Threat Field Notes17 Oct 2026
Critical patch
BlockStrap: Check the Magento Patch, Not Just the Release Number
Defender takeaway
Apply the October fix, verify it landed in deployed code, and keep the separate September StyleSmuggler hotfix in place.
Independent cyber intelligence
Context. Clarity.Stronger defenses.
Curated threat intelligence, practitioner insights, field notes, and the ideas that help defenders stay ahead of attackers.
Signal over noise. Curated by a practitioner. Updated regularly
Threat landscape
Global activity, distilled for defenders
Threat radar
What defenders should know today
Known exploited
CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
CISA KEVOct 16, 2026
Open briefing Known exploited
CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
CISA KEVOct 16, 2026
Open briefing Known exploited
CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an…
CISA KEVOct 15, 2026
Open briefing Known exploited
CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
CISA KEVOct 14, 2026
Open briefing Cybersecurity news
Latest analysis and reporting
Read analysis
Threat Field Notes15 Oct 2026
Active exploitation
Ivanti Connect Secure: The VPN Was Only the First Stop
Defender takeaway
Patch affected appliances, then investigate the pre-patch window and the credentials the VPN could reach. A clean integrity check alone may miss this activity.
Threat Field Notes15 Oct 2026
Active exploitation
Cisco Secure Email Gateway: Check the Scanner Behind the Mail Policy
Defender takeaway
Check File Reputation and scanner versions, patch affected appliances, and use independent logs to investigate possible compromise.
Threat Field Notes15 Oct 2026
Vendor advisory
PAN-OS: The Management Door Matters as Much as the Patch
Defender takeaway
Check who can reach management, review privileged access, and use the vendor’s branch-specific fixed-build table.
Threat Field Notes13 Oct 2026
Patch intelligence
SAP Cloud SDK for Python: Check the Tenant Boundary Before Tokens Travel
Defender takeaway
Find deployments using sap-cloud-sdk before 0.45.2, update them, validate tenant subdomains, and review credential exposure where untrusted input could reach the SDK.
Threat Field Notes13 Oct 2026
Critical patch
GitLab’s Emergency Patch: An Unauthenticated Route to Server Code Execution
Defender takeaway
Identify self-managed CE/EE instances on affected 19.2, 19.3 and 19.4 builds; update to a fixed patch release and review relevant CI/CD changes.
Threat Field NotesUpdated Oct 15, 2026
Active exploitation
AhsayCBS: The Hotfix Is Here, but a Compromised Server Needs More
Defender takeaway
Verify hotfix 10.3.4.45 or 9.15.2.70, investigate the earlier exposure window, and rebuild a compromised server from a trusted state.
SecurityWeekOct 18, 2026
AI & security
US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars
Why it matters
Separate demonstrated capability from speculation and examine both defensive value and abuse potential. Useful follow-up questions include data exposure, access controls, model provenance, monitoring, and human review.
SecurityWeekOct 17, 2026
Threat activity
Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
Why it matters
For defenders, the value is in translating the report into an environment-specific question: where could this behavior appear, which controls should interrupt it, and what evidence would confirm or disprove exposure?
Cybersecurity DiveOct 16, 2026
Vulnerabilities
China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign
Why it matters
Defenders should first confirm whether the affected technology exists in their environment, then prioritize exposed and high-value systems. Treat reported exploitation as a prompt to review telemetry and vendor guidance—not only as a patching reminder.
Voices from the field
Insights from podcasts and practitioners
SANS Stormcast · Johannes B. Ullrich
PNG payloads, npm malware, and Pi-hole
Three stories from the 22 September episode, with the main risk in each and a defender check to make next.
Episode field noteRead analysis
Blue team notes
Latest practical guides for defenders
Detection engineering · Windows
Windows Security Events That Deserve Your Attention
A practical way to turn Windows account, group, logon, and lockout events into useful monitoring without drowning the SOC in noise.
Read guide View all notesFrom my reading
Latest notes and useful references
Anthropic · Threat research
One Stolen Credential, Many Doors
A reading note on the AI-assisted credential-harvesting lifecycle in Anthropic’s September 2026 threat report.
Read note View bookshelfAttack library
Scattered Spider
A financially motivated threat group known for high-pressure social engineering, identity compromise, SIM swapping, and cloud-focused intrusion.
Initial accessIdentitySocial engineeringCloud
Aug 30Targeted airline helpdesk with fake Okta login page
Aug 27Breached retail chain through SIM swapping
Aug 24New phishing toolkit observed in the wild
Latest intel feed
Curated from trusted sources
CISA KEVCVE-2025-61624: Fortinet Multiple Products Path Traversal VulnerabilityOct 16, 2026CISA KEVCVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityOct 16, 2026CISA KEVCVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityOct 15, 2026CISA KEVCVE-2026-0322: Palo Alto Networks PAN-OS Code Injection VulnerabilityOct 14, 2026CISA KEVCVE-2026-105133: Ahsay AhsayCBS Improper Authentication VulnerabilityOct 14, 2026
People worth following
Researchers, presenters, and defenders
WD
Will Dormann
Vulnerability research
A longtime software-vulnerability analyst known for practical testing, careful disclosure analysis, and explaining real exploitation conditions.
Read profileFR
Florian Roth
Detection engineering
A threat researcher and detection engineer associated with Sigma, THOR, YARA-based scanning, and widely used open-source defensive tooling.
Read profileJR
Johanna Rothman
Technical leadership
An author and consultant who writes about product development, management, organizational systems, risk, and decision-making under uncertainty.
Read profileAC
Alex Campbell
Critical infrastructure
A cybersecurity adviser whose work focuses on digital trust, resilience, and cyber risk in energy and critical-infrastructure organizations.
Read profileAbout Threat Field Notes
Built by a defender, for defenders.
I’m Sukarn. This is my space to share what I learn, what I find interesting, and the field notes that help turn threat information into useful defensive action.