Thursday, October 8, 2026

Top story

The FBI and U.S. Secret Service say FortiBleed has compromised more than 86,000 Fortinet FortiGate firewalls and SSL VPN gateways in 194 countries by reusing leaked or weak credentials, not via one new Fortinet bug. SOCRadar has verified 86,644 devices; operators add admin accounts, lock out legitimate admins, and sell access to ransomware affiliates. Treat exposed FortiGate and SSL VPN portals as actively targeted until credentials are rotated and rogue accounts removed.

Exploitation & threats

• CVE-2026-21589, a critical unauthenticated file-access flaw in self-hosted Jira, Confluence, Bitbucket, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye, was hit on honeypots within two hours of a public proof of concept.
• CyberXero, a Russian-speaking initial-access broker, used WordPress exploitation, Cobalt Strike, and Claude Code agents against Ukrainian energy targets, including 564,073 subscriber records from a Kharkiv heating provider. An exposed server held more than 90,000 files (CVE-2026-4815).
• PoeLLM has infected more than 3,000 servers, mainly in the United States and Western Europe, since at least April 2026, mining with XMRig after breaking into exposed LiteLLM, Ollama, Gotenberg, and Gitea services and hiding command-and-control in a GitHub poem.
• Unit 42 says DPRK-linked actors resolve npm-worm command-and-control via Web3 smart contracts. ChainDrop, linked to Shai-Hulud, hit more than 400 packages, including keyv and cacheable-request.
• SOCRadar reported a large NetScaler exploitation operation around CVE-2026-88771 after Citrix’s September 27 bulletin; published severity and scope are incomplete. CISA added nothing to the KEV in the last 24 hours.
• Jordan detained suspected ShinyHunters leader Saif Al-din Khader (“Rey”), reportedly cooperating with the FBI, while the group was extorting Boeing spin-off Jeppesen ForeFlight.

Patch priorities

• CVE-2026-21589 (CVSS 9.3): patch the eight affected self-managed Atlassian products; a public PoC is already being used.
• CVE-2026-102255 (CVSS 10): pre-auth SSRF on SonicWall SMA1000 models 6210, 7210, and 8200v (12.4.3-03526, 12.5.0-02952, and earlier). No confirmed exploitation; SonicWall advises 12.4.3-03670 or the matching fixed release.
• CVE-2025-64393 (CVSS 9.4): authenticated Backup Viewer remote code execution in Veeam Backup & Replication 12 through 12.3.2.4854. Install 12.3.2 P4 (build 12.3.2.4934); version 13 is unaffected.
• CVE-2026-104286 (CVSS 9.8, EPSS 2.2%, public PoC): path traversal in FortiMail 8.0.0–8.0.1 and 7.6.0 and further listed builds — patch affected mail gateways.
• CVE-2026-88779 (CVSS 8.7): move NetScaler ADC and Gateway off builds before 14.1-73.41 and 13.1-64.28, including listed FIPS builds.
• CVE-2026-63688 and CVE-2026-63692 (both CVSS 10): missing authentication in Dell Container Storage Modules before 1.18.0 — upgrade to v1.18.0 or later.

Breaches & incidents

• Denmark’s Central Person Register: a supplier’s credentials drove more than 14 million searches over about 10 days in September, returning records on about 8.8 million people. Protected names and addresses were not affected.
• Arizona courts: a September 24 phishing click led to copied FARE backups with names, Social Security numbers, and case numbers for more than 1.3 million people.
• Double Counter said an October 4 breach through an unused OVH server still exposing Metabase exposed tens of millions of Discord IDs and IPs and about one million emails.
• EY says a tax-platform intrusion from March 28 to April 12, 2026, exposed personal and financial data linked to Goldman Sachs wealth-management clients, Man Group, and Tishman Speyer investors.
• ASOS (16.5 million active customers) confirmed a breach after an October 6 app notice and a leak threat from a group calling itself Xuanye Group; names and contact details may have been accessed.
• Attackers compromised the .gh, .sl, and .as registries and obtained later-revoked HTTPS certificates for Google and YouTube names (12 certificates logged September 22–27). Google said its own systems were not breached.
• Leak sites named 30 victims in 24 hours, including T-Mobile and Gate, University of Rostock, CyrusOne (373,460 records), Champaign Unit 4 School District, and Qatar National Import & Export. Those are leak-site posts, not separately confirmed here.

AI

• OpenAI is rolling GPT-6 with Intelligent UI to more than 1.2 billion weekly ChatGPT users, mixing answers with graphics, buttons, forms, and charts. Plus, Pro, Business, and Enterprise get GPT-6 Sol first; Go and free users get GPT-6 Luna.
• Mistral previewed Le Chonk (Mistral Large 4), a freely available 1-trillion-parameter open-weight model aimed at coding, cyberdefense, manufacturing, finance, and electrical engineering, with a final release expected this month.
• Claude Haiku 5.5 prices prompts up to 100,000 tokens at $0.10 per million input tokens and $0.50 per million output tokens, about 75% less than Haiku 4.5.
• Anthropic expanded vetted Claude cyber access into Defense, Red Team, and Specialized tiers. Project Glasswing reported at least 129,000 verified flaws from April to July 2026, more than 33,000 critical or high; VulnCheck found only two of 300 sampled flaws exploited.
• NVIDIA and Microsoft showed RTX Spark Windows PCs (Blackwell GPU, Grace CPU, up to 128GB unified memory) and made Execution Containers generally available for OS-controlled agents.

Watchlist

• FortiBleed is still active, with INC/Lynx and Payload ransomware affiliates reportedly using stolen Fortinet logins.
• Atlassian exploitation began within a day of patches; on Crowd and Jira, file reads can lead to administrative access.
• A second PoeLLM count puts infections above 3,400 servers, with compromised hosts scanning for more exposed services.
• Revoked certificates from the .gh, .sl, and .as hijacks do not remove the registry-operator risk that produced them.
• New open weights include Aleph-Alpha/Kolibri-1, perplexity-ai/pplx-decider-v1-27b, and LiquidAI/d1-3B.