Cisco and GitLab flaws enter CISA exploited-vulnerability catalogue

Cisco says CVE-2026-76418 is being exploited against its Secure Firewall ASA and Threat Defense software.The Hacker NewsSecurityWeek An unauthenticated attacker can send a crafted request to the Remote Access SSL VPN service and cause a device reload; exposure requires a vulnerable release, a reachable SSL VPN login service and secondary authentication in the affected tunnel group.The Hacker NewsSecurityWeek Cisco fixed ASA releases 9.16 and earlier in 9.16.4.104, 9.18 in 9.18.4.96, 9.20 in 9.20.4.50, 9.22 in 9.22.3.200, 9.23 in 9.23.1[.]48, and 9.24 in 9.24.1[.]27 and 9.24.10[.]1; FTD fixes range from 7.0.11 through 10.1.1 across the affected release lines.The Hacker NewsCISA CISA added the flaw to KEV on 29 October and set a 1 November 2026 deadline; Cisco has not disclosed campaign details.The Hacker NewsCISA

AnalysisCISA’s two catalogue additions cover different reported activity: Cisco confirms exploitation of its flaw, while the GitLab listing follows an attempted attack on Alpine’s server whose outcome remains unconfirmed.The Hacker NewsCISAThe Hacker NewsCISA

CISA added CVE-2026-97229, which affects GitLab Community Edition and Enterprise Edition, to KEV on 29 October.CISA The flaw can allow unauthenticated code execution through a crafted regular expression in a CI/CD configuration, and CISA lists GitLab 19.4.2 as a patch release.CISA The Hacker News reported that Alpine Linux rebuilt its GitLab server after an attacker probed it and caused worker crashes; Alpine said it had no definitive evidence of a successful attack.The Hacker NewsCISA CISA’s listing confirms active exploitation, but says ransomware use is unknown.The Hacker NewsCISA Its remediation deadline is 1 November 2026.The Hacker NewsCISA

AnalysisThe catalogue addition updates the status of the GitLab flaw since the Alpine incident was reported, without confirming that Alpine’s own server was breached.The Hacker NewsCISA

Kaspersky described a suspected supply-chain incident involving a malicious archive found in a Windows update download folder at a government client in Asia.SecurityOnline The archive appeared connected to Patch My PC and included Microsoft-signed .NET components, but Kaspersky said Patch My PC itself was not proven to have been breached.SecurityOnline Kaspersky said the concealed infection chain led to NetamLoader, a .NET loader, and characterised the evidence as strongly indicating a supply-chain attack.SecurityOnline It reported one observed victim and said attribution remained undetermined.SecurityOnline

The Hacker News reported that Binance disclosed an incident affecting around $6.3 billion of assets on its platform, with about $3 billion frozen on-chain.The Hacker News Binance said there was no evidence wallet private keys had been leaked and that it would cover losses from its Secure Asset Fund for Users and reserves.The Hacker News The Hacker News said Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop, while SecurityOnline described the event as a suspected hot-wallet breach and said Binance had not formally confirmed theft or full private-key compromise.The Hacker NewsSecurityOnline Tether and Circle separately reported freezing more than USDT 1.567 billion and USDC 800 million tied to the incident.The Hacker NewsSecurityOnline

AnalysisThe accounts describe different levels of confirmation: Binance disclosed a security incident, while SecurityOnline said the company had not confirmed theft or full key compromise.The Hacker NewsSecurityOnline