WAF Weekly: exploited edge zero-days, PDF upload RCE, Oct 9-16

This week belonged to exploited edge software and the file upload path. Palo Alto, Cisco and Collabora shipped patches while attacks were already running, and a critical Ghostscript flaw showed again how a PDF upload can become root on a server. Fastly launched network-layer DDoS defense and detailed AI bot impersonation.

PAN-OS zero-day exploited, CISA orders fixes

Palo Alto Networks patched CVE-2026-0322, a high severity flaw in the PAN-OS management interface that lets an authenticated attacker execute code as root. The company confirmed limited exploitation in the wild. CISA added the bug to its Known Exploited Vulnerabilities catalog and ordered federal agencies to mitigate by October 17. Fixes cover PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2.

The WAFplanet angle: the management interface is the part of the box that no WAF rule can cover. This is the third week in a row of management plane attacks after Check Point, NetScaler and F5. Restrict management access to trusted IPs and treat edge appliances as assets behind their own controls.

Cisco Secure Email Gateway flaw exploited in the wild

Cisco confirmed attackers are exploiting CVE-2026-76519, a critical bug in Secure Email Gateway. The flaw sits in the Advanced Malware Protection feature and stems from improper handling of email attachments when the File Reputation service is enabled. A crafted email can let an attacker write arbitrary files on the operating system and run commands as root. Exploitation needs the File Reputation service enabled and assigned to a mail policy.

The WAFplanet angle: email gateways parse untrusted content by design, and this flaw lived in the attachment scanning layer that mirrors file upload inspection in web apps. Policy assignment is security: the inspection feature only protects you if it is in the mail flow.

Ghostscript PDF upload becomes unauthenticated RCE

Wordfence disclosed CVE-2026-39919, a critical heap buffer overflow in Ghostscript with a CVSS score of 9.8. A crafted PDF containing a JPEG 2000 image makes Ghostscript write 1,024 bytes into a 256-byte buffer, which the Wordfence Argus team turned into unauthenticated remote code execution on a WordPress test site. The flaw affects Ghostscript 9.21 through 10.07.1, including any system that renders PDF thumbnails through ImageMagick.

The WAFplanet angle: file upload is a classic WAF blind spot because the payload lives inside an image parser. File type validation and sandboxed rendering matter more than signature rules.

Collabora RCE exploited to backdoor Nextcloud servers

Attackers are exploiting CVE-2026-110447, a critical command injection in the Collabora Online built-in CODE Server app for Nextcloud. A malicious request to the proxy.php endpoint triggers OS command injection without authentication, as long as the built-in CODE server is stopped. Exploitation began in mid-September, roughly a month before the advisory and CVE were published. Administrators reported PHP webshells hunting for password databases, credential manager artifacts and cryptocurrency wallets, with some ransomware activity reported. The fix shipped in version 26.4.303 on September 11.

The WAFplanet angle: the gap between public fix and CVE publication keeps growing, so signature-based defenses lag reality. A rule cannot block a vulnerability it cannot name. This argues for update automation and app-layer controls that do not depend on CVE metadata.

Fastly launches Network Protect

Fastly introduced Network Protect, a hardwareless Layer 3 and Layer 4 DDoS defense running on its global network. The service promises inline protection with global capacity and no traffic detours, positioned alongside Fastly's WAF and bot management products.

The WAFplanet angle: DDoS defense and WAF protection keep converging at the edge. Network-layer shielding is becoming an edge platform feature rather than separate hardware, which changes how buyers compare WAF providers.

Fastly research: AI bot cosplay at 6.3 million requests

Fastly found more than 6.3 million requests in a single day impersonating AI bots while hunting for .env files, Git metadata, credentials and other private files. The traffic came from nearly 10,200 unique IP addresses cycling through about a dozen AI bot identities against a 96-file wordlist, mostly from one campaign on a single cloud provider. Fastly does not trust the User-Agent header. It checks whether the connecting address belongs to the vendor the bot claims to be, and ships WAF rules that block impostors.

The WAFplanet angle: a User-Agent string is not identity. Bot management that verifies source IP ranges beats pattern matching on headers.

Also notable

• Microsoft shipped its largest Patch Tuesday set, over 1,400 fixes including a Windows Shell zero-day already used in attacks: csoonline.com
• NETSCOUT recorded more than 9.1 million DDoS attacks in the first half of 2026, up nearly a quarter year over year, with attacks above 1 Tbps or 1 Gpps up 1,286 percent: helpnetsecurity.com

WAFplanet take

The pattern this week is management planes and parsers. Attackers go where the logic lives: management interfaces, attachment scanners, PDF renderers and office app starters. A WAF still earns its place, but it loses when the flaw sits behind the application boundary. The growing fix-to-CVE gap rewards patch automation and source-verified bot management over waiting for signatures.

We also read

• Wordfence Intelligence weekly report, 655 vulnerabilities across 406 plugins and 100 themes: wordfence.com
• Wordfence on a second-order SQL injection in Backuply affecting 600,000 WordPress sites: wordfence.com
• Prophaze on nine API security features SaaS applications need in 2026: prophaze.com
• Sophos on intent-based access control without reading minds: sophos.com
• Sucuri on what a 500 Internal Server Error means and how to fix it: blog.sucuri.net
• Sucuri on encryption and how it protects your website: blog.sucuri.net