Today’s vibe is “your tools are the breach.” Source code hosts, backup consoles, and firewall management planes keep turning into the easiest door, because we keep treating them like internal-only forever.

Today's Top 5

1. 1,500 Meta people exposed: A single stolen employee credential was enough to pull code and a little personal data out of Meta’s GitHub. The uncomfortable question is what else was sitting in repos “by mistake.” Source
2. PAN-OS mgmt RCE is attacked: Palo Alto shipped fixes for an authenticated management-interface RCE with observed exploitation. If your management plane is reachable from anywhere sketchy, the patch window is already gone. Source
3. Linux “Vghost” VM-escape risk: A vhost stale-cache bug can hand local users kernel read/write, and in some setups can pivot from guest to host via QEMU memory corruption. This one will show up in hardening checklists tomorrow. Source
4. Docker Hub token swap: A design flaw let attackers reassign a personal access token to a different owner during account-to-org conversion, enabling registry actions as the victim. Supply chain problems rarely arrive with sirens. Source
5. curl HTTP/2 UAF → RCE conditions: curl shipped a high-severity HTTP/2 upload use-after-free that can become RCE under precise conditions. The real risk is how many products embed libcurl without telling you. Source

Why today matters: The common failure mode is not “a clever exploit,” it’s control-plane sprawl. GitHub orgs, firewall management interfaces, backup consoles, and container registries keep living one policy exception away from disaster. CISOs should assume attackers are optimizing for the admin surface you forgot to inventory, not the endpoints you do.

XERJ Corpus Hub: If PAN-OS CVE-2026-0322 is on your patch list today, an AI agent loading nuclei-templates can draft a safe internal-only check template for exposed management interfaces, then hand you a prioritized target list in minutes. Grab it at hub.xerj.org.

Okay, let’s get into the receipts.

Data Breaches

1. Meta GitHub breach impacts ~1,500 people: Meta says an outside group used an employee’s stolen credentials to access some GitHub repositories, taking mostly source code plus a small amount of personal data that should not have been stored there. Meta says it rotated secrets found in the repos and is offering monitoring to affected individuals. Source: SecurityWeek
2. Cyberattack hits Senture, disrupts FMCSA trucking support: A cyberattack on contractor Senture knocked out phone support for the Federal Motor Carrier Safety Administration’s registration system. DOT said FMCSA data was not compromised, but the operational impact was immediate for drivers and carriers who depend on the contact center. Source: DysruptionHub

Security Research

1. PAN-OS management interface RCE (limited exploitation observed): Palo Alto Networks published an advisory for CVE-2026-0322, an authenticated management-interface RCE that can yield root privileges. The vendor notes limited exploitation and stresses management-plane access restrictions as key risk reduction. Source: Palo Alto Networks
2. Linux kernel vhost “Vghost” (LPE and guest-to-host): Tencent Zhuque Lab disclosed CVE-2026-74580, describing how stale vhost IOTLB metadata can lead to arbitrary kernel read/write for local users, and in certain virtualization configurations can enable a guest-to-host path via QEMU memory corruption. This is a permissions and device-node exposure story as much as it is a kernel story. Source: oss-security (Openwall)
3. Docker Hub PAT reassignment bug (registry-level impersonation): Docker disclosed and fixed CVE-2026-105445, where account-to-organization conversion could transfer active personal access tokens without rotating the secret or obtaining consent, enabling actions in repos accessible to the target user. Docker says it found no evidence of exploitation after reviewing activity and deactivated transferred PATs (with exceptions by request). Source: BleepingComputer
4. curl HTTP/2 upload UAF advisory ships with 8.23.0: The curl project published CVE-2026-92392, a use-after-free triggered by specific HTTP/2 RST_STREAM handling during uploads. The advisory notes it can be turned into RCE if a malicious server has very precise conditions and knowledge about the target environment. Source: curl project advisory
5. LiteLLM gateway vulns in real-world LLM plumbing: Check Point Research published details on vulnerabilities in LiteLLM (an LLM gateway), including CVE-2026-35029, emphasizing access-control weaknesses that matter when teams expose LLM gateways broadly inside enterprises. If you run “AI infra,” treat it like identity infrastructure. Source: Check Point Blog

Top CVEs

1. CVE-2026-0322: Palo Alto Networks PAN-OS management interface authenticated RCE enabling code execution as root. Vendor reports very limited in-the-wild exploitation and recommends strict management-plane access controls plus rapid patching. Source
2. CVE-2026-74580: Linux kernel vhost stale IOTLB metadata-cache bug enabling local privilege escalation to root, and in some virtualization setups a guest-to-host avenue via QEMU heap overwrite. Fix requires patched kernels and reboot, mitigations include restricting vhost device-node access. Source
3. CVE-2026-105445: Docker Hub incorrect privilege assignment during account-to-organization conversion could reassign an active personal access token to another user without rotating the secret, enabling registry actions as the victim within token scopes. This is a supply-chain adjacent risk with a deceptively “account feature” root cause. Source
4. CVE-2026-92392: curl/libcurl HTTP/2 upload use-after-free that can be exploitable for RCE under specific conditions controlled by a malicious server. Upgrade to curl 8.23.0 or apply downstream patches; remember embedded libcurl in appliances and agents. Source
5. CVE-2026-35029: LiteLLM access-control weakness highlighted by Check Point Research, relevant to organizations deploying LiteLLM as an internal gateway for multiple model backends and toolchains. Validate tenant boundaries, key scopes, and admin surfaces before rolling it “company-wide.” Source

Podcasts & Talks

1. ISC Stormcast (SANS) for Thu Oct 15, 2026: Quick, practical triage for what defenders should watch today. Use it as a sanity check against your own patch and detection priorities before the day escapes into meetings. Listen: SANS ISC
2. Risky Business #855, “ShinyHunters done sowing, enters reaping phase”: Good listen for CISOs who want the narrative glue between headline bugs and the operational reality of exploitation, plus the industry subtext that never fits into a press release. Listen: Risky Business

Final Words

The pattern today is control-plane trust. GitHub repos became a data store, Docker Hub tokens became identity, firewall management became “just another web app,” and kernel device nodes quietly became privilege boundaries. The uncomfortable implication is that your “internal tools” are now a primary attack surface, and attackers are optimizing for whatever has the cleanest path to admin.

This week, do three things:

• Patch PAN-OS for CVE-2026-0322 and verify the management interface is reachable only from a tightly controlled jump host subnet.
• Audit Linux hosts and hypervisors for exposure to CVE-2026-74580, especially permissions and group access on /dev/vhost-*, then schedule kernel updates that include the fix and reboot windows.
• Run a GitHub org fire drill: enforce SSO and strong MFA, rotate any high-value secrets, and scan repositories for accidentally committed personal data and credentials in light of the Meta GitHub incident.

Your turn: If a single developer credential got popped tomorrow, do you know exactly which repos, CI secrets, and production environments that account could reach in under 15 minutes? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone who still exposes a firewall management interface to “just a few” external IPs? Forward them this issue before CVE-2026-0322 turns into a weekend plan. For everyone reading via a forward or the site, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!