Front Page

Zero-Day

The Gatekeeper With No Gate: A CVSS 10.0 Cisco ISE Flaw Under Active Attack Turns the Identity Layer Into the Soft Target

Cisco disclosed a critical zero-day in Identity Services Engine, tracked as CVE-2026-76460 and rated CVSS 10.0, already under active exploitation. The flaw stems from insufficient authentication control on an API endpoint, allowing a remote attacker with no credentials to bypass authentication entirely. ISE is not an ordinary application: it is the policy engine that decides which devices and users are allowed onto a network, what they may reach once admitted, and which posture checks they must satisfy — a single appliance whose judgment every downstream segment inherits.

That position is what makes this more than another appliance bug. An attacker who reaches administrative control of the identity layer does not need to defeat the controls behind it; they can simply be granted permission to walk past them, and the resulting access looks entirely legitimate in every log that records it. Forensic priority: patch on the emergency track rather than the maintenance cycle, and treat authorization decisions themselves as evidence — export ISE policy and authorization logs for the full exposure window and reconcile every network admission against an independent source such as switch port and DHCP records. Any endpoint admitted by a policy that cannot be traced to a legitimate administrative change should be treated as attacker-placed, and administrator accounts, certificates, and RADIUS shared secrets should be rotated on the assumption that the appliance's own account store was readable.

Supply Chain

The Recommendation Was the Payload: An Attacker Rides a Live AI Coding-Assistant Session Into 100 Internal Repositories

Mandiant documented an intrusion at an unnamed SaaS provider in which an attacker took over a developer's active AI coding-assistant session and used the developer's own authenticated context as the attack path. The assistant recommended a third-party package the attacker had already poisoned; the developer accepted the suggestion, and the poisoned dependency delivered an infostealer. With GitHub OAuth tokens harvested from that foothold, the attacker deployed a self-spreading worm — the same Shai-Hulud family seen in earlier registry campaigns — across roughly 100 internal repositories, taking repository secrets and product source code with it. The public case study does not say how the session was taken over or when the intrusion occurred.

The forensic lesson is about where trust actually sits. A developer reviews a dependency suggestion the way they review a colleague's recommendation, not the way they review an email attachment, and an assistant operating inside an authenticated session inherits every permission that session holds. Forensic priority: check AI-recommended third-party dependencies against cryptographic checksums and an approved allowlist before they are accepted, keep raw API keys and long-lived OAuth tokens out of direct reach of editor extensions and assistants, and route dependency traffic through a controlled internal repository so that what a developer installs is auditable after the fact. During an investigation, treat assistant session logs and dependency-resolution records as first-order evidence — they may be the only place the initial decision is recorded.

Threat Bulletin

ACTIVE EXPLOIT
CVE-2026-94127

F5 BIG-IP APM — a heap-based buffer overflow in the Access Policy Manager, the component that brokers remote access and SSO for the environments behind it. Added to CISA KEV on September 22. Forensic Note: Patch to a fixed BIG-IP release and review APM access and session logs for malformed requests or unexplained crashes and restarts, which often precede successful memory-corruption exploitation; treat any APM-brokered session established during the exposure window as requiring re-authentication.

ACTIVE EXPLOIT
CVE-2026-85102 / CVE-2026-93616

Check Point — an improper certificate-validation flaw alongside a path-traversal flaw across multiple products, both added to CISA KEV on September 22. Weak certificate validation undermines the assumption that an authenticated peer is who it claims to be. Forensic Note: Apply vendor fixes, audit gateway logs for connections accepted with unexpected or mismatched certificates, and review file access outside expected directories as the primary path-traversal indicator.

Malware Spotlight

KREMLIN — The Banking Toolkit That Lives in the Browser, Not the Binary

Researchers this week detailed KREMLIN, a previously undocumented Brazilian banking malware ecosystem active since May 2025. It chains multi-stage JavaScript loaders with custom C++ installers whose real purpose is to plant malicious Chrome and Edge extensions, which then harvest credentials and session tokens from inside the browser itself. Because the theft happens in an already-authenticated browser context, stolen session tokens can carry an attacker past multi-factor authentication without ever touching a password prompt. Forensic Note: Inventory installed browser extensions against an approved list and review extension install timestamps against the suspected infection window, hunt for unexpected extension-loading policies written to the registry, and treat every active banking or SSO session on an affected profile as compromised rather than merely exposed.