> InfoSec News Nuggets – 10/15/2026

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability Attackers are actively exploiting CVE-2026-76519 (CVSS 9.8), a critical flaw in Cisco Secure Email Gateway that lets an unauthenticated sender write files to the appliance’s operating system through a crafted email attachment and potentially run commands as root. Only gateways with the File Reputation service enabled and a Content Scanner Tools package older than version 25.3.0.5525 are vulnerable. Fixes are available through a scanner update or AsyncOS 15.5.5-014 and 16.5.0-780, there is no workaround, and Cisco is urging admins to run its “System Security” log check for signs of compromise. This is the second exploited Secure Email Gateway flaw Cisco has confirmed in a month.   Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days Microsoft’s October 2026 Patch Tuesday addresses a record-breaking 1,411 vulnerabilities, 70 of them rated Critical, including one actively exploited and two publicly disclosed zero-days. The exploited flaw, CVE-2026-96951, is a Windows Shell security feature bypass that lets attackers get around Mark of the Web protections, while the publicly disclosed bugs include a .NET Framework flaw (CVE-2026-108398) that can be used to bypass Windows Defender Application Control. The release also marks the final update for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016, with the surge in volume tied to Microsoft’s growing use of AI to find and fix vulnerabilities.   Hackers turn up supermarket fridges to 50°C, threatening millions in food losses Hundreds of French supermarkets, including roughly 300 Intermarché and Netto stores and nearly 100 Coopérative U outlets, were hit overnight by an attack on internet-connected Danfoss refrigeration control systems that forced defrost cycles to run nonstop, pushing some units as high as 50°C. Two stores in Alsace reportedly lost €270,000 in stock, and nationwide damage could reach several million euros. The Paris prosecutor’s office has opened an investigation and ANSSI is coordinating with European counterparts, while a patch for three affected Danfoss controllers has been available since September following vulnerabilities disclosed by Claroty researchers in August.   CikaBika Bot RAT Uses Discord for C&C Darktrace has uncovered a phishing campaign delivering CikaBika Bot, a Rust-based remote access trojan that relies on Discord for command-and-control. Victims receive a PDF containing a disk image with a Windows shortcut disguised as a Word document, which displays a decoy while a hidden PowerShell process launches a Nim-based loader that attempts DLL sideloading via the Edge directory to bypass User Account Control. Once running, the RAT registers the machine with Discord and gives operators reconnaissance, command execution, screenshot, camera surveillance, and file theft capabilities, with stolen data exfiltrated through Ngrok.   Ransomware gets personal: ‘We-know-where-you-are kind of stuff’ A global survey of 1,200 organizations hit by ransomware found that 37% of attacks involved psychological or physical threats against staff, ranging from doxxing and swatting to threats against employees’ families. More than half of respondents said attackers followed through on threats in the past year, with reported incidents including threatening packages, physical intrusion, and even abduction. A Semperis incident responder recounted receiving an anonymous package of regional gifts while investigating Midnight Blizzard and urged victims to involve law enforcement early and never pay, noting that 69% of surveyed victims were targeted multiple times within a year. The post InfoSec News Nuggets – 10/15/2026 appeared first on AboutDFIR - The Definitive Compendium Project.