A Cisco firewall zero-day crashing appliances in the wild, custom malware stealing SD-WAN encryption keys, and the largest crypto theft in history attributed to North Korea - today’s brief covers three stories that will drive customer conversations this week, plus a CVSS 10 GitLab RCE that demands immediate patching for any self-hosted instance.

In the News

Cisco ASA/FTD SSL VPN Zero-Day Crashes Firewalls Under Active Exploit

CISA added CVE-2026-76418 to the Known Exploited Vulnerabilities catalog on October 29 after confirming in-the-wild exploitation. The vulnerability, rated CVSS 8.6, affects Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. A remote, unauthenticated attacker can send crafted requests to the SSL VPN service and trigger a full device reload - crashing the firewall and taking it offline.

The attack requires no credentials and no user interaction. Any ASA or FTD appliance with SSL VPN enabled on an internet-facing interface is exposed. Exploitation does not achieve code execution - this is a denial-of-service condition - but the operational impact is severe: a firewall crash takes the entire protected network segment offline until the device reboots.

Cisco has released fixed software versions. Organizations that cannot patch immediately should restrict SSL VPN access to known IP ranges and deploy IPS signatures to detect crafted requests targeting the vulnerable service. The broader question is exposure surface: how many SSL VPN interfaces are reachable from the internet, and does the organization have an inventory?

What defenders should do: Patch to fixed ASA/FTD software versions immediately. If patching is delayed, restrict SSL VPN access by source IP and enable IPS signatures for CVE-2026-76418. Audit internet-facing interfaces for unnecessary SSL VPN exposure. MITRE ATT&CK: T1499.004 - Endpoint Denial of Service: Application or System Exploitation.

KeyDrift Malware Steals Cisco SD-WAN Encryption Keys

A threat actor tracked as UAT-11473 is deploying custom malware called KeyDrift against Cisco Catalyst SD-WAN controllers, exploiting CVE-2026-20127 - an authentication bypass that Cisco patched in February 2026. Organizations that delayed patching are now facing active compromise.

KeyDrift’s purpose is specific and damaging: it exfiltrates the site-to-site encryption keys used to protect traffic across the SD-WAN overlay. With these keys, the attacker can passively decrypt inter-site traffic - a capability that transforms a network management compromise into a full-scale communications interception operation. The malware establishes persistence on the controller and exports keys to attacker-controlled infrastructure.

The operational response is two-fold: patch CVE-2026-20127 and rotate all site-to-site encryption keys. A patch alone is insufficient if keys were already exfiltrated. Organizations should review controller access logs for anomalous authentication events and bulk key export operations dating back to when the vulnerability was first disclosed.

What defenders should do: Apply the February 2026 patch for CVE-2026-20127, rotate all SD-WAN encryption keys, and hunt for indicators of KeyDrift on controller infrastructure. MITRE ATT&CK: T1557 - Adversary-in-the-Middle, T1552.004 - Unsecured Credentials: Private Keys.

Binance Confirms $6.3 Billion Crypto Theft - North Korea Attributed

Binance disclosed what is now the largest cryptocurrency theft in history: $6.3 billion stolen from hot wallets. The attack has been attributed to North Korea’s TraderTraitor group, also tracked by Microsoft as Jade Sleet. The entry vector was a compromised DevOps engineer’s laptop - a single endpoint with access to production deployment pipelines.

The attack chain followed a pattern consistent with TraderTraitor’s documented tradecraft: initial access through social engineering or malware delivery to a developer endpoint, followed by lateral movement through CI/CD infrastructure to reach production systems. From there, the attackers accessed hot wallet signing keys and executed transfers. Microsoft’s concurrent threat intelligence report confirms that North Korean APT groups are using AI to accelerate social engineering and repository trojanization - the same techniques that likely supported this operation.

The lesson is not crypto-specific. Any organization where a single developer laptop can reach production signing infrastructure without device trust verification, conditional access enforcement, or network segmentation has the same exposure. The $6.3 billion figure makes the headline; the unmanaged laptop makes the kill chain.

What defenders should do: Enforce device trust and conditional access for all production environment access. Require phishing-resistant MFA on privileged accounts. Segment CI/CD infrastructure from developer endpoints. MITRE ATT&CK: T1078 - Valid Accounts, T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain.

GitLab CVSS 10 RCE Exploited in the Wild

CVE-2026-97229 is a max-severity unauthenticated remote code execution vulnerability in GitLab Community and Enterprise editions. The flaw is an integer overflow in CI regex processing - an attacker can trigger it without any authentication by submitting crafted input to the CI pipeline. Alpine Linux’s own GitLab instance was confirmed compromised through this vulnerability.

Self-hosted GitLab instances exposed to the internet are the highest-risk targets. The exploit requires no valid credentials, no prior access, and no user interaction. Organizations running self-hosted GitLab should treat this as an emergency patch, restrict inbound access to the GitLab web interface, and review CI pipeline execution logs for anomalous activity.

What defenders should do: Patch GitLab to the latest fixed version immediately. Restrict internet access to self-hosted GitLab instances. Audit CI pipeline logs for unauthorized executions. MITRE ATT&CK: T1190 - Exploit Public-Facing Application.

Today’s Deep Dive - Supply Chain Attacks Are Accelerating Across Every Layer

Three supply chain compromises landed in today’s research, each targeting a different layer of the software ecosystem. Polymarket traders lost $2 million after attackers injected malicious JavaScript through a compromised website monitoring tool - a third-party script running in the browser. The Anthropic Claude Code extension for VS Code was compromised on the Open VSX registry to install a persistent SSH backdoor, targeting developers who trust official marketplace listings. And malicious Hugging Face models returned days after a takedown, hijacking GPUs for crypto mining and planting backdoors on ML infrastructure.

The common thread: each attack exploits the trust relationship between a platform and its ecosystem. Website owners trust monitoring scripts. Developers trust marketplace extensions. ML engineers trust model repositories. In every case, the compromise vector was not the primary platform itself but a component the platform ingests from a third party.

GitHub’s new npm firewall (now in preview) represents one response - intercepting malicious packages at install time. But the broader defensive posture requires software composition analysis, subresource integrity checks for browser-loaded scripts, and strict extension allowlisting for developer tooling. MITRE ATT&CK: T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools, T1059.007 - Command and Scripting Interpreter: JavaScript.

Defender Action Items

  • Cisco ASA/FTD: Patch CVE-2026-76418 immediately. Restrict SSL VPN access by source IP if patching is delayed. Deploy IPS signatures for the crafted request pattern.
  • Cisco SD-WAN: Verify CVE-2026-20127 patch is applied (available since February 2026). Rotate all site-to-site encryption keys regardless of patch status. Hunt for KeyDrift indicators on controllers.
  • GitLab self-hosted: Emergency patch for CVE-2026-97229. Restrict internet access to GitLab instances. Audit CI pipeline execution history.
  • Endpoint and identity: Enforce device trust for production access. Require phishing-resistant MFA on all privileged accounts. Audit DevOps laptop fleet for unmanaged endpoints.
  • PAN-OS management interfaces: Verify CVE-2026-109618/109619 patches applied - PHP2Shell exploitation is active. Ensure management interfaces are not internet-exposed.
  • VMware ESXi: Patch CVE-2026-41709 - Warp Panda is exploiting it to suppress audit logs.
  • Linux kernel: Prioritize CVE-2026-98432 (CVSS 9.8) on internet-facing servers - AI-generated working exploit exists.

Detection Spotlight

Detecting CVE-2026-76418 exploitation attempts on Cisco ASA. The crash produces syslog message 746016 followed by a device reload. This Splunk SPL query correlates SSL VPN connection attempts with subsequent crash events to identify potential exploitation:

index=cisco_asa sourcetype="cisco:asa"
(mnemonic="746016" OR mnemonic="ASA-1-199010")
| eval event_type=case(mnemonic=="746016", "ssl_vpn_crash", mnemonic=="ASA-1-199010", "device_reload")
| stats earliest(_time) as first_event latest(_time) as last_event values(event_type) as events by host
| where mvcount(events) > 1
| eval time_delta=last_event - first_event
| where time_delta < 30
| table host first_event last_event time_delta

This query identifies ASA devices that experienced both an SSL VPN processing error (746016) and a device reload within a 30-second window - a high-fidelity indicator of CVE-2026-76418 exploitation. False positive rate is low: legitimate crashes from this message pair outside of exploitation are uncommon in production environments.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.