Here are today’s top cybersecurity stories for Thursday, October 15, 2026.
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Researchers at the University of Toronto’s Citizen Lab linked zero-click infections on Al Jazeera devices to Candiru, an Israeli spyware maker. Ad company Discover-Tech screened devices by advertising ID and IP address, then sent attack code only to chosen targets. At least 45 Al Jazeera devices were targeted in 2024 and 2025. Google removed Discover-Tech from its ad exchange. The Hacker News
Cisco Warns of Active Attacks on Critical Secure Email Gateway Flaw
CVE-2026-76519 carries a CVSS score of 9.8. An unauthenticated sender writes files to the appliance operating system by emailing a crafted attachment, which allows commands as root. The flaw affects gateways with File Reputation enabled and Content Scanner Tools older than 25.3.0.5525. Cisco lists no workaround. The Hacker News
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
CVE-2026-0322 is a CVSS 8.6 flaw in the PAN-OS management interface. An authenticated attacker with network access runs code as root on PA-Series, VM-Series, and Panorama devices. Palo Alto Networks reports limited exploitation. CISA added the flaw to its KEV catalog with an October 17 federal deadline. The Hacker News
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws
Next.js 16.4.1 and 15.5.28 fix a use cache code execution flaw and an SVG processing flaw tracked as CVE-2026-96889. Vercel rates both CVSS 9.5. A third fix addresses a denial of service issue in Server Actions. No attacks are reported. The Hacker News
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path Through Contributed Modules
CVE-2026-108097 sits in the Field UI module of Drupal core. Fixes ship in 11.4.10, 11.3.19, and 10.6.19. Drupal says at least one known exploit path needs no login. No public exploit code or attacks are reported. The Hacker News
NGINX Fixes Five Flaws, Including Three Memory Bugs and a TLS Client-Certificate Issue
NGINX 1.30.6 and 1.31.7 address five vulnerabilities. F5 scores the three memory bugs 9.2 on CVSS v4.0. One TLS flaw, CVE-2026-97629, allows a forged session to bypass client-certificate checks in some configurations. None of the five appears in the CISA KEV catalog. The Hacker News
GhostAction Compromises About 1,900 GitHub Accounts and Targets Over 30,000 Repositories
GitGuardian researchers traced a supply chain campaign pushing malicious GitHub Actions workflows through stolen tokens. The attackers tried to extract 3,174 secrets from CI pipelines on October 8 and 9. GitHub began blocking the workflow on October 9, and later waves extracted no secrets. The Hacker News
Langflow Critical Authenticated RCE Flaw Draws 1,423 Honeypot Exploit Attempts
Previdian reports 1,423 attempts against CVE-2026-105740 since September 19 from 27 unique IP addresses in 15 countries. The CVSS 9.9 flaw lets any logged-in user run operating system commands by adding an MCP server with the stdio transport. Versions before 1.9.0 are affected. The Hacker News
Help TDS Linked to Hotejka as 20,000 Cloudflare Pages Domains Host Tech Support Scams
Infoblox assesses with high confidence the Help TDS traffic distribution system belongs to the operation behind ROI777. Researchers found more than 20,000 pages.dev domains since April 2026, with roughly 300 disposable pages created each day. About 20 affiliates send traffic to the system. The Hacker News
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
Cisco Talos and Recorded Future Insikt Group describe a Kazakhstan-nexus actor using CVE-2025-8088 in an April 2026 chain to place the PickleShell reverse shell in the Windows Startup folder. Victims and lures span nine countries in the Commonwealth of Independent States region. It is the first time the group has used a security flaw for delivery. The Hacker News
Stay tuned for today’s in-depth analysis posts.
