by sig9
Hacker Wars - October 29, 2026
Your daily dose of infosec chaos
Your network perimeter is having a genuinely bad week: Cisco shipped a fix for yet another firewall VPN zero-day that is already being exploited, Palo Alto management interfaces are getting hit by PHP2Shell in the wild, and a China-linked group quietly used an ESXi logging bug nobody took seriously to hide inside virtualization hosts. Add custom malware hoarding SD-WAN encryption keys and a shady AI relay selling coding agents with the safety features switched off, and you have the makings of a long change-control meeting.
Second Cisco Firewall VPN Zero-Day Exploited In The Wild
Cisco dropped fixes for CVE-2026-76418, an 8.6-severity flaw in the Remote Access SSL VPN service of Secure Firewall ASA and FTD, and attackers are already riding it. That is the second VPN zero-day on these firewalls since August, which at this point looks less like bad luck and more like a subscription service.
What to do: Patch ASA and FTD to the fixed releases now, and treat every internet-exposed SSL VPN as an incident-in-waiting until you do.
PHP2Shell Is Actively Exploiting Exposed Palo Alto Management Interfaces
Palo Alto Networks is warning that the recently patched PHP2Shell flaws are being actively exploited against management interfaces left reachable from the internet. If your firewall admin panel answers to the whole internet, it is a fair bet someone else has already been browsing the menus.
What to do: Patch to the fixed PAN-OS releases immediately and lock management interfaces behind a jump host or management VLAN - they should never face the public internet.
Warp Panda Turned A Low-Key ESXi Logging Flaw Into A Stealth Zero-Day
A China-nexus group tracked as Warp Panda exploited CVE-2026-41709 - a VMware ESXi logging flaw rated low severity because it merely lets privileged users act without being logged - as a zero-day to blur its tracks on virtualization hosts. CISA has since added it to the known-exploited catalog, a nice reminder that “low severity” and “useless to attackers” are very different things.
What to do: Apply the ESXi updates and make sure audit logging cannot be disabled by the very accounts it is meant to watch - ship logs to a separate, append-only collector.
KeyDrift Malware Steals SD-WAN Encryption Keys For A Rainy Day
Attackers exploited a Cisco Catalyst SD-WAN flaw patched back in February to plant KeyDrift, custom malware that copies the keys encrypting traffic between sites and quietly stores them. Stolen keys mean traffic captured today can be decrypted tomorrow, long after the implant is gone and everyone has moved on.
What to do: Patch SD-WAN controllers past the February release, hunt for the implant in your management plane, and rotate inter-site keys after any suspected exposure.
Shady AI Relay Resells Coding Agents With The Sandboxes Switched Off
A mysterious relay service is reselling OpenAI Codex and Claude Code access to regions where those tools are not officially sold - with sandboxing and other key safety features turned off. It is convenient for users and extremely convenient for anyone running prompt-injection payloads against fully-powered coding agents.
What to do: Block unofficial AI relays at the network egress, and make sure corporate coding-agent use runs on sanctioned accounts with sandboxing intact.
Until next time, may your logs be clean and your alerts be false positives.
Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown
This bulletin is provided for informational purposes. Contact us for tailored security analysis.