Defender DailyThe daily security brief for enterprise defenders
Daily Brief
Cisco Adaptive Security Appliance and Firepower Threat Defense
Cisco learned of attacks in October, and only firewalls whose remote access VPN uses secondary authentication are exposed.
Regular expression flaw letting an unauthenticated attacker run code on servers
Fix19.4.2, 19.3.5 or 19.2.8, plus a fixed Ruby when not using GitLab’s packagesFurther readingAlpine Linux notice, further reading on GitLab Community Edition, Enterprise Edition GitLab advisory, further reading on GitLab Community Edition, Enterprise Edition Ruby advisory, further reading on GitLab Community Edition, Enterprise Edition
Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.29
Veeam Management Pack for Microsoft System Center
It sits in the Virtualization Extensions service of version 9.1 and earlier, and Veeam fixed it only in 13.1 and hasn’t reported attacks.
From Oct 17, the group’s ARTEX agents went after more than 200 organizations in at least 14 countries, and CrowdStrike confirmed follow-on activity at nine of them.
Cisco Talos
Phishing began just over a third of Talos’s incident response cases in the third quarter, and ransomware and pre-ransomware cases rose to 27 percent.
Read: Cisco Talos on attackers posing as IT help desks to get remote accessMicrosoft
Microsoft says Jade Sleet, Coral Sleet and Jasper Sleet use AI across all their operations, which still aren’t fully autonomous.
Read: Microsoft on how North Korean hacking groups use AI to scale their attacksWiz
Wiz says agent-run intrusions tend to be noisy and can try several approaches at once, and lists the fingerprints from three cases it investigated.
Read: Wiz on telling AI agent intrusions apart from legitimate automation