CISA flags active attacks on firewalls, email and backup systems
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Friday, October 16th, 2026.
Four newly prioritized flaws are already being used against security and backup infrastructure. The affected products include Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and AhsayCBS.
Under specific configurations, the Cisco issue can allow root-level command execution through a crafted email attachment. Attackers also chained two AhsayCBS flaws to plant web shells and cryptominers. Limited exploitation targeted the PAN-OS management interface as well.
These systems sit at trusted network boundaries or manage critical recovery data, making compromise especially consequential. Earlier AhsayCBS patches were incomplete, so some administrators who had already updated remained exposed.
Leaders should verify remediation rather than assume a completed patch ticket means the risk is closed. Defenders should prioritize affected assets, restrict management access, and hunt for compromise using records held outside the appliances. The larger lesson is that exploited infrastructure flaws demand validation, not checkbox patching.
Confirm fixed versions on every affected product and perform compromise checks using both local and external logs.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
