A working examiner's read of the week's most interesting compromises. What happened, how it happened and what it means for anyone who has to reconstruct the event afterward.
Last week the theme was the edge. This week the edge learned to clean up after itself. Between October 7 and October 14 the most dangerous intrusion on the board was one that ran no malware, dropped no web shell and edited the appliance logs on its way out. The biggest patch release in Microsoft's history landed with a zero-day that quietly removes the one tag Windows uses to remember where a file came from. And the systems built to save a company after an attack, its backup servers, became the way in.
Put those together and the week asks one uncomfortable question of every security team: when something goes wrong, what will be left to examine? Here is the week, read the way an examiner reads a disk: not as headlines, but as events that leave traces, and this week, events designed to leave as few as possible.
Ivanti Connect Secure: the intrusion that erases its own trail
On October 13 Ivanti disclosed CVE-2026-104935, an authentication bypass in Ivanti Connect Secure, the VPN appliance thousands of organizations use as the front door for remote staff. The flaw is rated 8.6 and lets a remote, unauthenticated attacker run arbitrary commands on the appliance. Affected builds include Connect Secure 22.8R2.4 and earlier, 25.1.1.1 and earlier and 25.1.2.2 and earlier. CISA added it to the Known Exploited Vulnerabilities catalog the same day and gave federal civilian agencies until October 16 to fix it. It is, by watchTowr's count, the fifteenth Connect Secure or Pulse Connect Secure flaw to make that list.
The disclosure was late to the party. Volexity, which found the attack, says a previously unknown actor it tracks as UTA0576 has been exploiting it since at least October 3, and the deception firm Defused reported first signs in its decoys on October 1. UTA0576 did not use the bug alone. It chained CVE-2026-104935 with two further flaws to reach unauthenticated root-level code execution on appliances that were fully patched. Ivanti fixed two of the three. At disclosure it was still working on the privilege-escalation link in the chain.
The tradecraft is what earns this story the top spot, because it was built for the person who investigates afterward. UTA0576 deployed no malware and no web shell. Instead of leaving a persistent foothold it re-exploited the appliance for every command it wanted to run, and it altered logs to cover its tracks. Volexity reports that the actor got past Ivanti's own Integrity Checker Tool, the utility customers are told to run to confirm a device is clean. CISA's guidance follows the same logic: confirming compromise takes network and memory forensics, not a file check.
What the actor did once inside reads like a shopping list for the rest of the network. Reported activity includes extracting credentials stored on the VPN appliance, exfiltrating a limited amount of Active Directory metadata, running a Kerberoasting tool, capturing LDAP traffic and using a Python LDAP tool to search the directory for administrator passwords and BitLocker recovery keys. That last item deserves a second look. Organizations escrow BitLocker recovery keys in Active Directory precisely so that a lost laptop stays protected. An intruder who harvests those keys turns every stolen or seized encrypted laptop in the fleet into an open book.
Exploitation is not slowing. Honeypot operator Previdian logged 105 exploitation attempts from 50 unique IP addresses by October 14, with attackers using a request header named X-DSCGI-PATH to reach an internal CGI handler and upload Perl scripts disguised as ZIP files. Shadowserver tracks more than 5,500 Connect Secure instances exposed to the internet. Volexity assesses with low confidence that UTA0576 is criminally motivated rather than an espionage crew.
For responders, three things follow. First, a clean Integrity Checker result does not clear an appliance that faced the internet between October 1 and the patch. Second, the appliance is the wrong place to look for the full story, because the actor controlled what it recorded. The surviving evidence sits upstream and downstream: firewall and proxy logs that the appliance could not touch, packet captures, domain controller logs showing the LDAP queries and Kerberos service-ticket requests that Kerberoasting produces. Our guide to Windows event log forensics for incident response covers which event IDs to pull first, and Sherlock Forensics Universal Events Viewer opens exported EVTX files on an analysis machine, so the review never touches the live controller. Third, CISA's cleanup instructions are a reset, not a patch: back up the configuration, factory reset or rebuild, restore, then reset every account password and revoke certificates, API keys and license server credentials. If the BitLocker escrow was queried, rotate those recovery keys too. When the appliance itself cannot be trusted, an incident response team that reconstructs the intrusion from everything around it is the only way to an answer that holds up.
Patch Tuesday: a record release and a zero-day that hides where files came from
Microsoft's October 13 release fixed 1,413 CVEs by Microsoft and SecurityWeek's count, the largest single Patch Tuesday on record. BleepingComputer counted 1,411 and noted that this excludes 348 flaws fixed earlier in the month. Seventy to seventy-five of them are rated critical depending on whose tally you use, and the bulk are elevation-of-privilege, remote code execution and information disclosure bugs.
The flaw under active attack is CVE-2026-96951, a Windows Shell security feature bypass rated 8.8. It lets an attacker defeat Mark of the Web, the label Windows attaches to files that arrive from the internet. The delivery is ordinary social engineering, a crafted file sent by email, instant message or web download, but the effect is not. Mark of the Web is the trigger for SmartScreen warnings and Office Protected View, so a file that arrives without it opens with the safety rails down. CISA added the bug to the exploited catalog with an October 16 deadline. Two more flaws were publicly disclosed before the fix: CVE-2026-108398, a .NET Framework bypass of Windows Defender Application Control found by James Forshaw of Google Project Zero, and CVE-2026-92707, a MessagePack-CSharp denial-of-service bug.
There is a forensic cost to a Mark of the Web bypass that rarely makes the patch notes. On NTFS, the mark lives in a small alternate data stream called Zone.Identifier attached to the downloaded file, and on a modern system it often records where the file came from: a zone number and, frequently, the referring page and the download URL. Examiners lean on that stream to prove a file arrived from outside and to trace it back to the email or site that delivered it. A bypass that keeps the mark from being written does not just disarm a warning. It removes a piece of provenance evidence. When Zone.Identifier is missing, the timeline has to be rebuilt from other artifacts, such as browser and mail client history, prefetch and the execution traces we cover in our piece on ShimCache and AmCache process execution attribution.
The rest of the release is dominated by bugs that need no click at all. Several Outlook remote code execution flaws, including CVE-2026-70242 and CVE-2026-70291, trigger when a message is simply viewed in the Reading Pane. A PowerPoint flaw, CVE-2026-88178, is reachable through the Preview Pane. CVE-2026-70571 lets an inbound email trigger remote code execution on Exchange Server, and CVE-2026-21413 in the Raw Image Extension fires when someone opens a folder holding a malicious file. For investigators the takeaway is practical: a suspect mailbox should be examined outside the client that would render it. Pulling the mailbox to a PST and reviewing it in a standalone tool, as described in our guide to opening a PST file without Outlook, keeps the review away from Outlook's preview and rendering path. Sherlock Forensics PST Viewer is built for that job, and the email header analyzer traces the relay path a suspicious message took before it reached the inbox.
Microsoft was not alone on October 13. The same day brought fixes from Adobe, Cisco, Citrix, Dell, Docker, Fortinet, GitLab, Ivanti, Kiteworks, Progress, SAP and SonicWall, among others. SonicWall's critical SMA1000 server-side request forgery flaw was exploited within two days of its fix, and Atlassian's critical CVE-2026-21589 in Confluence, Jira and Bitbucket Data Center was exploited after a public proof of concept appeared. Patch Tuesday is no longer one vendor's day. It is the industry's.
AhsayCBS: when the backup server is the way in
The story with the sharpest lesson for small and mid-sized businesses came from the backup world. AhsayCBS is a backup management platform used mainly by managed service providers and system integrators to run backups for their clients. On October 4 two flaws were published: CVE-2026-105133, an authentication bypass, and CVE-2026-105134, an unauthenticated remote code execution flaw in the Replication Receiver component that runs as SYSTEM. Chained, the first opens the door to the second.
Huntress first saw the chain used at 23:20:15 UTC on October 7 and counted five targeted organizations by the next day. The attackers configured a malicious replication receiver and dropped JSP web shells into the directory the console serves. In other cases the AhsayCBS service process, cbssvcX64.exe, was made to run curl and pull down a toolkit into the Temp folder. The payload was a cryptominer, and the disguise is worth studying: the XMRig miner was renamed edge.exe, a modified copy of the NSSM service manager was named msedge.exe and both ran under a new service called MicrosoftEdgeUpdateSvc, built to pass for the real Edge updater at a glance. A PowerShell script named Taskgmr.ps1 stopped the miner whenever Task Manager was open and restarted it when Task Manager closed, so a curious administrator checking CPU load would see nothing wrong. A known-vulnerable driver, WinRing0x64.sys, gave the miner kernel-level access to the hardware.
The fix was not clean either. Ahsay's version 10.3.4.0 did not fully close the chain, and on October 12 the company issued hotfix 10.3.4.45 for version 10 and 9.15.2.70 for versions 7, 8 and 9. CISA added both CVEs to the exploited catalog on October 14.
A cryptominer is the mild outcome here. A backup server holds the credentials and the reach to touch every machine it protects, and it holds the copies a company plans to restore from after ransomware. An attacker who owns the backup console owns the recovery plan. That is why our first-60-minutes ransomware response guide treats the integrity of backups as a first-hour question rather than a final step, and why backup assessment runs alongside the forensic work in our walkthrough of the ransomware recovery process.
For anyone examining an AhsayCBS host, Huntress published hashes for the three main files, and a hash calculator settles in seconds whether a suspicious edge.exe is the miner. Look for unexpected child processes of cbssvcX64.exe or cbssvcX86.exe, any service named MicrosoftEdgeUpdateSvc that does not point to Microsoft's own updater, a WinRing0x64.sys driver and recently written JSP files in the console's web directory. Huntress advises rebuilding a compromised host from a trusted backup because the attackers planted secondary backdoors. Before you wipe it, image it. A forensic disk image taken first, logged under a proper chain of custody, is the only way the question of what else the attacker touched can still be answered next month.
Pwn2Own Ireland: the final tally
Last week we covered the opening day in Cork. By the time the contest closed on October 8 the board read 1,262,000 US dollars paid for 98 unique zero-days. Day one paid 388,500 dollars for 32 bugs, day two 232,500 dollars for 45 and day three 641,000 dollars for 21, with a single entry accounting for nearly half of that final day.
That entry decided the competition. Ikotas Labs chained zero-days to compromise the Google Pixel 10 for 300,000 dollars, the top award on offer, and finished as Master of Pwn with 42.5 points and 361,000 dollars across the three days, having also landed exploits against the Samsung Galaxy S26, OpenAI Codex and Oracle's Autonomous AI Database. Xint took second with 240,000 dollars and 27.5 points, and Team ZyGoat took third with 125,000 dollars.
The phones had a hard week. The Galaxy S26 fell three more times on day two, to PetoWorks, to Kyeongmin Kim of KAIST Hacking Lab and to CENSUS Labs, and was rooted again on day three by BunkyoWesterns. The Pixel 10 went down three times on the final day. The one flagship nobody touched was Apple's iPhone 17: no team registered an attempt, even with up to 300,000 dollars on the table for a remote compromise. That is a statement about how expensive iOS exploit chains have become, not a guarantee that none exist.
Elsewhere the smart home kept falling. Team MAMMOTH found six zero-days in the Home Assistant Green hub and a Brother office printer fell to a single zero-day for 20,000 dollars. The AI category also added fresh successes against Oracle's Autonomous AI Database on the last day. Every one of these bugs now sits in a vendor disclosure window.
For mobile forensics the lesson from Cork is the same one we drew last week, now with a final score attached. Current Android flagships are being taken apart by working chains in public, so an examination should never assume the handset in evidence was clean. The defensible approach is to capture what the device recorded, its app data, logs and diagnostic artifacts, in a documented acquisition. On Android that is the job Sherlock Forensics Android Acquirer was built for, and on iPhone, Sherlock Forensics iPhone Analyzer does the same with backups and extractions.
Japan: one cloud provider, 495 victims
The week's clearest picture of supply-chain risk came from Japan. On October 7 a ransomware attack disrupted IDCF Cloud, the cloud service run by SoftBank subsidiary IDC Frontier, and 495 corporate and local-government customers were affected in one stroke. On October 14 IDC Frontier said it had found no evidence that data on the affected virtual servers was taken, but it did confirm unauthorized queries against registration information for 48 customers. The investigation continues.
The attack landed in the middle of a run of Japanese incidents that included Times Mobility, part of the Park24 group, reporting unauthorized access affecting about 6.6 million accounts and driver's licence images, and karaoke operator Daiichikosho reporting about 8.72 million customers potentially affected through a system run by an outside contractor. Masaaki Taira, head of Japan's National Cybersecurity Strategy Headquarters, described the situation as a state of emergency in cyberspace. On October 9 the Financial Services Agency urged banks and other financial institutions to tighten security, review third-party risk and move away from identity checks based on uploaded document photos toward IC-chip verification.
When a provider is hit, each of its 495 customers inherits an incident they did not cause and cannot fully see. The evidence about what happened to your data now lives on someone else's infrastructure, under someone else's retention policy, which is the core problem of cloud forensics. The time to negotiate log access and preservation with a provider is before you need it, not after.
The breaches worth your attention
The most consequential disclosure of the week came from healthcare. iRhythm Technologies, the San Francisco maker of Zio wearable cardiac monitors, began notifying patients and state regulators about a breach of what it called certain third-party-hosted business applications. Data was accessed and downloaded between June 3 and June 8. Early state filings counted nearly 300,000 people in Texas and nearly 70,000 in South Carolina, and by October 16 the company put the total at 8.2 million individuals. The exposed fields include names, addresses, email addresses and phone numbers, dates of birth, insurance numbers, iRhythm patient account numbers, dates of service and device serial numbers. iRhythm said its clinical systems and devices were not affected. Its June 10 SEC filing disclosed that the attacker demanded payment to keep the stolen data from being published.
Two details are worth holding onto. The first is the gap: four months between a June intrusion and October notifications, and a count that grew from hundreds of thousands to more than eight million in a matter of days. Scope only becomes clear once someone works through exactly what was accessed, which is why breach counts so often climb after the first announcement. The second is the data itself. A device serial number tied to a name and an insurance number is a durable identifier that cannot be reissued like a password. For organizations facing their own notification decisions, our guides to breach response for insured companies and PIPEDA breach notification cover the clock that starts the moment you suspect personal data left the building.
On the watchlist
A few more items earned a place on the patch-now list.
On October 14 CISA added a Palo Alto Networks PAN-OS code injection flaw, CVE-2026-0322, and a Cisco Secure Email Gateway path traversal flaw, CVE-2026-76519, to the exploited catalog alongside the AhsayCBS pair. A firewall and a mail gateway, the two devices that see the most of an organization's traffic, should both be checked this week.
And just after our window closed, on October 16, BeyondTrust patched CVE-2026-102764 in Remote Support, a flaw reported as exploited by a China-linked group since late August. Self-hosted Remote Support appliances should be patched now, and any appliance exposed since August should be treated as a candidate for investigation rather than simply updated. We will cover it fully next week.
The forensic read
Pull back from the individual stories and this week has one argument to make. Attackers are now designing intrusions around the investigation that will follow them.
Look at the pattern. UTA0576 refused to leave a web shell, re-exploited the Ivanti appliance for every command and rewrote the appliance logs. The Mark of the Web zero-day removes the tag that tells an examiner a file came from the internet. The AhsayCBS miner hid from Task Manager and wore the name of a Microsoft service. None of these are accidents. Each one targets a specific thing a defender or an examiner would check.
The defensive lessons follow directly. Evidence has to live somewhere the attacker cannot reach, which means forwarding logs off the appliance and off the host as they are written, not collecting them afterward. Integrity checks and vendor tools are a starting point, never a clearance. Backups are part of the attack surface, so the backup console deserves the same scrutiny as the domain controller. And when a provider or an appliance is the thing that failed, the answer comes from the systems around it, which only works if those systems were recording in the first place. If you are not sure yours are, our Digital Evidence Readiness Self-Audit shows where the gaps are.
That is the through-line Sherlock Forensics cares about. An intrusion is not finished when the attacker leaves. It is finished when someone can reconstruct what happened in a form that holds up to scrutiny. This week's adversaries worked hard to make that impossible. The answer is to keep evidence where they cannot reach it, and to have an incident response retainer in place before the day you need one. That is the work. See you next week.
Sources
- Ivanti warns of Connect Secure zero-day exploited in attacks, BleepingComputer: www.bleepingcomputer.com
- CISA urges immediate Ivanti Connect Secure updates, The Hacker News: thehackernews.com
- CISA adds two Known Exploited Vulnerabilities to catalog, October 13, CISA: www.cisa.gov
- CISA adds four Known Exploited Vulnerabilities to catalog, October 14, CISA: www.cisa.gov
- Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days, BleepingComputer: www.bleepingcomputer.com
- Microsoft patches record 1,413 vulnerabilities, SecurityWeek: www.securityweek.com
- October 2026 Patch Tuesday: updates and analysis, CrowdStrike: www.crowdstrike.com
- Threat actors exploit critical AhsayCBS flaws to drop web shells and XMRig cryptominer, Huntress: www.huntress.com
- Hackers earn 1,262,000 dollars for 98 zero-days at Pwn2Own Ireland, BleepingComputer: www.bleepingcomputer.com
- Pwn2Own Ireland 2026 Day Two Results, Zero Day Initiative: www.zerodayinitiative.com
- Pwn2Own Ireland 2026 Day Three Results and Master of Pwn, Zero Day Initiative: www.thezdi.com
- Japan on cyberattack alert as ransomware wave hits major brands, International Business Times: www.ibtimes.co.uk
- Heart monitor firm notifying patients of hack, BankInfoSecurity: www.bankinfosecurity.com
- BeyondTrust patches zero-day exploited in attacks since August, BleepingComputer: www.bleepingcomputer.com
Previous in this series: Weekly Security Roundup: September 29 to October 6, 2026.