My Next Class

Today's episode covers the Panchan crypto mining worm spreading over SSH, plus three actively exploited zero-day vulnerabilities: a root-level remote code execution flaw in Cisco Secure Email Gateway, an authenticated root RCE in Palo Alto Networks' management interface, and a chained Ivanti Connect Secure exploit documented by Volexity.

Panchan's Mining Island [Guest Diary]
SANS.edu intern Zachary Norwood analyzes Panchan, a Golang crypto mining worm that spreads via SSH, steals SSH keys, installs a rootkit and uses Discord for command and control, using FakeNet-NG for dynamic analysis.
https://isc.sans.edu/diary/Panchan%27s%20Mining%20Island%20%5BGuest%20Diary%5D/33426

Cisco Secure Email Gateway 0-Day (CVE-2026-76519)
With the reputation feature enabled, the advanced malware protection feature lets attackers write arbitrary files and execute code as root. The flaw is already exploited and there is no workaround, so patch and review Cisco's indicators of compromise.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp

Palo Alto Networks 0-Day (CVE-2026-0322)
An already exploited, authenticated remote code execution vulnerability that runs code as root. Exploitation requires an exposed management interface.
https://security.paloaltonetworks.com/CVE-2026-0322

Ivanti Connect Secure 0-Day (CVE-2026-104935)
Volexity found three chained vulnerabilities: an authentication bypass, an arbitrary file write leading to remote code execution, and a privilege escalation. Ivanti patched the first two under one CVE; the privilege escalation appears unpatched.
https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

No Podcast on Monday, Oct. 19th.

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Login here to join the discussion.