Fortinet FortiMail Zero-Day Actively Exploited With No Patch Available

CISA and Fortinet warned that attackers are exploiting CVE-2026-104286, a critical FortiMail vulnerability with a CVSS score of 9.8. Crafted HTTP or HTTPS requests can allow attackers to write arbitrary files to the underlying system and potentially achieve code or command execution, while Fortinet has advised temporary mitigations until patches become available.

Source: SecurityWeek

Atlassian Data Center Flaw Targeted Within Hours of Public Disclosure

Attackers began probing and attempting to exploit CVE-2026-21589 within roughly two hours of public technical details becoming available. The critical unauthenticated arbitrary file access vulnerability affects multiple Atlassian Data Center products, including Jira, Confluence, Bitbucket, Bamboo and Crowd.

Source: The Hacker News

New NetScaler Zero-Day Exploited in Targeted Attacks

Citrix patched CVE-2026-88779 after observing targeted zero-day exploitation against NetScaler ADC and Gateway deployments. The memory overflow vulnerability can cause denial of service when affected systems are configured as a SAML service provider or identity provider.

Source: The Hacker News

Cisco Patches Critical Nexus Vulnerabilities That Could Allow Root-Level Takeover

Cisco disclosed five critical vulnerabilities in NX-OS affecting Nexus 3000 and Nexus 9000 Series switches. The flaws affect features including NX-API, NGOAM and MPLS OAM and can potentially allow attackers to execute arbitrary code with root privileges or crash affected devices.

Source: BleepingComputer

SonicWall Fixes Maximum-Severity SMA1000 SSRF Vulnerability

SonicWall released hotfixes for CVE-2026-102255, a CVSS 10 vulnerability affecting SMA1000 appliances. A remote unauthenticated attacker can abuse an unintended access path to make the appliance issue requests on their behalf, potentially reaching internal functionality and performing unauthorized operations.

Source: SecurityWeek

Tensorlake npm Package Compromised With Shai-Hulud Worm

Version 0.5.144 of the tensorlake npm package was compromised with a new Shai-Hulud variant that steals secrets and attempts to propagate through connected software supply chains. Tensorlake provides sandbox infrastructure for AI agents, and its npm package has more than 100,000 reported lifetime installs.

Source: Aikido Security

FBI Warns FortiBleed Campaign Remains Active After Harvesting More Than 86,000 Credentials

The FBI and U.S. Secret Service warned that the FortiBleed campaign continues targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The campaign has reportedly collected more than 86,000 working device credentials across 194 countries and has also been observed providing initial access for ransomware operations.

Source: The Hacker News

Ransomware Attack Disrupts Japanese IDCF Cloud Infrastructure

IDC Frontier confirmed that ransomware caused an outage in its IDCF Cloud East Japan Region 1 environment. The company shut down network and system infrastructure after detecting the attack, disrupting a cloud platform used by government and enterprise customers.

Source: BleepingComputer

Iran-Aligned Blinder Tunnel Campaign Targets Iraqi Critical Infrastructure

Unit 42 linked the Blinder Tunnel campaign to an Iranian state-aligned actor tracked as CL-STA-1178. The operation targeted Iraqi critical infrastructure and used identities impersonating Dubai Airports IT staff to deliver trojanized coding challenges to high-value targets.

Source: Palo Alto Networks Unit 42

ASOS Confirms Data Breach After Employee Account Compromise

ASOS confirmed that attackers gained access to an employee account by impersonating a trusted contact and subsequently abused customer communication infrastructure to send unauthorized push notifications. The attackers also accessed some personal information, including customer names and contact details.

Source: The Record

Android Phones Shipped With Midnight Mimosa Malware Preinstalled in Firmware

Bitdefender identified Midnight Mimosa malware preinstalled on low-cost Android devices built on MediaTek platforms. The malware runs with system-level privileges before the user first powers on the device and can silently install applications, grant permissions and load remotely supplied code.

Source: Bitdefender

FakeGit Campaign Re-Arms More Than 17,000 Malicious GitHub Repositories

Researchers observed the FakeGit infrastructure rapidly repointing thousands of existing GitHub repositories toward SmartLoader malware downloads. More than 13,000 repositories were modified in roughly 34 hours, demonstrating how long-lived fake repositories can be reused without rebuilding the attacker infrastructure from scratch.

Source: Apiiro

Active WordPress XSS Campaign Creates Hidden Administrator Persistence

Attackers are actively exploiting stored XSS vulnerabilities in WPC Product Bundles for WooCommerce and Ninja Forms to deliver the same malicious JavaScript payload. The implant executes in the browser of a logged-in administrator and is designed to establish persistent access, including hiding attacker-controlled administrator accounts.

Source: Patchstack

Chinese State-Linked Hackers Operated Portal Providing Access to Stolen Emails

The FBI and partner agencies said actors linked to China’s Integrity Technology Group compromised government, law enforcement, healthcare and religious organizations in Southeast Asia. The operation used vulnerability scanning, password attacks against Microsoft 365 and Exchange accounts, and infrastructure that provided third parties with access to stolen email data.

Source: The Hacker News

UAT-11985 Uses AI-Assisted Lures and Real-Time Google AitM Phishing

Cisco Talos identified an APT campaign targeting individuals associated with Taiwanese research organizations using highly tailored event invitations and malicious QR codes. The operation used a real-time adversary-in-the-middle phishing framework that impersonated Google authentication pages and intercepted credentials and MFA challenges.

Source: Cisco Talos