Good morning!

An exploited Cisco email-gateway flaw leads CISA's Wednesday additions as Microsoft takes down the marketplace behind three phishing kits. Both live at the inbox — one guards it, one floods it.

Here are the 7 things you don't want to miss:

1. 🔒 Four new KEV entries, led by an exploited Cisco email flaw

CISA added four vulnerabilities to its Known Exploited Vulnerabilities list on October 14, led by CVE-2026-76519 in Cisco's Secure Email Gateway, rated 9.8 by Cisco. Two others are in Ahsay's backup software, one in Palo Alto Networks' PAN-OS. Cisco's advisory, published the same day, says its product security team became aware of active exploitation in October. Anyone running this appliance just lost the argument for waiting. (CISA)

2. 🤝 Practice the Thing You Just Read About

Every item above is something you will eventually have to do, not just read about. Threat Road's Cyber Security Labs give you an isolated VM, a guided exercise, and a target that only exists for you to break — Linux fundamentals through hands-on exploitation, in your browser, on your own schedule. No shared infrastructure, no waiting for a lab window, no permission slip. (Threat Road)

3. 🎯 Microsoft takes down the YAM Store phishing marketplace

Microsoft says its Digital Crimes Unit, working with law enforcement partners worldwide, disrupted the developers and infrastructure behind three phishing kits sold through the YAM Store marketplace. The kits are CoGUI, Haozi and Iron Man System; Microsoft puts their output since January at over a billion phishing emails and SMS messages to more than 75,000 organizations. (Microsoft)

4. ☁️ A Nextcloud document-server flaw was exploited before it had a CVE

NVD published CVE-2026-110447 on Wednesday and records it as exploited in the wild since September: command injection in Collabora's built-in CODE server app for Nextcloud, allowing remote code execution. Collabora shipped the fix in 26.4.303 on September 11, and standalone Collabora Online servers are not affected. (NIST)

5. 📦 NGINX's two new releases close five flaws, the oldest from 0.1.29

NGINX shipped 1.31.7 and 1.30.6 on Wednesday with fixes for five vulnerabilities — three memory-corruption bugs, an HTTP/3 request-body injection, and TLS session-ticket forgery. The alias-and-rewrite overflow reaches back to version 0.1.29, and one fix covers a use-after-free open since 0.8.11. (nginx.org)

6. ⚖️ OLVX's alleged operator faces charges in North Macedonia

North Macedonia's Ministry of Interior announced on October 14 that it had filed criminal charges against a 20-year-old it identifies only as E.A., accused of running the OLVX marketplace for stolen data and credentials between 2023 and 2025. The FBI called the case the first cyber operation it has coordinated with North Macedonia. (North Macedonia Ministry of Interior)

7. 🤖 curl fixes an HTTP/2 bug credited to Claude

A use-after-free in HTTP/2 uploads, fixed in curl 8.23.0, affected versions 8.12.0 through 8.22.0. The advisory credits the report to "Luna with Claude, Anthropic" and says turning the bug into remote code execution requires a specific set of conditions. When Claude finds the bug, humans still own the release. (curl)

Bonus. Threat Road Tip Of The Day

Your patch queue probably lists severity first. Sort it once by what is reachable from the internet instead — exposure moves faster than any score, and the top of that list is the work that matters today.

Disclosure: Topic #2 in this newsletter is a promotion for Threat Road's Cyber Security Labs. Nothing else in this issue is sponsored.