Thursday, October 15, 2026

Published 7:01 AM · 120 articles from 16 sources · about 5 min to read in full

The day in brief

Three network-edge products were hit by actively exploited zero-days at once. Palo Alto Networks patched PAN-OS CVE-2026-0322 (CVSS 8.6, remote code execution in the management interface), Cisco patched a Secure Email Gateway flaw that allows unauthenticated root command execution, and Ivanti patched a Connect Secure authentication bypass exploited since October 1. CISA added the PAN-OS and Cisco flaws to its KEV catalog and urged immediate Ivanti updates. Ivanti has promised a separate privilege-escalation fix later. Honeypots logged 105 Ivanti exploit attempts and 1,423 against Langflow, so scanning moves fast once a bug is public. AI is now part of the offensive toolchain: XBOW chained three Chrome zero-days into a full exploit in six days using a public OpenAI model, and Google has patched them. The attack surface is also widening to physical and software supply chains. Connected fridge controllers in France were driven to about 50C, GhostAction hit roughly 1,900 GitHub accounts, and Ledger is probing tampered devices. On the policy side, eight US states sued OpenAI over child safety, and 40 attorneys general are pressing the Character.AI bankruptcy court on user data. Law enforcement hit North Korean IT worker laptop farms and a phishing-kit marketplace.

Top stories

1
PAN-OS, Cisco email gateway and Ivanti zero-days all exploited
CISA added four exploited flaws to KEV, including CVE-2026-0322 in PAN-OS and CVE-2026-76519 in Cisco Secure Email Gateway. The Cisco bug allows unauthenticated remote root command execution, and the PAN-OS bug is a CVSS 8.6 RCE in the management interface. All three vendors' products sit at the network perimeter, so patch them first and take management interfaces off exposed networks. CISA Advisories
2
Ivanti Connect Secure bypass exploited since October 1
CISA urged immediate patching of CVE-2026-104935 (CVSS 8.6), an authentication bypass exploited as a zero-day. Honeypots logged 105 exploit attempts. Ivanti has promised a separate privilege-escalation fix later, so the patching work is not finished. The Hacker News
3
XBOW builds Chrome full-chain exploit in six days with public model
XBOW chained three Chrome zero-days into a drive-by exploit using OpenAI's GPT-5.6 Sol, and the work earned a $250,000 bounty. Google has patched the bugs. A commercially available model compressing exploit development to days shortens the window defenders have between disclosure and weaponization. The Hacker News
4
Fridge controller hack hits supermarkets, causing fires and millions in losses
Ars reports an attack on about 700 supermarkets that exploited outdated, internet-exposed devices. Schneier describes hackers taking over Danfoss refrigeration controllers in France and heating cold units to around 50C overnight. It is a concrete case of exposed operational technology causing physical damage. Ars Technica
5
Eight US states sue OpenAI over ChatGPT child safety
The states allege ChatGPT harms children and that OpenAI misled consumers about its safety, under state consumer protection laws. Separately, 40 bipartisan attorneys general have filed notice in Character.AI's Chapter 11 case demanding data protections in any asset sale. State enforcement is now a significant regulatory front for AI products aimed at consumers. The Verge

By topic

Themes today

Read the analysis →

Perimeter devices remain the attackers' favorite entry point
AI is shortening the path from bug to exploit
Agent ecosystems are repeating old supply-chain mistakes
Attacks and surveillance now have physical consequences
Regulators are moving faster than AI vendors