AI-generated content. This briefing is compiled by an AI assistant from public sources. Summaries may contain errors — always verify details in the linked primary sources before acting.
This edition is dominated by an uncomfortable pattern: flaws that were quietly fixed months ago are being weaponised now, because organisations never installed the patch. Nextcloud servers are being backdoored through a critical flaw in the Collabora Online built-in CODE editor app that was patched on 11 September, yet is still being exploited in the wild in September and October. On the OT side, CISA published an advisory on six vulnerabilities in the Eclipse Milo OPC UA Java stack — the library behind countless industrial OPC UA servers in chemical, manufacturing, energy and water environments — with severity up to 9.1 and fixes already available in Milo 1.1.5. BSI flags a fresh critical issue in JetBrains TeamCity, the CI/CD server, where attackers can execute arbitrary code, plus unpatched flaws in pfSense and WildFly. Microsoft and Health-ISAC scored a rare offensive win, seizing the domains of the YAM Store, CoGUI and Iron Man phishing-as-a-service ecosystem behind more than a billion malicious messages aimed at 75,000 organisations. And Forescout’s analysis of a decade of ICS advisories shows high-severity OT flaws climbing steadily, with field controllers, PLCs and SCADA systems increasingly in the crosshairs — a good week for organisations to re-check patch backlogs, especially where industrial protocols meet IT networks.
Category: IT | Severity: Critical (CVSS 9.2) | Status: Exploited in the wild since September 2026; fix available since 11 September 2026
Threat actors are exploiting a critical OS command injection flaw, now tracked as CVE-2026-110447, in the Collabora Online Built-in CODE Server app (richdocumentscode) for Nextcloud. The unauthenticated command execution is triggered when the app’s local document server is not running — typically during restarts or upgrades — allowing attackers with no account to execute commands and plant web shells on the server. Collabora says the exposure only affects the Development Edition in the rather rare Built-in CODE Server deployment mode, and the flaw is distinct from CVE-2025-66208. The fix shipped in richdocumentscode 26.4.303 on 11 September 2026, yet exploitation continued into October — a textbook case of a patch that exists but is not applied. Notably, merely disabling the app does not remove the exposure; upgrading the app is required.
Takeaway: Organisations running Nextcloud with the built-in Collabora CODE app should upgrade to 26.4.303 or later immediately — and check your servers for web shells, since exploitation has been ongoing for weeks.
Sources: BleepingComputer, The Hacker News, Primary source (Collabora/CVE record)
Category: OT | Severity: Up to CVSS 9.1 | Status: Patched in Eclipse Milo 1.1.5 (upgrade recommended)
On 15 October 2026, CISA published ICSA-26-288-01 covering six vulnerabilities in the Eclipse Foundation’s Milo OPC UA stack — the Java implementation widely embedded in industrial OPC UA servers and gateways. The issues include missing authorization on server diagnostics nodes (CVE-2026-63248), a failure of OpcUaServerConfig.copy() to preserve a configured RoleMapper, and resource-exhaustion defects (CVE-2026-61387), among others. An anonymous client can enable diagnostics over an unsecured endpoint, exposing usernames, login history, authentication mechanisms and security policies of other sessions. CISA assesses the risk to chemical, manufacturing, energy and water sectors as significant, since Milo code is embedded in countless vendors’ industrial products. All six flaws are fixed in Eclipse Milo 1.1.5 and newer.
Takeaway: Because Milo is a library, organisations may have it without knowing — identify which industrial products embed it (many SCADA, historian and gateway products do) and push vendors to deliver builds on Milo 1.1.5+.
Sources: Windows Forum analysis, Security Boulevard OT roundup, Primary source (CISA ICSA-26-288-01)
Category: IT (DevOps) | Severity: High/Critical | Status: Fixes available for TeamCity; WildFly flaw still unpatched
Germany’s BSI released a new high-severity advisory (WID-SEC-2026-3986) for JetBrains TeamCity, the widely used CI/CD server, where multiple vulnerabilities allow arbitrary code execution and cross-site scripting. TeamCity has a history of being a prized target — attackers who compromise a build server inherit the credentials and code-signing capabilities of the entire software supply chain. BSI also flagged, in the same batch, an unpatched (UNGEPATCHT) information-disclosure flaw in Red Hat WildFly and an unpatched set of flaws in Netgate pfSense that can lead to admin-level code execution — the latter notable for a firewall product. Older updates from the same BSI cycle include critical Samba fixes, high-severity Linux kernel and FortiOS advisories, and fresh Android and Chrome patches.
Takeaway: CI/CD servers like TeamCity deserve the same patch urgency as your perimeter — a build server is a launching pad for supply-chain attacks.
Sources: BSI WID-SEC-2026-3986 (TeamCity), BSI WID-SEC-2026-3983 (pfSense, unpatched), Primary source (JetBrains security bulletin)
Category: IT (threat intelligence / law enforcement) | Severity: Major disruption operation
Microsoft’s Digital Crimes Unit and Health-ISAC announced on 14 October 2026 that they are dismantling three components of a Chinese-language cybercrime marketplace: YAM Store (fraudulent Microsoft and Google accounts plus identity-theft tools), CoGUI (a high-volume phishing-kit service) and Iron Man (hosting infrastructure). Together these services enabled more than 1 billion malicious messages targeting over 75,000 organisations worldwide since January 2026, with much of the operational activity traced through Japan, whose National Police Agency assisted the investigation. Microsoft obtained a court order from the US District Court for the Southern District of Florida to seize and redirect the domains, and disabled more than 20,000 accounts connected to the store. This disruption targeted the “service economy” behind transnational cybercrime rather than a single group.
Takeaway: Phishing volume may temporarily dip, but marketplaces like this rebrand — keep your email authentication (SPF/DKIM/DMARC) and user-reporting hygiene tight.
Sources: SecurityWeek, The Verge, Industrial Cyber, Primary source (Microsoft On the Issues)
Category: OT | Severity: Strategic/industry trend
A new analysis from Forescout (Vedere Labs) shows a sustained spike in high-severity OT/ICS vulnerabilities, with the sharpest increases in flaws affecting field controllers, PLCs and SCADA systems — the assets closest to physical processes. The long-view data is stark: between March 2010 and January 2026, CISA/ICS-CERT published 3,637 ICS advisories covering 12,174 vulnerabilities across 2,783 products from 689 vendors, and 2025 set a record with 508 advisories covering 2,155 vulnerabilities. Forescout argues that growing interconnection between OT, IT and cloud services keeps expanding the attack surface, and calls for better asset visibility, coordinated vulnerability prioritisation and faster patching — noting that vulnerabilities concentrate at Purdue levels 1–3, exactly where organisations have the least insight.
Takeaway: Patch programmes for OT can’t beat the raw volume — prioritise by exposure and consequence, which requires (you guessed it) an accurate asset inventory of the OT network.
Sources: Industrial Cyber, Primary source (Forescout blog)
Disclaimer: This briefing is compiled by an AI assistant. All summaries are AI-generated from public sources; links to the original articles and advisories are provided for verification. Always confirm details in the primary sources before acting.