The Signal, An Offensive Intelligence Digest (Volume 004)
Welcome to the 4th edition of The Signal, a newsletter designed to improve your signal-to-noise ratio. A monthly digest curated by our Offensive Security Operations Center (OSOC), delivering timely insights into emerging vulnerabilities, threat trends, and the exposures that matter most.
Three Ivanti Connect Secure zero-days chained to root on fully patched appliances, with no web shell and nothing for Ivanti’s Integrity Checker to catch. A CVSS 10.0 in GitLab exploited days after a public proof of concept. PHP exploit details leaked hours before the patch shipped. Thirty-six new entries on CISA’s Known Exploited Vulnerabilities catalog, 14 of them Critical. October was the month time-to-exploit collapsed to hours.
Each month, Evolve Security’s Offensive Security Operations Center (OSOC) tracks the vulnerabilities and threat actors doing the most damage in the wild, not just the ones making headlines. Here’s what mattered in October 2026, and what to do about it.
By the numbers
5 vulnerabilities confirmed exploited in the wild: 3 Critical, 2 High
36 new CISA KEV additions: 14 Critical, 14 High, 7 Medium, 1 Low
10.0: the highest CVSS score of the month (GitLab CE/EE unauthenticated RCE)
3 distinct threat actors tracked: 1 cybercriminal group and 2 ransomware operators
3 of 5: top exploited flaws that hit VPN or email security appliances
Threat actors to watch
UTA0576 (Volexity designation; no public aliases) · Cybercriminal
Assessed as criminal with low confidence. Starting October 3, the group chained three Ivanti Connect Secure zero-days to gain root on fully patched VPN appliances, then went after Active Directory, pulling LDAP, LAPS, and BitLocker secrets. It ran entirely in memory, re-running the exploit chain for every command instead of leaving a web shell behind. Volexity assesses with medium confidence that the group uses LLMs for exploit development. Signature techniques include in-memory Python payloads, Kerberoasting and password spraying, credential sniffing with a renamed tcpdump, and log truncation to cover its tracks.
Qilin (aka Spikey Scorpius, Agenda) · Ransomware
Back for a second consecutive month. This Russian-speaking RaaS operation escalated its use of PAN-OS GlobalProtect CVE-2026-0257 in October to bypass MFA and open VPN sessions, then pivoted to vCenter and ESXi to dump domain credentials offline from a domain controller VMDK, sidestepping in-guest EDR entirely. Targets span healthcare, manufacturing, education, financial services, and government. Expect RMM tool abuse, RDP and SMB lateral movement, ESXi tampering, and Veeam backup targeting (CVE-2023-27532) ahead of double extortion.
INC Ransom (aka Tarnished Scorpius) · Ransomware
Confirmed by Unit 42 in October as a second ransomware operation exploiting CVE-2026-0257 for initial access. INC follows the same VPN-to-virtualization playbook to reach credentials and backups, then exfiltrates data before encryption. Targets include healthcare, education, professional and legal services, and manufacturing.
The pattern worth noting: two ransomware crews, one months-old VPN flaw, and a shared route around endpoint defenses by going straight for the hypervisor.
Top 5 actively exploited vulnerabilities
Active exploitation in the wild, not disclosure alone, was the bar for this list.
1. CVE-2026-104935: Ivanti Connect Secure | CVSS 8.6 | High
An authentication bypass in welcome.cgi combined with a race-condition file write in wu.cgi gives unauthenticated attackers command execution on ICS VPN appliances. UTA0576 exploited it as a zero-day from October 3, chaining it with CVE-2026-111357 (dsinvoked privilege escalation) to reach root on fully patched 22.8R2.4 devices before harvesting LDAP, LAPS, and BitLocker secrets. No web shell was left, and the Integrity Checker did not detect the activity. CISA added CVE-2026-104935 on October 13 and the follow-on CVE-2026-111357 and CVE-2026-118527 on October 30.
Action: Upgrade to 22.8R2.6 or 25.1.1.3 or later, which covers all three CVEs per Ivanti’s updated advisory. Hunt for high request volumes to /dana-na/auth/url_default/welcome.cgi with mismatched X-DSCGI-PATH headers and artifacts in /tmp/. Rotate any AD credentials reachable from the appliance. Do not rely on the Integrity Checker alone.
2. CVE-2026-104286: Fortinet FortiMail | CVSS 9.8 | Critical
A path traversal and NULL-byte handling flaw lets unauthenticated attackers write arbitrary files on FortiMail 7.2 through 8.0.1 via crafted HTTP/HTTPS requests. It was exploited as a zero-day before fixes shipped. Fortinet confirmed in-the-wild exploitation and published IOCs including ld.so.preload persistence and planted binaries under /data/bin. CISA added it on October 1 with a three-day federal deadline.
Action: Upgrade to FortiMail 8.0.2, 7.6.7, or 7.4.9 or later (7.2.x users should move to 7.4+). Until patched, disable IBE (config system encryption ibe / set status disable) and remove internet exposure of the management interface. Check for /data/etc/ld.so.preload, /data/lib/liblog.so, and the published IPs.
3. CVE-2026-97229: GitLab CE/EE | CVSS 10.0 | Critical
An integer overflow in GitLab’s CI/CD regular expression compiler allows unauthenticated code execution on self-managed instances running 19.2 through 19.4. A public exploit followed disclosure, and CISA confirmed active exploitation on October 29 with a three-day federal deadline. Shadowserver tracks roughly 2,800 internet-exposed GitLab CE instances.
Action: Upgrade self-managed GitLab to 19.4.2, 19.3.5, or 19.2.8 immediately. Deploy GitLab’s published detections and review runner and pipeline activity since October 29. Rotate CI/CD secrets, deploy keys, and tokens on any instance that was exposed unpatched.
4. CVE-2026-109618 / CVE-2026-109619: PHP (“PHP2Shell”) | CVSS 9.2 | Critical
Two memory-safety flaws in the PHP engine, in OOM longjmp handling and stale request state, enable unauthenticated RCE against applications such as WordPress and Drupal, with some paths abusing the default-on session upload-progress feature. Exploit details leaked hours before PHP’s October 21 out-of-band release, and Patchstack reported exploitation the same morning, with hosting providers seeing opportunistic mass exploitation within hours. CISA added both CVEs on October 26. Attackers are chaining Linux kernel flaw CVE-2026-46300 (“Fragnesia,” added to KEV October 28) for root.
Action: Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, including PHP bundled in containers, appliances, and managed hosting. Migrate off unsupported branches. Patch the Linux kernel for CVE-2026-46300. Review web logs from October 20 onward and rotate credentials on any host showing signs of compromise.
5. CVE-2026-0257: Palo Alto Networks PAN-OS GlobalProtect | CVSS 7.8 | High
Not a new flaw, but a new chapter. CVE-2026-0257 has been exploited since June; October brought a significant escalation, as ReliaQuest and Unit 42 confirmed Qilin and INC Ransom using it to open VPN sessions without MFA. From there, both groups moved via RDP and SMB to vCenter and ESXi, dumped domain credentials offline from a domain controller VMDK, and targeted Veeam backups (CVE-2023-27532). It’s on this month’s list for the ransomware adoption, not first-time exploitation.
Action: Upgrade to a fixed PAN-OS version or apply Palo Alto’s workarounds. Use a dedicated certificate for Authentication Override cookies, or disable the feature. Hunt GlobalProtect logs for host IDs such as WINDOWS-LAPTOP-001 and DESKTOP-GP01, restrict management access on ports 4443 and 3879, and review vCenter, ESXi, and Veeam access.
CISA KEV: the rest of October’s additions
Beyond the eight KEV entries tied to the five above, CISA added 28 more in October. Critical-severity additions included Cisco Secure Email Gateway, BeyondTrust Remote Support, Atlassian, Collabora Online, Arista VeloCloud Orchestrator, Ahsay AhsayCBS, ONLYOFFICE Docs, Adobe Commerce and Magento, Google Brotli, and ProFTPD.
Old flaws are still finding new victims. On October 8 alone, CISA added vulnerabilities dating back to 2015 and 2016 in ProFTPD, ISC BIND, and Apache Struts, alongside a 2021 ONLYOFFICE flaw and a 2023 Strapi flaw. If legacy services are still running somewhere in your environment, attackers are proving they’ll find them.
The NetScaler story also continued. CVE-2026-88779, the third Citrix NetScaler zero-day we flagged in last month’s outlook, landed on KEV on October 4.
High-severity additions spanned Microsoft Windows, Palo Alto Networks PAN-OS, Cisco Secure Firewall ASA and FTD, two Zammad flaws, EG Secure Solutions SiteGuard, and Plex Media Server, which picked up four KEV entries in a single day. Rounding out the month, a low-severity insufficient logging flaw in VMware ESX is worth noting given how heavily ransomware operators leaned on the virtualization layer in October.
CISA set three-day federal remediation deadlines on most October additions. Every organization, regardless of mandate, should treat KEV inclusion as a high-priority remediation signal.
What actually moves your risk
Exposure to October’s activity isn’t uniform. The variables that determine yours:
Internet exposure of VPN, email gateway, and management interfaces. Patch cadence measured in days, not monthly cycles, for KEV-listed edge devices. Visibility into PHP and other runtimes embedded in containers, appliances, and hosted platforms. Credential exposure from appliances that store or proxy Active Directory secrets. And the hardening and monitoring of vCenter, ESXi, and backup infrastructure.
What we’re watching in November
Expect continued zero-day pressure on VPN and email security appliances, and fast follow-on exploitation of any public proof of concept against widely deployed web platforms. Our OSOC is tracking additional Ivanti Connect Secure and Fortinet zero-days and their post-exploitation tooling, exposure to the GitLab, PHP2Shell, and Adobe Commerce flaws within client environments, and further adoption of edge-device exploits and virtualization-layer tradecraft by Qilin and INC.
The Takeaway
October’s exploitation windows were measured in hours. PHP2Shell details leaked before the patch existed. GitLab exploit chains were weaponized almost immediately after a public PoC. And ransomware operators turned a months-old VPN flaw into hypervisor-level compromises that never touched an endpoint agent.
A monthly patch cycle can’t keep pace with that. Knowing what’s exposed, and whether your compensating controls actually hold in the gap between disclosure and patch, is what closes the window. Evolve Security’s Continuous Penetration Testing (CPT) provides that ongoing validation between patch cycles, not just a snapshot from the last audit.
Questions or Need Help Remediating?
Our team is here for yours. If any of the above touches your environment, reach out to talk with Evolve Security, we’ll help you validate the exposure and prioritize what to fix first.
Start Playing Offense. Contact Evolve Security’s Offensive Security Operations Center to talk through this month’s findings.
