Cisco’s network access control platform - the system that decides who gets on the network - is the initial access vector today. A CVSS 10.0 zero-day in Cisco Identity Services Engine (ISE) is under active exploitation, patches shipped this morning, and every ISE shop should be treating this as an emergency. Alongside that, the FBI dismantled a major DDoS-for-hire platform, and federal agents physically boarded an oil tanker after a cyber intrusion - a rare convergence of cyber and physical response.

In the News

Cisco ISE Zero-Day Exploited in the Wild - CVSS 10.0, Patch Available

A maximum-severity remote code execution vulnerability in Cisco Identity Services Engine is under active exploitation. The flaw allows unauthenticated attackers to bypass authentication entirely via crafted requests and gain full control of the ISE node. No credentials are required. The attack surface is the ISE web interface itself.

This is not a theoretical risk. Active exploitation is confirmed, and Cisco shipped patches today. The irony is significant: ISE is the platform organizations rely on for 802.1X authentication, RADIUS, TACACS+, and posture assessment - it is the gatekeeper. When the gatekeeper is compromised, every access decision it has made becomes suspect.

Organizations running ISE should patch immediately. If patching requires a maintenance window, isolate the ISE management interface from untrusted networks as an interim measure. Post-patch, review ISE admin accounts for unauthorized additions and audit RADIUS/TACACS+ policy changes made during the exposure window.

What defenders should do: Patch ISE today. Restrict management interface access to trusted admin VLANs. Audit ISE admin accounts and policy change logs for the period between vulnerability disclosure and patch application.

Source: BleepingComputer

FBI Seizes NightmareStresser DDoS-for-Hire Platform

The FBI seized NightmareStresser, one of the longest-running DDoS-for-hire services, linked to thousands of distributed denial-of-service attacks. The platform lowered the barrier to volumetric attacks to the cost of a fast-food meal - anyone with a few dollars and a target IP could launch disruptive floods.

The seizure is part of an ongoing federal campaign against booter and stresser services. While the takedown removes one major node, the DDoS-for-hire ecosystem regenerates quickly. New platforms typically emerge within weeks, often operated by individuals who learned the model from the seized service.

What defenders should do: Use this as a reminder to validate DDoS mitigation controls. Upstream scrubbing, rate limiting at the edge, and SSE-based DDoS absorption remain the durable defenses - they work regardless of which stresser platform is operational this month.

Source: BleepingComputer

Coast Guard and FBI Board Oil Tanker After Cyber Intrusion in Gulf of Mexico

U.S. Coast Guard and FBI personnel physically boarded an oil tanker in the Gulf of Mexico after detecting intrusion by what officials described as “foreign cyber actors.” The boarding was conducted to assess the integrity of both IT and OT systems aboard the vessel - a rare instance where a cyber incident triggered a kinetic, on-site federal response.

Details remain limited. Officials have not publicly attributed the attack to a specific nation-state or group. What is confirmed is that the response involved physically inspecting operational technology systems - the controls that manage propulsion, navigation, cargo handling, and safety systems.

For organizations in energy, maritime, and critical infrastructure verticals, this is a signal. The federal government treats maritime OT compromise as serious enough to warrant a physical boarding. If your customers operate in these sectors, the conversation about IT/OT segmentation, OT asset inventory, and incident response plans that account for operational technology is no longer hypothetical.

What defenders should do: Ensure OT asset visibility - you cannot defend systems you have not inventoried. Enforce IT/OT network segmentation. Include OT systems in incident response plans and tabletop exercises.

Source: The Record (Recorded Future)

AI Coding Assistant Hijacked - Shai-Hulud Worm Spreads Across 100 Repos

Mandiant documented the first public case of an attacker hijacking an AI coding assistant to propagate a supply-chain worm. The attacker poisoned software recommendations that the AI assistant accepted and incorporated into code. The resulting “Shai-Hulud” worm spread autonomously across approximately 100 internal repositories, exfiltrating secrets - API keys, tokens, credentials - from each one.

This is a new attack surface. The AI coding assistant acted as an unwitting amplifier: it trusted poisoned input, generated compromised code, and pushed it to repositories at machine speed. The blast radius expanded far faster than a human-driven supply-chain attack would have.

What defenders should do: Audit AI coding assistant configurations for guardrails on accepting third-party recommendations. Enforce code review gates that cannot be bypassed by automated commits. Run secret scanning on all repositories that AI tools have write access to. Treat AI-generated code with the same suspicion as untrusted third-party dependencies.

Source: The Hacker News

Today’s Deep Dive - CVE Roundup: Five Actively Exploited Flaws

Beyond the Cisco ISE zero-day, four additional CVEs are confirmed under active exploitation this week. Each represents a distinct attack surface.

CVE-2026-5430 - WSO2 API Manager (CVSS 9.8). A JWT signature bypass that allows admin account takeover on WSO2 API Manager instances. API gateways sit at the intersection of north-south and east-west traffic - compromising one gives an attacker a pivot point into every service behind it. Patch immediately. If patching is delayed, enforce network-level access restrictions on the API Manager admin console. MITRE ATT&CK: Initial Access (T1190 - Exploit Public-Facing Application). Source: The Hacker News

CVE-2026-87886 - Acronis Backup Plugin for cPanel & WHM (CVSS 7.8). Insecure file permissions in a widely deployed backup plugin allow local privilege escalation. Backup infrastructure is a high-value target - attackers who gain local access can escalate to root and compromise backup data itself. MSPs and hosting providers should prioritize this. Source: The Hacker News

CVE-2026-58704 - Google Pixel Cellular Modem (CVSS 8.0). A privilege escalation flaw in the Pixel modem firmware, exploited in targeted attacks. Google shipped the fix in the September Android security update. Organizations with BYOD policies allowing Pixel devices should enforce update compliance. Source: BleepingComputer

CVE-2026-89026 - Issabel Framework PBX (CVSS 9.8). Hard-coded credentials in the open-source unified communications framework enable unauthenticated remote code execution. VoIP and PBX systems are frequently overlooked in patch cycles - and frequently internet-exposed. Segment or isolate PBX infrastructure and patch. Source: The Hacker News

Defender Action Items

  • Cisco ISE: Patch to the version shipped today. Restrict ISE management to trusted VLANs. Audit admin accounts and policy changes for the exposure window.
  • WSO2 API Manager: Patch CVE-2026-5430 immediately. Restrict admin console access. Review API gateway logs for unauthorized admin sessions.
  • Acronis cPanel plugin: Patch CVE-2026-87886 or remove the plugin. Audit file permissions on backup infrastructure.
  • Google Pixel devices: Enforce September 2026 Android security update. Flag non-compliant Pixel devices in MDM.
  • Issabel PBX: Patch CVE-2026-89026 or take offline. Segment VoIP/PBX systems from production networks.
  • AI coding assistants: Audit repository write access for AI tools. Enforce human-reviewed merge gates. Run secret scanning on all repos with AI commit access.

Detection Queries

For organizations monitoring ISE authentication infrastructure, this Splunk SPL query identifies potential exploitation attempts targeting the ISE web interface - specifically anomalous unauthenticated requests that result in admin-level actions:

index=cisco_ise sourcetype="cisco:ise:web"
| where http_method="POST" AND status_code=200 AND NOT authenticated="true"
| stats count by src_ip, uri_path, http_method, status_code
| where count > 5
| sort -count
| table src_ip, uri_path, count, http_method, status_code

This query surfaces source IPs making repeated unauthenticated POST requests that receive HTTP 200 responses - a pattern consistent with authentication bypass exploitation. Tune the threshold (count > 5) based on your environment’s baseline. False positives are low in most ISE deployments because legitimate unauthenticated POST traffic to ISE admin interfaces should be near zero.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.