppliers this week.
Your edge devices
Which firewalls, remote-access gateways and email filters does the company run, and are any among the five named here?
Speed of a fix
How quickly can a fix be applied once the maker reports an attack in progress, and who can approve it outside normal hours?
Exposure
Can those devices be reached from the internet, and who can log in to manage them?
Suppliers
Do any suppliers run these products on your behalf, and how would they tell you about an attack?
Identity data
How many copies of customers’ identity documents do you keep, and why?
AI and bot claims
Treat claims that AI caused a particular attack, or that a strike silenced a network of bots, as unproven until investigators or measurement support them.
Terms used in the stories
Zero-day. A flaw that attackers use before the maker has issued a fix, so defenders had zero days to prepare.
Remote-access gateway. The device that lets staff connect to internal systems from outside the office.
Firewall. A device that filters the traffic entering and leaving a company network.
Email gateway. A device that filters an organisation’s email for spam and malicious attachments.
Ransomware. Software that locks a company’s systems until a payment is made.
Bot. Software that sends web requests automatically. A search-engine crawler is a bot, and so is a fake social media account run by software.
The Technical Briefing
First half of October: the security stack
Fortinet, Citrix, Ivanti, Palo Alto Networks and Cisco each patched a zero-day in a security or access product. SonicWall’s maximum-severity flaw was exploited three days after its fix. Microsoft shipped a record update. Japan recorded four incidents of customer-data theft or ransomware. Ukrainian strikes on Yandex data centres produced a disputed claim about Russian bots. AI-found flaws and an AI-built Chrome exploit appear alongside a trade-press argument that attacker use of AI is overstated.
01Executive Overview
Five zero-days in edge and mail products
Between 1 and 14 October, five vendors disclosed actively exploited zero-days in products that sit at the network edge or filter inbound mail. Four of the five entered the CISA Known Exploited Vulnerabilities (KEV) catalogue. In the Ivanti case, researchers reported root access on a fully patched gateway after a July fix proved incomplete. SonicWall’s CVE-2026-102255 (CVSS 10.0) was exploited three days after its patch. Microsoft’s October release carried 1,413 fixes, including one exploited Windows zero-day. In Japan, Times Car, Lawson, skyticket and IDC Frontier disclosed incidents covered in section 05 and in Advisory SW-A003.
Each of these products holds a privileged position: it sees traffic, terminates sessions or holds credentials. An attacker who controls one gains a foothold that bypasses the controls it was bought to provide.
02Zero-Days in the Security Stack
Signal 01 · Email Security
Fortinet FortiMail and Cisco Secure Email Gateway both let unauthenticated attackers write files
ConfirmedHighCISA KEVCVE-2026-104286
CISA added FortiMail CVE-2026-104286 (CVSS 9.8) to KEV on 1 October. It lets an unauthenticated attacker write arbitrary files to the underlying system. Two weeks later Cisco reported that attackers were exploiting a critical Secure Email Gateway flaw. A crafted attachment sent through the gateway lets an attacker without a login write files and then run commands as root. BleepingComputer described it as another zero-day in that product.
Signal 02 · Remote Access
Ivanti and Citrix gateways were attacked, one of them fully patched
ConfirmedHighCISA KEVCVE-2026-104935CVE-2026-88779
CISA urged immediate updates to Ivanti Connect Secure after disclosure of CVE-2026-104935 (CVSS 8.6), an authentication bypass. Honeypots logged 105 exploit attempts. SecurityWeek reported that the chain gave attackers root access to a fully patched VPN. Dark Reading reported that the flaw was only partly found and fixed in July.
Citrix released emergency fixes on 4 October for CVE-2026-88779, a memory overflow in NetScaler ADC and Gateway used in zero-day attacks. It is rated as a denial-of-service flaw, and researchers noted it can knock SAML single sign-on deployments offline. BleepingComputer reported that researchers were investigating whether it could also enable remote code execution. That question was open at the time of writing.
Signal 03 · Firewalls
Palo Alto Networks patched an exploited PAN-OS flaw in the management interface
ConfirmedHighCISA KEVCVE-2026-0322
The fix addresses a remote code execution flaw in the PAN-OS management interface. The company told customers it is aware of limited exploitation against firewalls and has published indicators of compromise. The Hacker News describes it as an authenticated flaw, so exposure of the management interface determines risk.
03Patch Pace & Volume
Signal 04 · Exploitation After the Patch
SonicWall SMA 1000 was exploited three days after its fix
ConfirmedHighCVE-2026-102255
The flaw is a pre-authenticated server-side request forgery rated CVSS 10.0. BleepingComputer reported exploitation on 9 October, three days after the Tuesday patch. By 12 October, 135 exploitation attempts had been recorded.
Signal 05 · Volume
Microsoft patched a record 1,413 vulnerabilities
ConfirmedMed-HighCVE-2026-96951
The October release includes an exploited Windows security-feature bypass (CVE-2026-96951, CVSS 8.8), also in KEV. Prioritisation sets the order of work, since patching in arrival order cannot cover 1,413 fixes.
04AI: Reported Results and Commentary
AI results from researchers, and commentary from the trade press
XBOW chained three then-unknown Chrome bugs into a full attack that runs code when a user loads a page, directing agents on OpenAI’s publicly available GPT-5.6 Sol model. Google confirmed and fixed all three. Source
In an isolated lab, AI models met every objective across eight scenarios and reached an industrial control network from a perimeter compromise in just over 16 minutes. Source
Tencent Zhuque Lab found the Linux vhost flaw (CVE-2026-74580) that gives local root. SecurityWeek reports exploitation of the AI-discovered Rejetto HFS flaw (CVE-2026-61500).
None of the five zero-days was reported as AI-driven. Each needed a flaw and a network path.
05Japan: Data Theft & a Cloud Outage
Four incidents, reported by the companies
Advisory SW-A003 sets out the evidence in full, with ten primary sources. The figures below come from the companies’ own disclosures.
Times Car (Park24)
6.6 mAccounts stolenNames, addresses, birth dates and driving-licence details. 1.6 million accounts also had ID document images exposed.
skyticket
14.64 mCustomer recordsFrom a server intrusion on 2 to 4 October. No credit card numbers or passport images.
IDC Frontier (SoftBank)
495Organisations disruptedRansomware on 7 October shut down virtual servers in East Japan. On 14 October the company reported no evidence data was taken from customer servers.
Signal 06 · Japan Alert
JPCERT/CC reported mobile-app API abuse and known-flaw exploitation behind the data leaks
ConfirmedHigh
The JPCERT/CC alert of 8 October says attackers abused APIs for mobile apps and targeted known software flaws. The alert names no attacker and no affected organisation, and says the same methods were not necessarily used in every incident. The Hacker News also ties the alert to attacks on the Metabase analytics tool. No source reviewed attributes these incidents to AI, and investigators have not established a link between them.
Signal 07 · Other Japanese Disclosures
A contractor malware infection exposed 8.7 million records, and Nikkei lost two email accounts
ConfirmedMedium
Daiichi Kosho disclosed that malware at its contractor Nippon Columbia exposed more than 8.7 million customer and employee records. BleepingComputer’s headline gives 8.6 million, and the article text gives 8.7 million. Nikkei disclosed that attackers breached two employee email accounts and used one to send thousands of phishing emails. The sources do not link either case to the four incidents above.
06Infrastructure & State Activity
Signal 08 · Russia
Drone strikes hit three Yandex data centres, and the claim that Russian bots went silent is disputed
Confirmed: strikes and outageUnverified: bot claim
Yandex confirmed on Telegram that drone strikes damaged its servers in Sasovo, Kaluga and Vladimir between 7 and 11 October, according to Snopes. BleepingComputer reported that Yandex shut down two facilities and partly disabled a third, and that users lost access to cloud files. Cloudflare data showed bot traffic from Yandex’s network dropping to 0.4% of its two-week maximum.
Signal 09 · Operational Technology
About 700 French supermarkets hit through refrigeration controllers
ConfirmedMed-High
SecurityWeek reports that the attacks now extend to Copeland and Dixell controllers, and that no group has claimed responsibility. Dark Reading says hundreds of stores lost millions of euros because third parties managed outdated firmware on their cooling systems. No source attributes the attack to AI.
Signal 10 · State Activity
North Korean IT-worker scheme disrupted, and Candiru spyware traced to online ads
ConfirmedMedium
The US Department of Justice charged 14 people and seized about 187 computers and KVM devices in a scheme affecting more than 70 US companies. The Citizen Lab traced zero-click Candiru infections at Al Jazeera to targeted online ads. CISA also added five flaws to KEV after abuse by the China-linked actor Flax Typhoon, with an 11 October deadline for federal agencies.
Signal 11 · Privacy
CenterPoint Energy breach affects 1 million Texans
ConfirmedMedium
SecurityWeek reports that names, addresses, Social Security numbers and driver’s licence numbers were compromised.
07Signals & Patterns
Privileged products
Five zero-days landed in firewalls, gateways and mail filters. Their position gives an attacker visibility and credentials.
Incomplete fixes
Ivanti’s July fix left a gap, and AhsayCBS needed new fixes after incomplete patches. A patch does not prove closure.
Short window
SonicWall went from patch to exploitation in three days. Time to patch is the variable defenders control.
Identity data at scale
Four Japanese companies and CenterPoint together lost records on tens of millions of people, much of it identity data.
08Defender Actions
Inventory the edge
List every firewall, gateway and mail filter, its version and who manages it. Check the five named here first.
Patch KEV entries first
Treat CISA KEV listings as emergency changes. Apply the Ivanti, Citrix, FortiMail, PAN-OS and Cisco fixes, then verify the version.
Close management exposure
Restrict PAN-OS and similar management interfaces to a trusted network. Review logs for the published indicators.
Hunt after patching
A fix does not remove a foothold. Look for web shells, unexpected files and new accounts on affected devices, especially Ivanti and FortiMail.
Plan for the three-day window
Decide in advance who can authorise out-of-hours changes, and which devices can be isolated if a fix is not yet available.
Review APIs and ID data
Check mobile-app back ends and administrative APIs for exposure, as JPCERT/CC describes. Reduce the identity documents you retain and restrict access to them.
09Closing Note
In the first half of October, five security products were exploited before their makers had fixes. Defenders learned of each flaw from the vendor or from CISA, after exploitation had begun. Teams with an inventory of their edge devices and a fast change process could act on each notice the same day.
Sources
- The Hacker News: FortiMail zero-day
- The Hacker News: NetScaler zero-day
- BleepingComputer: Citrix NetScaler
- The Hacker News: Ivanti and CISA
- SecurityWeek: Ivanti zero-day chain
- Dark Reading: Ivanti patching
- The Hacker News: PAN-OS
- SecurityWeek: PAN-OS zero-day
- The Hacker News: Cisco email gateway
- BleepingComputer: Cisco zero-day
- BleepingComputer: SonicWall
- The Hacker News: SonicWall
- SecurityWeek: Microsoft patches
- The Hacker News: XBOW Chrome exploit
- SecurityWeek: Booz Allen OT lab
- The Hacker News: Linux vhost
- SecurityWeek: Rejetto HFS
- Dark Reading: AI and attackers
- Signal Watchtower Advisory SW-A003: Japan
- Park24: identity-document exposure update
- Lawson: breach disclosure
- skyticket: unauthorised access disclosure
- IDC Frontier: investigation update
- JPCERT/CC: JPCERT-AT-2026-0030
- The Hacker News: Japan web data leaks
- BleepingComputer: Nippon Columbia
- BleepingComputer: Nikkei
- BleepingComputer: Yandex outage
- Snopes: Yandex strikes and Russian bots
- Tom’s Hardware: Yandex bot traffic
- CBC: Zelenskyy’s bot claim
- Cybernews: Yandex bot traffic drop
- Cloudflare: Yandex outage and bot migration
- Lawfare: The Russian Bots Went Silent. Or Did They?
- SecurityWeek: supermarket refrigeration
- Dark Reading: EU grocers
- The Hacker News: laptop farms
- The Hacker News: Candiru
- The Hacker News: Flax Typhoon
- SecurityWeek: CenterPoint
About The Signal Watchtower
Published by Elytra Security. Signal-only intelligence across security, privacy, and AI, with confirmed facts kept rigorously separate from claims.
Authored by Venkat Mangudi · Founder & CEO, Elytra Security
Integrity. Trust. Clarity.
An ISO/IEC 27001:2022 Certified Company