IN the latest SANS Internet Storm Center podcast for Friday 16 October 2026, the discussion centres on several active exploitation campaigns and vendor patches affecting enterprise security gateways and management interfaces. The hosts describe Panchan’s Mining Island, a crypto-miner worm written in Go that spreads via SSH on Unix systems, pilfers SSH keys to access other hosts, and installs a rootkit to achieve persistence.
A notable feature is its use of a peer-to-peer style command-and-control channel, including Discord as one of the C2 options. Dynamic analysis with FakeNet-NG helped reveal these behaviours, including the Discord communications.
The briefing also highlights a potential flaw in Cisco Secure Email Gateway: when its Advanced Malware Protection feature’s reputation component is enabled, attackers could write arbitrary files that execute with root privileges, indicating both a directory traversal issue and a broader risk due to root-level execution.
The episode then covers several vendor responses to recently exploited vulnerabilities. Palo Alto Networks has released an update for a remote code execution flaw–also requiring authentication–where the attacker would still gain root access if they exposed a management interface. Cisco has issued guidance for detecting indicators of compromise in light of the active exploitation described.
Ivanti patched a zero-day sequence, with Volexity outlining three chained vulnerabilities that culminate in full system compromise: an authentication bypass, followed by arbitrary file write, remote code execution, and finally privilege escalation. Ivanti combined the first two vulnerabilities under a single CVE number, while the privilege escalation flaw remained unpatched at the time of the report. The presenter notes these are being actively exploited and urges timely patching.