Defender Daily · The daily security brief for enterprise defenders

Added to KEV

No additions

No additions to the catalog in this edition’s window.

Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.16

Vulnerabilities and patches

3 items

Citrix NetScaler ADC and NetScaler Gateway

Exploited
In KEV

Item 1

Citrix NetScaler flaws chained to gain root and plant web shells, Rapid7 says

Neither flaw needs credentials, and builds 14.1-73.41 and 13.1-64.28 fix both, but Rapid7 says patching alone isn’t enough for appliances exposed to the attacks.

Rapid7, source for item 1 Citrix security bulletin CTX697096, source for item 1 Citrix security bulletin CTX697174, source for item 1 CISA KEV catalog, CVE-2026-88771, source for item 1 CISA KEV catalog, CVE-2026-88779, source for item 1

Palo Alto Networks PAN-OS and Prisma Access

Exploited
In KEV

Item 2

PAN-OS flaw used by Qilin and Inc ransomware groups, Unit 42 says

The flaw lets an unauthenticated attacker open a VPN session on some firewalls that use GlobalProtect authentication override cookies, and Palo Alto Networks has released fixes.

Unit 42, source for item 2 Palo Alto Networks security advisory, source for item 2 CISA KEV catalog, source for item 2

Pillow

Public exploit

Item 3

Pillow image library flaw that may allow code execution has a public exploit

Apps that save an attacker’s crafted image as compressed TIFF to an in-memory file such as BytesIO are exposed from 2.0.0 until 13.0.0, which fixes it.

CVE record, source for item 3 Pillow release notes, source for item 3

Breaches and campaigns

2 items

Item 4

Attackers use Cairn AI agents to break into online shops, NorForge says

NorForge counted more than 1,100 attack projects on 14 exposed Cairn panels likely tied to a cluster it calls AIA0001, mostly against organizations in the US, Japan and Australia.

NorForge, source for item 4

OVHcloud CLI

Attacks confirmed

Item 5

OVHcloud CLI downloads swapped for a build that steals secrets from disk

An attacker used a developer’s GitHub account to replace files in five releases, and the malicious files were available from 8:47 to 10:21 a.m. ET on Oct 19.

OpenSourceMalware, source for item 5 Octave Klaba on X, source for item 5 The Stack, source for item 5

Worth reading

2 items

National Cyber Security Centre

Item 6

National Cyber Security Centre on post-quantum settings for TLS

Its guidance recommends TLS 1.3 profiles that pair post-quantum and traditional key exchange, and asks TLS 1.2 users to plan a move to 1.3.

Read

Wiz

Item 7

Wiz on spotting attacks run end to end by AI agents in the cloud

Its incident responders say AI-run intrusions add numeric task identifiers, comment their code step by step and name resources with words like “pentest” and “probe.”