Loki Intelligence — Security Briefs · Published
Daily Security Brief: Ivanti, PAN-OS and Cisco Email Gateway Exploitation
Today's picture is dominated by actively exploited flaws in network edge and email appliances, alongside server-side risks from document processing and an optional Nextcloud app. Teams should prioritize patching Ivanti, Palo Alto Networks and Cisco devices, then review file-handling components and exposed collaboration apps.
Signal 01 · The Hacker News
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
During an authorized assessment, an AI pentesting agent reportedly found a critical authentication bypass in which the login flow let the user influence where the sign-in code was delivered. The report says the harder part was proving the issue on a live website.
Why it matters: Verify server-side that one-time codes are only sent to destinations bound to the authenticated account, and treat any user-controlled delivery target in login flows as a review item.
Source: The Hacker News
Signal 02 · The Hacker News
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
CISA urged organizations to update Ivanti Connect Secure appliances to the latest version after disclosure of an actively exploited vulnerability. The headline notes honeypots logged 105 exploit attempts.
Why it matters: Remote access appliances are exposed by design, so apply the vendor update promptly and review the device for signs of compromise.
Source: The Hacker News
Signal 03 · BleepingComputer
Ghostscript flaw lets hackers hijack servers via PDF uploads
A critical heap buffer overflow in Ghostscript, tracked as CVE-2026-39919, could allow remote code execution through specially crafted PDF files.
Why it matters: Any service that processes uploaded PDFs with Ghostscript should be inventoried and updated, and document rendering should run in isolated, low-privilege environments.
Source: BleepingComputer
Signal 04 · BleepingComputer
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Palo Alto Networks released security updates for a high-severity PAN-OS remote code execution zero-day, CVE-2026-0322, which has been exploited in attacks against firewalls.
Why it matters: Prioritize applying the PAN-OS updates on firewalls and check device management exposure and logs for unexpected activity.
Source: BleepingComputer
Signal 05 · The Hacker News
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
Cisco said in an advisory that attackers are exploiting a critical flaw in Secure Email Gateway that lets an unauthenticated sender write files to the appliance's operating system via an email with a crafted attachment.
Why it matters: Email gateways process untrusted input from the internet, so apply Cisco's fixes quickly and review appliances for unexpected files or changes.
Source: The Hacker News
Signal 06 · GitHub Security
GitHub’s model for secret detection: Finding more secrets with less noise
GitHub described a context-aware secret classifier that it says improves detection quality, raises weighted acceptance by 11.5% and cuts median scan execution time by 86%.
Why it matters: Enable secret scanning and push protection in your repositories, and rotate any exposed credential immediately regardless of detection tooling.
Source: GitHub Security
Signal 07 · The Hacker News
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers exploited a flaw in the optional Nextcloud app Collabora Online - Built-in CODE Server to plant web shells on servers. Three administrators reported it on GitHub, with the first logged attack on September 10.
Why it matters: Audit optional apps on self-hosted collaboration platforms, remove those you do not need, update the rest, and check web directories for unexpected files.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.