Cyber security
Cybersecurity
Superyachts
Superyacht Cyber Intelligence: Remote Access Gateways Under Attack (Issue #019)
Matt
CyIntel - Bi-weekly briefing
The latest on what is being attacked, covering 8 to 25 October 2026. Plain English first. Technical detail for whoever looks after your onboard systems sits under each section.
Issue: 25 October 2026 · Covers: 8 Oct to 25 Oct · Snapshot, check vendor pages for later changes
TL;DR
The short version
Don't have the exact product named? Check the nearest equivalent. If it has not been updated since 29 July, treat it as out of date.
1Remote access and VPN gateways. Palo Alto GlobalProtect: confirm the May fix is installed, end all active VPN sessions and check logs for odd sessions, because ransomware gangs are now using this flaw. Ivanti Connect Secure or BeyondTrust Remote Support: patch now, both are under attack. A different VPN or remote support tool (Fortinet, SonicWall, Cisco, AnyDesk, TeamViewer): ask when it was last updated and who still has remote access.
2NAS drives, routers and firewall admin pages. A new PHP flaw (PHP2Shell) hits many web admin pages. QNAP: install the 23 October update. Synology: update the PHP packages. Peplink: update InControl Virtual Appliance to 2.14.4. Palo Alto firewalls: hotfixes are due 26 to 30 October. Another NAS, router or firewall: check when it was last updated and keep its admin page off the internet, crew Wi-Fi and guest Wi-Fi.
3Email security appliances. Cisco Secure Email Gateway or Fortinet FortiMail: both are being exploited, so ask your IT provider to apply the fix or workaround today. Cloud-based mail filtering is updated by the provider. A different on-site mail filter: check when it was last updated.
4Backups. Veeam Backup and Replication 12: install patch 12.3.2 P4 or move to version 13. A different backup tool: check when it was last updated. Either way, keep one copy off the main network and ask when a restore was last tested.
5Laptops, phones and iPads. Restart Chrome and Edge to pick up the October fixes, install the October Windows updates, and update iPhones, iPads and Macs to iOS and iPadOS 26.7.1 or macOS 26.7.1. Android, Linux or other makes: install whatever updates are waiting. Crew devices count too.
6Bridge, Starlink and satcom. Still no vendor fix for the Starlink Router Gen 3 management flaw or the Furuno FA-50 AIS transponder. Keep their admin access away from crew and guest networks. Other satcom, AIS and bridge kit: confirm none of it can be reached from the internet.
Not sure whether any of this applies to your vessel? Contact us and we will check it with you.
Priority 1 of 6
Remote access and VPN gateways
Exploited Critical
In plain English
These are the doors into the yacht network from shore, and attackers are walking through several of them at once. The Palo Alto GlobalProtect VPN flaw first appeared in May, but this week Palo Alto's own researchers named two ransomware gangs that are using it to get past multi-factor login. Ivanti Connect Secure and BeyondTrust Remote Support, both used for remote access and remote support, are also under attack. Palo Alto firewalls and Fortinet FortiOS each have a further flaw that is being exploited.
What to do
- Ask your onboard technical person which VPN, remote support and firewall products are in use and whether any of them can be reached from the internet.
- If you use Palo Alto GlobalProtect, check it is patched and ask for all VPN sessions to be ended and the logs reviewed.
- Ivanti Connect Secure and BeyondTrust Remote Support: apply the vendor patch this week, and sooner if they are internet-facing.
- A different VPN or remote access product: check when it was last updated and who has an account.
- Contact IT support if unsure.
+Technical detail for your onboard technical person Tap to open / close ▾
| Reference | Issue | Date | Fix and status |
|---|---|---|---|
| CVE-2026-0257 | Palo Alto PAN-OS and Prisma Access GlobalProtect authentication bypass. Vendor rates it High, exploit maturity Attacked. Unit 42 named Qilin and Inc ransomware operators in a threat brief updated 19 Oct, with Veeam targeted after VPN access. | 19 Oct (update) | Fixed in the PAN-OS builds listed in the Palo Alto advisory (for example 12.1.4-h6, 11.2.10-h7, 11.1.13-h5, 10.2.16-h7). Disable authentication override cookies if unpatched. |
| CVE-2026-0322 | Palo Alto PAN-OS management interface authenticated code injection to root. CVSS 4.0 base 8.6. Exploit maturity Attacked, very limited. Not on Cloud NGFW or Prisma Access. | 14 Oct | Fixed builds in each supported train (for example 12.2.4, 11.2.13-h3, 11.1.16-h3, 10.2.18-h12). No workaround. Keep management off untrusted networks. |
| CVE-2026-104935 | Ivanti Connect Secure authentication bypass to command execution, CVSS 8.6. Zero-day, in CISA KEV. Affects 25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior. | 13 Oct | Confirm fixed build in the Ivanti advisory. Version 22.8 reaches end of life on 31 Jan 2027. |
| CVE-2026-102764 | BeyondTrust Remote Support improper origin validation, CVSS v4 9.3, allowing file upload without credentials. In CISA KEV. All versions up to 26.2.3. | 16 Oct | Patch BT26-05-RS. SaaS patched 9 Oct. Self-hosted needs manual patching unless auto-update is on. |
| CVE-2025-61624 | Fortinet FortiOS CLI path traversal by an authenticated admin, CVSS 6.5. In CISA KEV and reported as a malware persistence step. Also FortiProxy, FortiSwitchManager, FortiPAM. | 16 Oct | Fixed in FortiOS 7.6.5 and 7.4.10 or later (FG-IR-26-122). Check other branches. |
| CVE-2026-102255 | SonicWall SMA1000 pre-authentication SSRF, CVSS 10.0, plus three further flaws (SNWLID-2026-0017). Carried forward from the 6 Oct advisory. | 6 Oct | Fixed in 12.4.3-03670 and newer, and 12.5.0-03082 and newer. |
Actions: inventory every VPN, remote support tool and firewall and record firmware versions. Confirm management interfaces are not internet-facing. After patching GlobalProtect, end all sessions, rotate local admin and VPN credentials, and hunt for unexpected sessions, new admin accounts and lateral movement to vCenter, ESXi, domain controllers and Veeam. Apply the Ivanti, BeyondTrust and SonicWall fixes under a planned change.
Priority 2 of 6
NAS drives, routers and firewall admin pages (PHP2Shell)
Critical Watch
In plain English
Two serious flaws in PHP, the web language behind many admin pages, let an attacker run commands on a device without logging in. QNAP and Synology NAS drives, Peplink routers and the management page of Palo Alto firewalls are all affected. No attacks on the vendors' own products have been confirmed, but one attempt was reported before the fix was public and test code exists, so treat it as urgent.
What to do
- Ask your onboard technical person whether you have a QNAP or Synology NAS, a Peplink or Pepwave router, or a Palo Alto firewall.
- Make sure none of their admin pages can be reached from the internet, guest Wi-Fi or crew Wi-Fi. Use a VPN for remote access.
- Install the updates: QNAP QTS and QuTS hero (23 Oct build), Synology PHP packages, Peplink ICVA 2.14.4. Palo Alto hotfixes are due 26 to 30 October.
- A different NAS, router or firewall: check when it was last updated and whether the maker has issued a PHP fix.
- Contact IT support if unsure.
+Technical detail for your onboard technical person Tap to open / close ▾
| Reference | Issue | Date | Fix and status |
|---|---|---|---|
| CVE-2026-109618 CVE-2026-109619 | PHP out-of-memory handling and stale memory references leading to unauthenticated code execution. CVSS 4.0 9.2. Fixed in PHP 8.2 to 8.5 (8.5.12) on 21 to 22 Oct. | 22 Oct | No exploitation confirmed by the vendors. Palo Alto and QNAP state they know of no attacks on their products. Not in CISA KEV at time of writing. |
| QNAP QSA-26-18 | QTS 5.2.11 and earlier, QTS 6.1.0, QuTS hero, QuTScloud. Note Station 3, QNE, QVR Surveillance (ARM32) and TVR OS also affected. | 22 Oct (rev 24 Oct) | QTS 5.2.11.3661 and 6.1.0.3656 build 20261023 resolved. Others fix pending. PHP inside containers is not covered. |
| Synology SA-26:14 | PHP 7.3 to 8.4 packages, Mail Station, Calendar. Rated Critical. DSM's built-in PHP is stated not to be externally exposed. | 22 Oct | Patched PHP 8.2 and 8.4 packages in Package Center. |
| Peplink advisory | InControl Virtual Appliance 2.14.3 and earlier (port 4443). Balance and MAX routers on 8.6.1 GA with Edge Computing enabled. Hosted InControl 2 not affected. | 22 Oct | ICVA 2.14.4. Balance and MAX special firmware 8.6.1s042. |
| Palo Alto PHP2Shell | PAN-OS 10.2, 11.1, 11.2, 12.1, 12.2 and Panorama, management web interface only. Not GlobalProtect, Clientless VPN or Captive Portal. | 24 Oct | Hotfixes estimated 26 to 30 Oct (for example 11.2.10-h16, 12.2.4-h1). Limit management access to trusted IPs until then. |
Actions: list every NAS, router and web-managed appliance, then close WAN exposure, port forwards and UPnP. Move management to a VLAN or VPN. Patch as vendors release. Rebuild containers that bundle PHP from patched images. Review admin logins and scheduled tasks, because updates do not remove an existing intrusion.
Priority 3 of 6
Email gateways and security management consoles
Exploited Critical
In plain English
Two on-site email security appliances are being attacked. Both sit in front of the mailbox, so a compromise can expose mail and give attackers a foothold. Separately, a critical flaw in Fortinet's security monitoring product FortiSIEM now has public test code, and SonicWall has fixed two flaws in its on-premises firewall management console.
What to do
- Ask your IT provider whether you run a Cisco Secure Email Gateway or a Fortinet FortiMail, on the yacht or at the management company.
- If you do, ask for the fix or workaround to be applied now.
- If you use FortiSIEM or SonicWall's on-premises management console, ask for the update and for access to be limited to a management network.
- A different mail filter or monitoring tool: check when it was last updated. Cloud services are updated by the provider.
- Contact IT support if unsure.
+Technical detail for your onboard technical person Tap to open / close ▾
| Reference | Issue | Date | Fix and status |
|---|---|---|---|
| CVE-2026-76519 | Cisco Secure Email Gateway unauthenticated arbitrary file write via crafted attachment, CVSS 9.8, leading to root. Needs File Reputation enabled. Cisco states active exploitation. | 14 Oct | Fixed in 15.5.5-014 and 16.5.0-780. No fixed build for 16.0, migrate. No workaround. |
| CVE-2026-104286 | Fortinet FortiMail unauthenticated arbitrary file write, CVSS 9.8, zero-day in CISA KEV (FG-IR-26-175). FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9. | 1 Oct | Workaround: disable IBE and block internet access to management. Fixes planned in 8.0.2, 7.6.7 and 7.4.9. Check the advisory for current status. |
| CVE-2026-106173 | Fortinet FortiSIEM 7.5.0 unauthenticated code execution, CVSS 9.8. Public proof-of-concept. Reported via Singapore CSA alert AL-2026-153. Exploitation unconfirmed. | 22 to 23 Oct | Update to 7.5.1 or later. Check the Fortinet PSIRT page for the advisory ID. |
| CVE-2026-96540 CVE-2026-100232 | SonicWall Network Security Manager on-prem access control flaw (CVSS 8.8) and command injection (CVSS 7.2), SNWLID-2026-0018. No evidence of exploitation per SonicWall. | 14 Oct | Upgrade NSM On-Prem to 4.4.0 or later. SaaS not affected. |
Actions: find appliances and versions, apply workarounds immediately where no fix exists, restrict management interfaces to a management VLAN or VPN, and check mail logs and appliance file systems for unexpected files. Escalate if a Cisco or Fortinet appliance shows signs of compromise.
Priority 4 of 6
Backups
Critical Watch
In plain English
Backups are the last line of defence against ransomware, and attackers go for them early. Veeam has fixed a critical flaw in Backup and Replication 12 that lets a user with very limited backup access take over the backup server. Palo Alto's researchers also report ransomware crews moving from a hijacked VPN straight to Veeam servers.
What to do
- Ask whether the yacht uses Veeam Backup and Replication version 12.
- If so, ask for patch 12.3.2 P4 or a move to version 13, and check the backup server is not reachable from guest or crew Wi-Fi.
- A different backup tool: check when it was last updated.
- Keep one copy off the main network and ask when a restore was last tested.
- Contact IT support if unsure.
+Technical detail for your onboard technical person Tap to open / close ▾
| Reference | Issue | Date | Fix and status |
|---|---|---|---|
| CVE-2025-64393 CVE-2026-93026 CVE-2025-64392 | Veeam Backup and Replication 12: remote code execution on the backup server by an authenticated low-privileged Backup Viewer (CVSS v4 9.4), plus two lower-severity flaws. Exploitation not stated by the vendor. | 6 Oct | Fixed in 12.3.2 P4 (12.3.2.4934). Version 13 not affected. Version 12 support ends 28 Feb 2027. |
| CVE-2023-27532 | Older Veeam credential-exposure flaw reported by Unit 42 as chained with the GlobalProtect bypass in ransomware intrusions. | 19 Oct (report) | Confirm the Veeam server is fully patched, not reachable from user networks, and has MFA on admin accounts. |
Actions: inventory Veeam servers and build numbers, remove unused Backup Viewer accounts, isolate the backup server and Enterprise Manager from user and guest networks, patch under a planned change and confirm an offline or immutable copy has been test-restored.
Priority 5 of 6
Laptops, phones and iPads
Exploited
In plain English
This fortnight's updates for Windows, Chrome and Apple include flaws that are already being used in attacks. A Windows flaw lets a malicious file dodge the warning Windows normally shows. Apple says an iPhone and iPad flaw may have been used in targeted attacks. Chrome fixed dozens of serious problems, and Edge follows Chrome.
What to do
- Install the October Windows updates on all yacht-managed laptops and PCs.
- Update iPhones and iPads to 26.7.1 and Macs to macOS 26.7.1 or Sequoia 15.8.1, starting with the owner and senior crew.
- Restart Chrome and Edge so the update takes effect.
- Other makes: install any pending updates.
- Contact IT support if unsure.
+Technical detail for your onboard technical person Tap to open / close ▾
| Reference | Issue | Date | Fix and status |
|---|---|---|---|
| CVE-2026-96951 | Windows Shell command injection bypassing Mark of the Web (CVSS 8.8). Exploited in the wild, in CISA KEV. | 13 Oct | Fixed in the October 2026 Patch Tuesday updates. |
| CVE-2026-86950 | Apple CoreGraphics out-of-bounds write leading to code execution. Apple reports possible exploitation in targeted attacks. | 28 Sep | Fixed in iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. |
| CVE-2026-110152 CVE-2026-110922 and others | Chrome 155: 37 fixes on 13 Oct including seven Critical, then a further Critical Prerender bug. Exploitation not stated. | 13 and 15 Oct | Chrome 155.0.8059.84 or later. Edge and other Chromium browsers follow. |
Actions: push the Windows, Apple and browser updates through MDM, WSUS or Intune and check compliance. Keep SmartScreen and Mark of the Web enabled by policy and quarantine risky attachment types at the mail gateway.
Priority 6 of 6
Carried forward: Starlink, bridge and satcom
Watch
In plain English
Nothing new here this fortnight, but these items from earlier briefings still have no vendor fix, so they stay on the list. The Starlink Router Gen 3 management interface and the Furuno FA-50 AIS transponder both need to be kept away from crew and guest networks. A joint US advisory also warns that internet-exposed Siemens PLCs, common in alarm and engine room systems, are being targeted.
What to do
- Keep Starlink router admin access away from crew and guest networks and check the Starlink app for updates.
- Confirm bridge, AIS, alarm and engine room systems cannot be reached from the internet.
- If you use a Furuno FA-50, plan its replacement.
- Other satcom or bridge makes: ask the supplier when the firmware was last updated.
- Contact IT support if unsure.
+Technical detail for your onboard technical person Tap to open / close ▾
| Reference | Issue | Date | Fix and status |
|---|---|---|---|
| CVE-2026-19918 | Starlink Router Gen 3 local gRPC management interface access control flaw. Public proof-of-concept. | 15 Aug | No vendor fix reported at last check. Isolate admin access. |
| CVE-2026-59769 CVE-2026-67578 | Furuno FA-50 Class B AIS transponder hard-coded credentials and missing authentication. End of life. | 26 Aug | No fix. No exploitation reported at last check. |
| AA26-231A | Joint NSA and CISA advisory on active threats to internet-exposed Siemens SIMATIC S7 PLCs. | 19 Aug | Isolate PLCs from IT networks and remove internet exposure. |
Actions: inventory the bridge and OT network, confirm segmentation from crew and guest networks, scan for exposed services, and where there is no fix, isolate the device and plan replacement. Status was last checked in earlier issues, so confirm with vendors.
How we rate items
Exploited. The vendor or CISA's Known Exploited Vulnerabilities list confirms attacks in the wild.
Critical. The vendor or CVSS rates it critical. This says nothing about whether attacks are happening.
Watch. No confirmed attacks, but the item is on kit that matters, or no fix exists.
Sources. Vendor security advisories, CISA Known Exploited Vulnerabilities catalogue and CISA advisories. Where a third-party report disagrees with the vendor, we follow the vendor. This briefing is a snapshot as of 25 October 2026. Fix status can change, so check vendor pages before acting.
Welcome to our bi-weekly cyber briefing for superyacht crew, where I share some of the major developments, lessons learned and helpful guides to help you improve onboard cybersecurity. Make sure to follow my LinkedIn page and Anchorpoint's LinkedIn page to receive updates on the future of superyacht cybersecurity!
To receive these and other curated updates to your inbox on a regular basis, please sign up for our email by clicking here.
