TL;DR
Critical Linux kernel vulnerability (CVE-2026-99999) allows guest VMs to read host memory; Nextcloud servers actively backdoored via Collabora RCE; ShinyHunters leadership arrested as group escalates attacks on stolen FBI data.
Executive Summary
- A critical Linux kernel flaw (PwnEscape, CVE-2026-99999) enables virtual machines to read host memory, confirmed exploited against Vercel cloud sandboxes.
- Threat actors actively exploit CVE-2026-110447, a remote code execution flaw in Collabora Online for Nextcloud, to deploy backdoors on production servers.
- Law enforcement has arrested multiple members of the ShinyHunters extortion group, including a Jordanian teenager and a Netherlands-based accomplice, though remaining members have escalated attacks following arrests.
- Microsoft released patches for over 1,400 security vulnerabilities, with multiple entries added to CISA's Known Exploited Vulnerabilities (KEV) catalog requiring federal remediation by October 17.
- Candiru spyware infected Al Jazeera devices through zero-click online ads requiring no user interaction, demonstrating new infection vectors for government-grade surveillance tools.
Top Threats Today
1. PwnEscape: Critical Linux Kernel Memory Disclosure in Virtual Machines
Severity: CRITICAL Affected: Technology
A newly disclosed critical vulnerability in the Linux kernel, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows code running inside a virtual machine to read memory on the host computer [1]. A researcher has demonstrated the flaw against Vercel's live cloud sandboxes, and Vercel has confirmed the vulnerability ⚠[1]. This attack breaks the isolation boundary between guest and host systems, enabling unauthorized disclosure of sensitive data including encryption keys, credentials, ⚠ and other confidential information processed on the underlying infrastructure.
Sources:[1] The Hacker News
Recommended Action
- Immediately assess inventory of virtual machine deployments and prioritize patching host systems running vulnerable kernel versions
- Monitor for signs of unauthorized process memory reads or cross-VM communication attempts in hypervisor logs
- Contact cloud infrastructure providers to confirm patching status and request evidence of remediation
- Review logs for any evidence of prior exploitation, focusing on high-value VM workloads (key management, credential storage, payment processing)
2. Nextcloud Backdoors via Exploited Collabora Online RCE
Severity: CRITICAL Affected: Technology
Threat actors are actively exploiting CVE-2026-110447, a critical remote code execution flaw in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud, to backdoor production servers [1]. Active in-the-wild exploitation has been confirmed, with adversaries achieving command execution capabilities that allow persistent access and lateral movement within Nextcloud deployments.
Sources:[1] BleepingComputer
Recommended Action
- Immediately update Collabora Online richdocumentscode to a patched version if deployed in your Nextcloud environment
- If patching is not immediately possible, disable the Collabora Online app until remediation is completed
- Search server logs and web server access logs for exploitation indicators targeting richdocumentscode endpoints
- Assume any vulnerable Nextcloud instance may be compromised; conduct forensic review of file modifications, user access logs, and API activity
3. ShinyHunters Leadership Arrested; Remaining Members Escalate FBI Data Extortion
Severity: CRITICAL Affected: Government
The Federal Bureau of Investigation arrested the co-founder of a Canadian cybersecurity firm in connection with the ShinyHunters hacking group, which recently exfiltrated sensitive data on thousands of FBI agents [1]. A teenager from Amman, Jordan suspected of leading ShinyHunters under the hacker handle “Rey” has been detained and is reportedly cooperating with the FBI to identify other group members [2]. A 23-year-old convicted cybercriminal was arrested in the Netherlands on suspicion of aiding ShinyHunters data thefts and extortions [3]. In the days following the Dutch arrest, remaining ShinyHunters members dramatically escalated their attacks and extortion activities [3], demonstrating the group's resilience and continued operational capability despite law enforcement action.
Sources:[1] Krebs on Security[2] Krebs on Security[3] Krebs on Security
Recommended Action
- If your organization has been contacted by ShinyHunters or has reason to believe data was stolen, escalate to law enforcement and FBI's IC3 (ic3.gov)
- Review ShinyHunters public leak sites and monitors for your organization or industry; establish alerts for new disclosures
- Strengthen credential management and MFA enforcement for all external-facing systems to prevent follow-on compromise
- Brief executive and board leadership on potential extortion attempts; establish a communications protocol should ransom demands arrive
4. CISA Adds Five Critical Vulnerabilities to Known Exploited Vulnerabilities (KEV) Catalog
Severity: HIGH Affected: Government
CISA has added five vulnerabilities to its Known Exploited Vulnerabilities catalog, requiring federal system remediation by October 17, 2026 [1][2][3][4][5]. The additions include: Ahsay AhsayCBS command injection (CVE-2026-105134) chainable with improper authentication (CVE-2026-105133) [1][3]; Cisco Secure Email Gateway relative path traversal (CVE-2026-76519) allowing arbitrary file writes [2]; and Palo Alto Networks PAN-OS code injection (CVE-2026-0322) executable with root privileges [4]. Each carries federal remediation deadline of October 17 ⚠, 2026 [1][2][3][4][5].
Sources:[1] CISA KEV[2] CISA KEV[3] CISA KEV[4] CISA KEV[5] CISA KEV
Recommended Action
- Verify your organization does not run Ahsay AhsayCBS, Cisco Secure Email Gateway, or Palo Alto PAN-OS; if deployed, prioritize patching before October 17 deadline
- Cross-reference asset inventory against CISA KEV catalog (cisa.gov/known-exploited-vulnerabilities-catalog) to identify affected systems
- If immediate patching is not possible, implement network segmentation and access controls to limit exposure of vulnerable systems
- Document remediation status and maintain evidence of patch deployment for compliance reporting
5. Candiru Spyware Infects Al Jazeera via Zero-Click Malicious Online Ads
Severity: HIGH Affected: Media
Researchers at Citizen Lab have traced zero-click Candiru spyware infections at the Al Jazeera news network to targeted online advertisements, requiring no user click or interaction for the hidden attack code to execute [1]. Candiru, an Israeli maker of government-sold spyware, has demonstrated a significant evolution in infection methodology by leveraging ad platforms for mass ⚠ distribution with zero user friction, establishing a new threat vector for surveillance targeting high-value organizations.
Sources:[1] The Hacker News
Recommended Action
- Review endpoint detection and response (EDR) logs for signs of Candiru spyware behavior, including process injection and system reconnaissance
- Implement or strengthen ad-blocking and content filtering policies on employee endpoints, particularly for high-risk personnel such as journalists, researchers, and executives
- Isolate and forensically analyze any devices used by targeted staff; assume compromise of credentials and sensitive documents
- Coordinate with law enforcement and relevant government agencies on disclosure and mitigation if any infections are confirmed
Ongoing Threats
Earlier reporting on Cisco vulnerabilities, Nextcloud backdoors, and phishing disruptions and Microsoft Patch Tuesday and Ivanti zero-day exploitation remains current. CISA has added Ivanti Connect Secure authentication bypass (CVE-2026-104935) to KEV with federal deadline of October 16, 2026 [35].
Today’s Action Checklist
- ☐ URGENT: Confirm your organization does not run vulnerable Collabora Online (richdocumentscode) in Nextcloud; if present, apply patches or disable immediately
- ☐ URGENT: Verify inventory against CISA KEV additions (Ahsay, Cisco Email Gateway, Palo Alto PAN-OS); document patching plans with October 17 deadline
- ☐ URGENT: Contact cloud infrastructure provider to confirm Linux kernel patching status for CVE-2026-99999 (PwnEscape)
- ☐ Review your organization's data exposure status with ShinyHunters via public leak sites and dark web monitors; escalate findings to CISO and legal
- ☐ Audit endpoint security policies for spyware indicators; review EDR alerts from the past 30 days for anomalous process behavior or memory access patterns
- ☐ Schedule team briefing on zero-click ad-based infection techniques and review user reporting channels for suspicious browser behavior