Today’s common thread is control planes. If it runs the helpdesk, the email perimeter, or your AI gateway, attackers treat it like the keys to the building.

Today's Top 5

1. 1.4M patients exposed: Central Ohio Primary Care says a cyber incident may have exposed SSNs and PHI for about 1.4 million people, and the review is still ongoing. Source
2. BeyondTrust zero-day playbook: Mandiant details how ARMORY CASTLE exploited BeyondTrust Remote Support, dropped the SAWFLY web shell, and went hunting for credential vault material, which is the part most defenders miss. Source
3. LiteLLM gateway takeover: Check Point says two LiteLLM bugs can be chained into ugly outcomes, including SSRF that turns your gateway into a request cannon pointed at places it should never reach. Source
4. Cisco email gateways exploited: Cisco warned of active exploitation of a Secure Email Gateway bug, and it is the kind of “edge appliance” issue that becomes a weekend fire drill the moment scanning ramps up. Source
5. AhsayCBS exploitation chain: Bitdefender published incident-backed detail on active exploitation of an AhsayCBS chain, with the reminder that patching the entry point is not the same thing as evicting what got planted. Source

Why today matters: We are watching exploitation and impact drift upward in the stack. Attackers want the systems that broker access, inspect email, and front your AI workloads, because one foothold there turns into many downstream compromises with clean-looking logs.

XERJ Corpus Hub: If BeyondTrust Remote Support (CVE-2026-102764) is in your estate, an AI agent loading splunk-security-content can draft SPL detections for the web shell and tunneling indicators described in the writeups, then package them into a deployment-ready hunt in minutes. Get it free at hub.xerj.org.

Now the rest of the day’s damage, with receipts.

Data Breaches

1. Central Ohio Primary Care says ~1.4M patients potentially impacted: The Ohio physician group said an August cybersecurity incident may have exposed patient and employee information, including potentially Social Security numbers and limited health-related data. The organization says the incident has been contained and investigation is ongoing. Source: Spectrum News 1
2. Burnaby School District ransomware, files accessed: Burnaby Schools says an unauthorized party gained access to district systems in a ransomware attack and may have accessed certain files, putting employee personnel records at risk. This is the kind of “schools are soft targets” incident that becomes a long tail of notifications and cleanup. Source: Burnaby Schools (SD41)
3. BDG Law Group breach notice: BDG Law Group issued notice of a data security incident involving personal information, via a public release. Legal services firms remain a high-value target because they hold the stuff everyone else does not want to store. Source: PR Newswire
4. Ampath Laboratories confirms incident, disputes huge-count claim: Ampath, a major South African pathology group, confirmed it is responding to a cyber incident after a threat actor began publicizing claims of stolen data. The company disputes the scale claimed publicly, which is a familiar move when extortion pressure ramps. Source: Cyber Breaches
5. The Money Store (MLD Mortgage) breach filed with California AG: California’s breach list shows MLD Mortgage Inc. dba The Money Store reported a breach with incident dates in early September and a filing date of October 15. Mortgage files are identity kits, which makes lender incidents uniquely painful. Source: California DOJ breach list

Security Research

1. Mandiant: ARMORY CASTLE exploited BeyondTrust Remote Support: Google Cloud’s threat intel writeup walks through exploitation and post-exploitation on BeyondTrust RS appliances, including web shell activity and credential harvesting. If you run these appliances, assume the actor cares more about secrets than splashy disruption. Source: Google Cloud Blog
2. BeyondTrust advisory BT26-05 for CVE-2026-102764: BeyondTrust published an advisory for a critical RS flaw that can allow remote file operations on affected appliances. Treat this as a “patch plus investigate” moment, not a “patch and forget.” Source: BeyondTrust
3. Check Point Research: LiteLLM gateway vulnerabilities: Check Point describes two LiteLLM vulnerabilities (including SSRF) and why LLM gateways should be assessed like production middleware, not a developer toy. This is the AI tax showing up in vuln management. Source: Check Point Blog
4. Cisco: exploited Secure Email Gateway flaw: SecurityWeek covers Cisco’s warning about active exploitation of a Secure Email Gateway vulnerability. Email gateways are a weird mix of “security product” and “internet-facing parser,” which is exactly why they keep getting farmed. Source: SecurityWeek
5. Bitdefender: AhsayCBS exploitation chain details: Bitdefender’s incident-driven advisory covers an AhsayCBS exploitation chain and stresses responder steps beyond applying the fix. This is a good template for how to write operational guidance. Source: Bitdefender

Top CVEs

1. CVE-2026-102764: BeyondTrust Remote Support critical vulnerability that could allow a remote attacker to perform file operations on an affected appliance. Exploitation has been discussed publicly in the context of ARMORY CASTLE activity, so prioritize patching and appliance review. Source
2. CVE-2026-35029: LiteLLM vulnerability reported by Check Point Research, one of the issues in the LiteLLM gateway set. If LiteLLM sits between internal apps and external LLM providers, treat it as a privilege boundary and inventory exposed endpoints. Source
3. CVE-2026-59823: LiteLLM SSRF vulnerability described by Check Point Research, enabling users to direct the gateway to send requests to attacker-controlled infrastructure. For CISOs, this is about egress control and “what can the gateway reach” as much as patching. Source
4. CVE-2026-76519: Cisco Secure Email Gateway vulnerability with active exploitation reported by Cisco and summarized by SecurityWeek. If you run AsyncOS appliances, validate fixed versions and review exposure and admin access paths. Source
5. CVE-2026-105134: AhsayCBS vulnerability discussed in Bitdefender’s advisory as part of an exploitation chain seen in real incidents. Patch, then hunt for web shells and persistence that may predate the patch window. Source

Podcasts & Talks

1. Smashing Security #488, “How a ransomware negotiator ended up arrested at his own conference”: A good CISO listen because it blends the human side of incident response, law enforcement realities, and the uncomfortable incentives around negotiation. Listen: Smashing Security

Final Words

The quiet shift is that compromise is happening in places your endpoint tooling barely sees. Appliances, gateways, and “helpful” middleware are now the preferred choke points, because one win there turns into many wins everywhere else. The uncomfortable implication: your org chart’s ownership lines are now a bigger risk factor than your patch cadence.

This week, do three things:

• Patch and investigate BeyondTrust Remote Support for CVE-2026-102764, then review appliance logs and vault access patterns described by Mandiant, not just version strings.
• Inventory and patch Cisco Secure Email Gateway for CVE-2026-76519, then restrict management access paths and validate admin auth telemetry for anomalous sources.
• Find every LiteLLM deployment, patch for CVE-2026-35029 and CVE-2026-59823, and enforce egress controls so the gateway cannot reach internal metadata and admin planes.

Your turn: If a breach notice hit tomorrow saying “SSNs plus limited PHI may have been exposed,” do you already know exactly which systems store that combination, or would you be guessing under pressure? Hit reply with your honest answer, or drop a comment on the web version. I read every reply.

Know someone running BeyondTrust Remote Support or any similar internet-adjacent appliance without a real hunting plan? Forward them this issue, it costs 30 seconds and the alternative costs a lot more. For forwarded and web readers: subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!