Fortinet patches critical flaws as new cyber threats emerge

Fortinet has issued a coordinated security update for FortiOS, FortiManager, and FortiAnalyzer to address a set of critical and high‑severity flaws found via AI‑assisted discovery; details remain under wraps until 10 November 2026. Separately, Trellix reports a new Sirius backdoor delivered through a FedEx invoice‑lure PDF, leveraging OpenAction/Launch objects to trigger a Base64 PowerShell loader and process hollowing before loading Sirius in memory. Citations for these items come from Fortinet and Trellix.

In other notable developments, FortiBleed 2.0 has surfaced with 40,573 exposed secrets across 975 newly identified domains, including 37,076 local user records and 1,576 LDAP binds, derived from FortiGate source files associated with 1,689 hosts; Hudson Rock’s update attributes the findings to material dating February 2026.

Infosec researchers also flag domain shadowing used to host illegal gambling content beneath school and government namespaces, with two campaigns exploiting DNS administration access to create new, trusted subdomains (Infoblox).

Other high‑impact items include CVE‑2026‑80097 in Microsoft Authenticator (token theft via a malicious Android app during an authentication flow), CVE‑2026‑42589 in Gotenberg (RCE used to deploy a Go reverse shell, with 1,358 exploitation events in the last 30 days from 128 IPs, per VulnCheck), and CVE‑2026‑41940 tied to a GitHub npm‑worm campaign (testmetest) that hijacked 42 repositories.

Cisco Talos reveals an AI‑enabled C2 framework called NIK C2 with multiple versions; Pillow (Python imaging library) and Brotli decoder flaws are also highlighted as remote‑code‑execution risks in popular software. The briefing closes with news of AI‑assisted ransomware economics and new data‑extortion activity, underscoring continuing abuse of stolen credentials, weak access controls, and trusted software chains.