Cyber Roundup: Week of October 5

Here are the main stories you missed last week.

1. CISA: Flax Typhoon exploits five old CVEs as federal agencies face an October 11 deadline

The headline: On October 8, 2026, CISA added five vulnerabilities to the Known Exploited Vulnerabilities catalog following confirmed abuse by Flax Typhoon, a China-linked threat actor known for prepositioning inside critical infrastructure networks. The five CVEs were CVE-2016-3081 in Apache Struts, CVE-2015-5477 in ISC BIND, CVE-2015-3306 in ProFTPD, CVE-2021-3199 in ONLYOFFICE Docs Server, and CVE-2023-22894 in Strapi. Federal civilian agencies were required to patch or discontinue use of affected software by October 11, 2026. CISA Acting Executive Assistant Director for Cybersecurity Chris Butera attributed the activity to Chinese government-affiliated actors positioning themselves inside critical infrastructure for disruption at a time of their choosing.

What we’re actually watching: The oldest flaw in the batch is from 2015. Four of the five CVEs are at least four years old. Flax Typhoon is operating against the infrastructure organizations assumed had been decommissioned or patched years ago, and finding it still exposed on the public internet.

The actors do not need novel exploits because the attack surface they target is populated by unmanaged, unmonitored, and often forgotten systems. Apache Struts installations from 2016 are still reachable. ProFTPD servers from a decade ago are still running on the open internet. The three-day federal deadline reflects how quickly CISA believes exploitation of these systems can convert into persistent access across adjacent infrastructure.

The CISO question: Does your asset inventory include the systems your organization believes were retired three years ago, or does it only cover the systems your teams currently manage, and when did you last verify the difference between the two?

---

2. AnyDesk: AnyPwn pre-authentication exploit gives remote attackers root on Linux installations

The headline: On October 8, 2026, researchers published a working proof-of-concept called AnyPwn for a critical vulnerability in AnyDesk’s Linux implementation. The exploit targets a heap buffer overflow in AnyDesk’s session protocol and allows a remote attacker to execute commands as root without authentication or user approval. The exploit code landed on GitHub on October 8, with the latest affected release being AnyDesk 8.1.0 and prior Linux builds. AnyDesk has not publicly confirmed exploitation in the wild as of this writing, but public PoC release historically compresses the time to active exploitation to hours.

What we’re actually watching: AnyDesk is a remote-support tool used by IT departments, managed service providers, and support contractors to reach endpoints inside organizations. A pre-authentication root exploit against the Linux version produces full administrative access on every reachable Linux endpoint running the vulnerable client.

AnyDesk’s reach inside enterprise environments is non-trivial. The tool often sits on servers, developer workstations, and support team machines where it is treated as background infrastructure rather than a managed security control. Organizations that deployed AnyDesk through decentralized IT support may not know where the Linux client is actually installed. The public PoC on GitHub has already been forked and modified, so remediation is now a race against commodity-attacker tooling rather than targeted research.

The CISO question: If AnyDesk is running on any Linux endpoint inside your organization, do you know where every instance is installed, which version it is running, and whether your detection coverage treats remote-access tools as potentially adversarial rather than only as support infrastructure?

3. AhsayCBS: Two unpatched flaws in enterprise backup platform exploited in the wild

The headline: On October 9, 2026, security researchers disclosed two vulnerabilities in AhsayCBS, the backup and replication platform used by hundreds of managed service providers and enterprise IT teams across Europe and Asia. CVE-2026-105133 is an improper authentication vulnerability in the checkSysPwd() function of ApiStructsAction.java, rated CVSS v4 5.5. CVE-2026-105134 is an operating system command injection flaw in the Replication Receiver component, rated CVSS v4 9.3. CVE identifiers were not formally published until October 4, 2026. Both flaws are confirmed under exploitation.

What we’re actually watching: Enterprise backup platforms are the systems that ransomware operators specifically target before deploying encryption, because a compromised backup system removes the recovery path and increases ransom-payment probability. AhsayCBS sits in exactly that position inside the organizations that rely on it.

The two flaws form a usable chain. The authentication bypass gives an attacker remote access to the AhsayCBS management interface without credentials, and the command injection in the Replication Receiver then provides remote code execution as the service account running the platform. In most deployments, that account has read-write access to every backup repository the platform manages, which means an attacker reaching stage two can alter, delete, or exfiltrate the backup data that would otherwise support recovery. AhsayCBS has issued patches for both vulnerabilities, but the window between CVE assignment on October 4 and public disclosure on October 9 is five days during which exploitation was already underway.

The CISO question: If your AhsayCBS or similar backup platform was compromised, what credential rotation and integrity-verification steps would your incident response plan execute, and have those steps been exercised against a real recovery scenario this year?

4. Citrix: NetScaler ADC and Gateway CVE-2026-107406 draws urgent patch advisory

The headline: On October 9, 2026, Citrix issued an urgent advisory for CVE-2026-107406, a critical vulnerability in NetScaler ADC and Gateway that can lead to remote code execution or denial of service depending on configuration. The company urged immediate patching. CVE-2026-107406 is separate from the CVE-2026-88771 and CVE-2026-88772 zero-days Citrix patched in late September, bringing the number of critical NetScaler advisories in a six-week window to four.

What we’re actually watching: Four critical NetScaler disclosures in six weeks is the pattern worth naming. Citrix has not stated whether CVE-2026-107406 is under active exploitation, but the “immediate patching” language in the advisory is unusual for a non-KEV disclosure. The gap between vendor advisory and KEV listing has shrunk to days across most of 2026, and the historical pattern for NetScaler specifically is that confirmed exploitation lands within one week of advisory publication.

NetScaler sits at the perimeter for a very large enterprise population, functioning as both a load balancer and a VPN gateway. Compromise at that layer produces both credential theft and direct network access, which is why the product has been continuously targeted since Citrix Bleed in 2023. The current cluster of advisories suggests either coordinated attacker research against the product family or a code quality issue surfacing multiple adjacent flaws.

The CISO question: Given four critical NetScaler advisories in six weeks, what internal threshold would your organization need to cross before reviewing whether the current patching cadence can keep pace with the vendor’s disclosure cadence, and who owns that decision?

5. ReliaQuest: Settra joins Qilin in exploiting Palo Alto GlobalProtect for ransomware access

The headline: On October 11, 2026, ReliaQuest’s threat intelligence team confirmed that the Settra ransomware operation has joined Qilin in actively exploiting CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks GlobalProtect VPN and Prisma Access. The vulnerability was published in May 2026 and added to CISA KEV on May 29. ReliaQuest observed Cobalt Strike, BloodHound, and SharpHound in related intrusions, and called out GlobalProtect sessions linked to hostnames including “kali” as investigation leads.

What we’re actually watching: The confirmed expansion from Qilin to Settra signals that CVE-2026-0257 has graduated from a single-actor exploit into shared ransomware tradecraft. Patches have been available since May. What is new is the breadth of the actor population now using it.

ReliaQuest noted that “patching alone may not remove access established before remediation.” For every organization that patched CVE-2026-0257 between May and October, unauthorized VPN sessions may have been established during the vulnerable window and persisted after the patch. Those sessions are the artifact ransomware operators are now operationalizing. ReliaQuest assesses continued exploitation of CVE-2026-0257 is highly likely over the next three months as ransomware groups and initial access brokers pursue unpatched systems and residual sessions from patched ones.

The CISO question: If your organization patched CVE-2026-0257 earlier this year, did your incident response team also hunt for unauthorized GlobalProtect sessions established during the vulnerable window, or did you treat patching as the end of the remediation rather than the beginning?

The pattern across all five stories

Every attack this week moved through the operations layer, not the application layer. Flax Typhoon exploited legacy infrastructure still exposed on the public internet. AnyDesk is what IT support uses to reach every endpoint. AhsayCBS holds the last-resort recovery data. NetScaler stands between external users and internal applications. GlobalProtect defines whether a session is trusted at all.

The attackers chose the systems your IT team uses to reach every other system. CybelAngel surfaces the exposed management planes and leaked credentials that turn an operations-layer compromise into a cross-environment incident.