The Exploit Bulletin — Saturday, October 10, 2026: 4 issues require action
Saturday, October 10, 2026 — 4 issues require action. If you run none of the software below, you are done.
Affects: SonicWall SMA1000 · Apache Struts · GitHub Actions/GhostAction · AhsayCBS
1. Pre-authentication SSRF in SonicWall SMA1000 Work Place interface reaches internal functionality (CVE-2026-102255)
AUTHENTICATION BYPASS · CRITICAL · CVSS 10.0
BleepingComputer reported on 2026-10-09 that attackers are exploiting the flaw three days after SonicWall's patch, and the Canadian Centre for Cyber Security updated AV26-1017 the same day to note in-the-wild exploitation, so an SMA1000 still on the affected hotfix is exposed to unauthenticated attack right now.
An unintended alternate access path in the SMA1000 Work Place interface lets a remote, unauthenticated attacker make the appliance issue requests on their behalf, reaching internal functionality and performing unauthorized operations. The flaw is rated CVSS 10.0 with scope change, meaning compromise extends beyond the vulnerable component.
Affected: SonicWall SMA1000 (models 6210, 7210, 8200v) 12.4.3-03526 (platform-hotfix) and older (Canadian advisory AV26-1017 lists 12.4.3-03670 and prior); SonicWall SMA1000 12.5.0-02952 (platform-hotfix) and older (Canadian advisory AV26-1017 lists 12.5.0-03082 and prior)
How to Test: On each SMA1000 (6210, 7210, 8200v) check the running platform-hotfix build against the affected ranges (12.4.3-03526 / 12.5.0-02952 and older per the CVE record; 12.4.3-03670 / 12.5.0-03082 and prior per AV26-1017) — anything not on the build SonicWall released on 2026-10-06 under SNWLID-2026-0017 should be treated as vulnerable. Review Work Place interface access logs for unauthenticated requests to unexpected paths and for appliance-originated requests to internal services that no user session explains; investigate any such activity since 2026-10-06 as a possible compromise.
How to Patch: Apply the SMA1000 platform-hotfix SonicWall released on 2026-10-06 under SNWLID-2026-0017 for the 12.4.3 and 12.5.0 branches (the dossier does not give the fixed build numbers; take them from that advisory). Until the hotfix is applied, remove the Work Place interface from direct internet reachability.
Evidence: VulnCheck KEV · Canadian Centre for Cyber Security AV26-1017 Update 1: exploited in the wild · BleepingComputer: SMA1000 flaw now exploited in attacks
2. Dynamic Method Invocation method: prefix expression injection in Apache Struts 2.3 enables remote code execution (CVE-2016-3081)
CISA KEV (due 2026-10-11) · REMOTE CODE EXECUTION · CRITICAL · CVSS 8.1
CISA added this ten-year-old flaw to KEV on 2026-10-08 with a 2026-10-11 remediation deadline, alongside advisory AA26-281A on Chinese government-linked actors, and public exploit code (Exploit-DB 39756, Metasploit struts_dmi_exec) means any remaining Struts 2.3 app with Dynamic Method Invocation enabled is trivially compromisable.
When Dynamic Method Invocation is enabled, a request using the method: prefix can carry a malicious expression that Struts evaluates on the server, letting an unauthenticated attacker execute arbitrary code on the application host. Affects Struts 2.3.20 through 2.3.28 (except 2.3.20.3 and 2.3.24.3).
Affected: Apache Struts 2.3.20 through 2.3.28, except 2.3.20.3 and 2.3.24.3
How to Test: Inventory Java web applications for the struts2-core library and confirm its version is outside the 2.3.20–2.3.28 range (or is 2.3.20.3 / 2.3.24.3 / 2.3.28.1); check your Struts configuration for whether Dynamic Method Invocation is enabled. Review web server and application access logs for action requests containing a method: prefix with unexpected expression content, and treat any such hits on an unpatched instance as a potential compromise requiring host forensics.
How to Patch: Upgrade to Apache Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 (Apache states no backward-compatibility issues are expected). If the upgrade must wait, disable Dynamic Method Invocation, or implement your own ActionMapper based on the source of the recommended Struts versions as the S2-032 advisory describes.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA AA26-281A (2026-10-08) on Chinese government-linked actors · Exploit-DB 39756
3. GhostAction returns: hijacked maintainer accounts push secret-stealing "security-audit.yml" workflow into hundreds of repos
SUPPLY-CHAIN COMPROMISE · CRITICAL
The workflow runs on push and harvests CI/CD and cloud secrets from whole git histories, so any repository or fork that received it since 8 October has already leaked long-lived tokens that attackers can use for downstream package and image publishing this week.
On 8 October 2026 the GhostAction operators took over two high-profile open-source maintainer accounts — Takashi Kitao (pyxel, 18.4k stars) and Henry Wu/henrywoo (original author of Uber's athenadriver) — and in two automated bursts committed a malicious GitHub Actions workflow to 345 repositories (27 repos from 13:20 UTC, then 318 repos in 16 minutes, 21:10–21:26 UTC). The fake "security audit" workflow exfiltrates GitHub Actions secrets, cloud credentials and secrets mined from the entire git history of each repository; as of 9 October Socket counted more than 500 GitHub accounts that committed the workflow across tens of thousands of repositories.
Affected: Repositories under the compromised accounts Takashi Kitao (pyxel author) — 27 repositories pushed from 13:20 UTC 2026-10-08; Repositories under henrywoo (athenadriver author) — 318 repositories pushed 21:10–21:26 UTC 2026-10-08; Any repository containing an attacker-added .github/workflows/security-audit.yml (500+ accounts, tens of thousands of repos per Socket)
How to Test: Search every org and personal repository (including forks and archived repos) for commits added since 2026-10-08 that create or modify a workflow named security-audit.yml or any workflow that reads ${{ secrets. }} / iterates git history and POSTs to an external host; cross-check the GitHub Actions run history and the org audit log (repo.add_member, workflows. , git push events) for runs of such a workflow and for pushes attributed to the compromised maintainer accounts, and review cloud provider logs for use of CI credentials from unfamiliar IPs after that date.
How to Mitigate: Delete the malicious workflow and any attacker commits, then rotate every secret the workflow could reach — repository and organization Actions secrets, OIDC-less static cloud keys, registry/publish tokens (npm, PyPI, Docker), signing keys and any credential ever committed to git history — revoke PATs, SSH keys and OAuth/GitHub App grants on the affected maintainer accounts, enforce hardware MFA plus required reviews on workflow changes, and pin/limit GITHUB_TOKEN permissions to read-only by default.
Evidence: StepSecurity: GhostAction Returns — malicious security-audit.yml workflows mine credentials from entire git histories · The Hacker News: credential-stealing GitHub Actions workflows planted in tens of thousands of repositories
4. Unauthenticated API authentication bypass in AhsayCBS chained to webshell deployment (CVE-2026-105133)
AUTHENTICATION BYPASS · HIGH · CVSS 6.9
Huntress published on 2026-10-08 (corroborated by BleepingComputer, The Hacker News and SecurityWeek on 2026-10-09, when VulnCheck also added the CVE to its KEV) that attackers are chaining this authentication bypass with CVE-2026-105134 to drop webshells and XMRig miners on reachable AhsayCBS servers, so a team that leaves its console exposed is handing over its backup server.
A flaw in the checkSysPwd function of the AhsayCBS API (com/ahsay/obs/api/ApiStructsAction.java) lets a remote, unauthenticated attacker manipulate the random argument to bypass authentication to the backup management server. Attackers are chaining it with the CVE-2026-105134 OS command injection to plant webshells and XMRig cryptominers on AhsayCBS hosts, giving them control of the backup infrastructure.
Affected: AhsayCBS 10.3.0; AhsayCBS 10.3.1; AhsayCBS 10.3.2
How to Test: Check the AhsayCBS version in the CBS web console or installation; versions 10.3.0, 10.3.1 and 10.3.2 are listed as affected. Review web server and API access logs for unexpected requests to the API handled by ApiStructsAction / checkSysPwd, especially with unusual values in the random parameter, and for authenticated-looking sessions from unknown source IPs. Hunt the server for webshells dropped in the web application directories and for unknown processes or binaries posing as Microsoft Edge (the reports describe XMRig miners disguised as Edge), unusual CPU consumption, and outbound connections to mining pools. Treat any such finding as a full compromise of the backup server and its stored credentials.
How to Mitigate: No vendor-confirmed fix is established: the CVE record states that upgrading to AhsayCBS 10.3.4 mitigates the issue, but Ahsay's 10.3.4 release notes (05-Aug-2026) list no security fix for it and Huntress, BleepingComputer and SecurityWeek describe the flaws as unpatched as of 2026-10-09. Upgrade to 10.3.4 as the best available step, but do not rely on it alone: immediately restrict network access to the AhsayCBS web console and API to trusted management addresses or a VPN, remove direct internet exposure, and watch for a vendor advisory explicitly addressing CVE-2026-105133 and CVE-2026-105134.
Evidence: VulnCheck KEV · Huntress: Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer (2026-10-08) · BleepingComputer: Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto (2026-10-09) · The Hacker News: Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge (2026-10-09) · SecurityWeek: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild (2026-10-09)
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
