Week in Review: Oct 5-11, 2026

Seven days. Ninety-eight zero-days bought at Pwn2Own. Five CVSS 9.8 Cisco patches. A maximum-severity SonicWall flaw exploited inside 72 hours of disclosure. Two ShinyHunters arrests on opposite sides of the world.

Pwn2Own Ireland: $1.26M, 98 zero-days

Pwn2Own Ireland 2026 closed October 9 with $1.26 million paid for 98 zero-day vulnerabilities. Targets: consumer NAS devices, SOHO routers, and enterprise networking gear. Most findings are under the standard 90-day responsible disclosure embargo, meaning patches are not available yet for the majority of what researchers demonstrated. Full coverage.

The practical implication: researchers have working exploits for dozens of consumer-grade and enterprise devices that ship without patches, and vendors have 90 days to fix them. Whether those vendors use the time is a separate question.

Network infrastructure: Cisco NX-OS and SonicWall SMA1000

Cisco patched five CVSS 9.8 flaws in NX-OS on October 9, all remote code execution. NX-OS runs on Nexus data center switches and MDS storage networking hardware. These are infrastructure devices. No confirmed exploitation at publication.

SonicWall CVE-2026-102255: CVSS 10.0, unauthenticated server-side request forgery in SMA1000 remote access appliances. Patch released October 7. Active exploitation confirmed October 9, roughly 72 hours later. SMA1000 has been a consistent target through 2026: two prior zero-days in the same product line were exploited before patches shipped in September. Unpatched SMA1000 instances at the perimeter carried confirmed active exploitation risk from October 9 onward.

CISA KEV: Flax Typhoon and an unpatched active exploit

CISA added five CVEs to the Known Exploited Vulnerabilities catalog last week, all linked to Flax Typhoon infrastructure. Federal remediation deadline: October 11. The deadline has now passed for FCEB agencies. Non-government operators: these are confirmed exploited in the wild.

AhsayCBS: the backup management platform is being actively exploited as of October 10, and no patch exists. Compensating control guidance in the linked coverage.

Ransomware: two ShinyHunters actions, one Qilin arrest

Law enforcement had a busy week on organized cybercrime.

ShinyHunters: a suspect was arrested in Jordan on October 6 in cooperation with U.S. law enforcement. Then, a second arrest connected to a breach of FBI systems was announced October 10. Two individuals, separate jurisdictions, same week. Whether this represents coordinated pressure or coincident timing is not stated publicly by the agencies involved.

Qilin ransomware: Germany arrested a core member after extradition proceedings involving Japan. Attribution to the Qilin operation is confirmed by German authorities.

IDCF Cloud: a ransomware attack on the Japanese cloud provider knocked government-contracted services offline. Operator of record confirmed the incident October 9.

Also this week

Exchange Server CVE-2026-96940 (October 6): out-of-band patch for a privilege escalation flaw that lets a lower-privilege account read any mailbox on the server. Microsoft issued this fix outside the regular Patch Tuesday cycle.

Perforce P4Search RCE and auth bypass (October 6): critical flaws in Perforce’s containerized search infrastructure. Affects organizations running P4Search in Kubernetes or Docker environments.

CERT-UA documented a campaign October 7 in which attackers hijacked 100-plus legitimate websites to serve fake Cloudflare verification pages, delivering LunexStealer via a ClickFix-style social engineering technique. CERT-UA’s advisory names specific indicators.

openapi-typescript-codegen CVE-2026-108551: CVSS 9.8 code injection in the widely-used API client generation tool. Supply-chain risk for any build pipeline that runs this package against untrusted OpenAPI specs.

FusionPBX OS command injection: authenticated attackers can inject OS commands via caller ID handling. VoIP infrastructure. Patch available.

The number

The CVSS 10.0 SonicWall exploitation timeline is the operational data point of the week: patch released Tuesday, exploitation confirmed Friday. That is 72 hours for an active zero-day in a product with a confirmed attacker history. 72 hours. That is the gap between patch availability and confirmed active exploitation for a product with a documented 2026 attacker history.