News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Fri 23 Oct· 4 articles
-
AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices
Cybersecurity researchers have uncovered an AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an Autonomous Red Team Kill Chain Framework called Phantom, used in live operations…
-
Fortinet FortiWeb2 articles this day · SecurityOnline first
Hackers Target Exposed Fortinet and Palo Alto Firewalls in Global Campaign · Hackers Steal 70,000 Credentials in Fortinet and Palo Alto Attacks
-
Hackers Target Exposed Fortinet and Palo Alto Firewalls in Global Campaign
Cybersecurity researchers have detailed a large-scale campaign that targeted exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The joint investigation by Group-IB and NyxLab notes that operators in the…
-
Hackers Steal 70,000 Credentials in Fortinet and Palo Alto Attacks
Group-IB and NyxLab have uncovered a widespread campaign linked to an operator known as “k0t” that targets FortiGate, FortiWeb and Palo Alto GlobalProtect deployments. Launched largely between February and June 2026, the operation uses bulk asset discovery…
-
-
INC Ransomware Exposed Using AI and Custom Malware Against Victims
In late September 2026, security researchers uncovered seven INC Ransomware command servers that exposed AI-driven activity and bespoke malware used by affiliates of the group. The exposed AI workbench contained 8,257 messages across 133 OpenCode sessions…
Tue 20 Oct· 2 articles
-
Japan’s October Breach Wave Exposes Millions of Customer Records
SOCRadar documents a dense wave of Japanese breach disclosures that began in late September and surged through October 2026. The firm’s Dark Web News logged 134 Japan-related items in the first half of October, more than all of September (129) and at roughly…
-
AI-Driven Ransomware Campaign Targeted 62 Organisations
SOCRadar Threat Research Unit (STRU) has disclosed an AI-driven intrusion ecosystem operated by affiliates of INC Ransomware and The Gentlemen Ransomware. A publicly accessible command-and-control server exposed the operators’ AI session databases, their…
Mon 19 Oct· 1 article
-
Fortinet Flaw Exploits Led to Stealthy FortiGate Implant in Telecom Breach
Security researchers have linked a sequence of exploited Fortinet vulnerabilities to a stealthy FortiGate implant used in a telecom intrusion. The activity began with the exploitation of a critical remote code execution flaw in FortiManager, tracked as…
Sat 17 Oct· 1 article
-
CISA Flags Fortinet and BeyondTrust Flaws Under Active Attack
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Fortinet Multiple Products Path Traversal (CVE-2025-61624) and BeyondTrust Remote Support Authentication…
Fri 16 Oct· 4 articles
-
Fortinet FortiOS2 articles this day · The Hacker News first
CISA Flags Fortinet Path Traversal Flaw Under Active Exploitation · Fortinet flaw lets stealthy PEERSTITCH malware hijack firewall processes
-
CISA Flags Fortinet Path Traversal Flaw Under Active Exploitation
CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities (KEV) catalogue on 16 October 2026. The vulnerability affects Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager, and may let an authenticated administrator with at least read-write…
-
Fortinet flaw lets stealthy PEERSTITCH malware hijack firewall processes
Security researchers say attackers leveraged Fortinet FortiOS vulnerability CVE-2025-61624 to deploy a memory-resident ARM64 malware named PEERSTITCH. The flaw is a path traversal bug in the FortiOS command line interpreter that could let a privileged…
-
-
Hackers Stole Fortinet Credentials from 500 Firewalls via FortiManager
PEERSTITCH malware: How attackers compromised 500 Fortinet firewalls via FortiManager discusses a multi-stage intrusion disclosed by Palo Alto Networks Unit 42. The operation began in September 2024 when attackers exploited CVE-2024-47575 (FortiJump) to…
-
Espionage Group Exploits WinRAR Flaw to Target CIS Governments
Security researchers have publicised an active espionage campaign attributed to the UAT-6275 group (also tracked as TAG-193) targeting CIS governments and allied institutions. The campaigns ran from June 2025 to August 2026, culminating in four distinct…
Thu 15 Oct· 2 articles
-
Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments
Silent Lynx has been linked to a new wave of attacks against government organisations across the CIS, with activity spanning from June 2025 to August 2026. The group employs four parallel infection chains that hinge on macro-enabled Office documents, PS2EXE…
-
Hackers Used FortiManager Flaws to Compromise 500 Firewalls
In September 2024, threat cluster CL-STA-0954, tracked by Mandiant as UNC5820 and attributed to Unit 42, breached a telecommunications managed service provider by exploiting Fortinet’s FortiJump vulnerability, CVE-2024-47575. The attackers gained access via…
Wed 14 Oct· 2 articles
-
Hackers Stole Configurations for 500 FortiGate Firewalls in FortiManager Breach
Unit 42 reports a multi-stage intrusion against a telecommunications provider, which began in September 2024 with the exploitation of CVE-2024-47575 against a FortiManager appliance. The attackers registered a rogue Virtual FortiGate named localhost on the…
-
Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day
Security updates have addressed 29 vulnerabilities across Citrix, Fortinet, and Ivanti products, including several critical-severity flaws that could allow unauthenticated code execution, authentication bypass, DoS, or leakage of sensitive data. Citrix…
Mon 12 Oct· 1 article
-
Actively Exploited Vulnerabilities Jump to 100 in Q3 2026
Daily CyberSecurity’s Q3 2026 CVE report tracks every entry CISA added to the Known Exploited Vulnerabilities (KEV) catalog between 1 July and 30 September 2026. In this quarter, 100 actively exploited vulnerabilities were added, up from 75 in Q2, with…
Mon 5 Oct· 1 article
-
Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk
Researchers tracked 2,652 new CVEs between 28 September and 4 October 2026, with seven flaws showing confirmed exploitation. Daily Cybersecurity (DC) flagged six exploited flaws, and six appeared in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Five…
Fri 2 Oct· 3 articles
-
Fortinet FortiMail3 articles this day · The Hacker News first
Fortinet FortiMail Zero Day Lets Attackers Write Files via HTTP · CISA Warns FortiMail Flaw Is Being Exploited in the Wild
-
Fortinet FortiMail Zero Day Lets Attackers Write Files via HTTP
Fortinet’s FortiMail has a critical zero-day vulnerability being exploited in the wild, tracked as CVE-2026-104286 with a CVSS score of 9.8. The flaw is a path traversal and improper neutralisation of NULL byte/NULL character, which could allow attackers to…
-
CISA Warns FortiMail Flaw Is Being Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Fortinet FortiMail flaw to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, CVE-2026-104286, is a path traversal issue (CWE-22) that can be triggered by…
-
Fortinet FortiMail Zero Day Exploited in Attacks, CISA Warns
Fortinet has disclosed a critical zero-day affecting Fortinet FortiMail that has been observed being exploited in the wild. The flaw, tracked as CVE-2026-104286 with a CVSS score of 9.8, allows unauthenticated attackers to write arbitrary files on the…
-
Thu 1 Oct· 2 articles
-
Fortinet FortiMail2 articles this day · CISA first
FortiMail Flaw Exploited in the Wild, Exposing Corporate Networks · CISA Flags Fortinet FortiMail Flaw Under Active Exploitation
-
FortiMail Flaw Exploited in the Wild, Exposing Corporate Networks
Fortinet’s FortiMail appliance is actively exploited due to a path traversal flaw tracked as CVE-2026-104286, rated CVSS 9.8. The vulnerability arises from a combination of path traversal (CWE-22) and poor handling of NULL bytes (CWE-158), enabling…
-
CISA Flags Fortinet FortiMail Flaw Under Active Exploitation
CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalogue on 1 October 2026. The vulnerability affects Fortinet FortiMail and is named the Fortinet FortiMail Path Traversal Vulnerability. It allows an unauthenticated attacker to write…
-
Tue 15 Sep· 1 article
-
Attackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BB
Threat actors targeted Thai broadband provider 3BB, also known as Triple T Broadband, by exploiting vulnerabilities in Fortinet and F5 products, according to cybersecurity firm Hunt.io. The intrusion was uncovered after the attackers left their tools in an…
Mon 14 Sep· 1 article
-
Russian Hackers Exploit Fortinet Flaw to Deploy PivotC2 Trojan
The SOCRadar Threat Research Unit says a suspected Russian-speaking cybercrime operator was actively targeting Fortinet edge devices in September 2026. More than 30,000 IP addresses were targeted, with 178 devices confirmed compromised, primarily in the…
Thu 10 Sep· 4 articles
-
Fortinet Multiple Products3 articles this day · CISA first
CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day · Fortinet Flaw Exploited to Deploy PivotC2 RAT Across 178 Devices
-
CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four flaws from Cisco, Google Chromium V8, Fortinet and Citrix NetScaler to its Known Exploited Vulnerabilities (KEV) catalog. The entries are CVE-2025-25249 (Fortinet multiple…
-
Fortinet Flaw Exploited to Deploy PivotC2 RAT Across 178 Devices
Security researchers report that a high-severity, unauthenticated remote code execution vulnerability in Fortinet products, tracked as CVE-2025-25249 (CVSS 7.4), has been exploited to deploy the PivotC2 Node[.]js RAT. Described as a heap-based buffer…
-
CISA Flags Actively Exploited Fortinet Flaw Allowing Code Execution
CISA has added CVE-2025-25249 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects Fortinet’s FortiOS, FortiSwitchManager and FortiSASE products. Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability allows…
-
-
CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack
CISA has added three actively exploited flaws to the Known Exploited Vulnerabilities (KEV) catalog, affecting Cisco, Citrix, and Fortinet products, with a deadline of 12 September 2026 for Federal Civilian Executive Branch (FCEB) agencies to apply patches.…
Fri 4 Sep· 1 article
-
Gentlemen Ransomware Storms Networks Through Fortinet VPNs
The Gentlemen ransomware operates as a ransomware-as-a-service under the GOLD SHERWOOD banner, with affiliates handling data theft, defence disruption and rapid encryption. Sophos Counter Threat Unit confirms the operation, noting a repeatable affiliate…
Tue 11 Aug· 1 article
-
Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA
The article discusses the Gunra ransomware gang, which is exploiting vulnerabilities in Fortinet products, particularly CVE-2024-55591 and CVE-2025-24472, to bypass multifactor authentication (MFA) and compromise critical infrastructure and government…
Tue 28 Jul· 1 article
-
U.S. CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerabilities related to Arista VeloCloud Orchestrator and Fortinet FortiOS to its Known Exploited Vulnerabilities catalog. Two notable flaws include CVE-2025-68686, affecting…
Mon 27 Jul· 2 articles
-
Fortinet FortiOS bug CVE-2025-68686 exposes data to hackers
On 27 July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2025‑68686 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects Fortinet FortiOS and is named “Fortinet FortiOS Exposure of Sensitive…
-
CISA adds Arista VeloCloud RCE and Fortinet FortiOS bypass to KEV
On July 27, 2026, CISA added two known exploited vulnerabilities to their KEV list: a critical remote code execution (RCE) flaw in Arista VeloCloud and a persistence bypass in FortiOS. These vulnerabilities are identified as CVE-2026-16812 (CVSS 10.0) and…
Sat 18 Jul· 2 articles
-
CISA urges patch of FortiSandbox, SharePoint flaws amid exploits
On July 16, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) included two critical vulnerabilities from Fortinet FortiSandbox and one from Microsoft SharePoint in its Known Exploited Vulnerabilities (KEV) catalog. The vulnerabilities…
-
Ubuntu Pro Client Flaw CVE-2026-11386 Allows Arbitrary Code Execution With Root Privileges
The article discusses a critical vulnerability (CVE-2026-11386) in the Ubuntu Pro Client, reported on July 16, 2026, by Frederick Jerusha. This flaw allows arbitrary code execution with root privileges, scoring 9.0 on the CVSS scale. It affects multiple…
Fri 17 Jul· 3 articles
-
CISA Mandates Urgent Patch for Actively Exploited Critical Fortinet Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated urgent patches for two critical vulnerabilities in Fortinet's FortiSandbox, identified as CVE-2026-39808 and CVE-2026-25089, both rated 9.1 on the CVSS scale. These vulnerabilities…
-
Microsoft SharePoint2 articles this day · SecurityOnline first
292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users · CISA orders urgent patches for SharePoint, FortiSandbox flaws
-
292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users
Today's critical security alert reveals three active exploits: CVE-2026-58644 related to Microsoft SharePoint, and two CVE entries (CVE-2026-25089 and CVE-2026-39808) concerning Fortinet FortiSandbox command injection vulnerabilities. An unattributed…
-
CISA orders urgent patches for SharePoint, FortiSandbox flaws
CISA has added three vulnerabilities to its Known Exploited Vulnerabilities catalog as of July 16, 2026. These include two critical vulnerabilities affecting Fortinet FortiSandbox and one affecting Microsoft SharePoint. The federal agencies are required to…
-
Thu 16 Jul· 3 articles
-
CISA adds FortiSandbox flaw CVE-2026-39808 to KEV catalogue
On 16 July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑39808 to its Known Exploited Vulnerabilities (KEV) catalogue. The affected vendor is Fortinet and the product is FortiSandbox. The Fortinet FortiSandbox OS Command…