Critical Exploits, Supply Chain Attacks, and New Vulnerabilities Highlight Cybersecurity Landscape

This daily summary covers critical cybersecurity incidents and advisories from October 12, 2026. The landscape features active exploitation of network devices, sophisticated supply chain attacks, and newly disclosed vulnerabilities.

Critical Vulnerabilities Under Active Exploitation:

• Cisco and SonicWall Flaws Under Active Exploit; CISA Issues KEVs: SonicWall SMA 1000 SSRF (CVE-2026-102255) is being actively exploited just days after patches were released. Researchers observed numerous exploit attempts originating from U.S. IP addresses, with the flaw allowing for full device takeover and remote code execution. Hundreds of appliances remain exposed, and immediate patching is urged for affected versions.
• New Critical RCE Flaw Found in Patched Citrix NetScaler Appliances: Citrix has disclosed CVE-2026-107406, a critical memory overflow vulnerability in NetScaler ADC and Gateway appliances, rated 9.5 CVSS. This flaw enables unauthenticated remote code execution and affects recent versions patched in September 2026. Exposure is contingent on the appliance's configuration as a SAML identity provider, and immediate patching is recommended.

New Threats and Advisories:

• [UPDATE] Iranian Actor Targets Iraqi Infrastructure with "Blinder Tunnel": The Iranian 'Blinder Tunnel' campaign has escalated, breaching an Iraqi government cloud environment and exfiltrating data. Attackers are employing new social engineering tactics, including fake LinkedIn personas and government portals, alongside the 'StarkMeet' trojanized application for deploying backdoors.
• Warlock Ransomware Hits Critical Sectors via Old SharePoint Flaws: The China-linked Warlock ransomware group has breached organizations by exploiting unpatched Microsoft SharePoint vulnerabilities. Attackers deploy web shells and use 'bring your own vulnerable driver' (BYOVD) techniques to disable security software before deploying ransomware.
• Ledger Wallets Hit by Supply Chain Attack; Over $90M in Crypto Stolen: A supply chain attack targeting Ledger hardware wallets has led to the theft of over $92 million in cryptocurrency. The attack involved physical tampering with devices sold through an authorized reseller, compromising devices before they reached customers.
• iRhythm Notifies Over 360,000 Patients of Data Breach from June: Medical device maker iRhythm Technologies is notifying over 360,000 patients of a data breach that occurred in June 2026. Unauthorized access to business applications hosted by a third party resulted in the exfiltration of personal and medical data, followed by a ransom demand.