🚨 ACTIVE EXPLOITATION
- FortiBleed Attackers Locking Victims Out of Compromised Fortinet Devices
The FBI and Secret Service warn the ongoing FortiBleed campaign has compromised over 86,000 Fortinet devices and is locking organizations out of their appliances.- Targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways; ~86,644 devices confirmed compromised across 194 countries.
- Attackers use credential stuffing and password spraying with credentials from infostealer logs and prior leak dumps, exploiting legacy SHA-256 password storage for offline cracking.
- A Go-based tool (FortigateSniffer) intercepts authentication traffic across 24 protocols; hashes are cracked via GPU clusters using Hashmat and Hashtopolis.
- Attackers create new admin accounts for persistence and delete or change passwords on original accounts, locking victims out of their devices.
- Operation is a Russian-speaking initial access broker linked to INC/Lynx and Payload ransomware; suspicious accounts include forticloud-sync, fgtsecure, and forti_support2.
💥 BREACHES & INCIDENTS
Oracle Health breach of legacy Cerner servers exposed data of nearly 20 million people
The 2025 Oracle Health cyberattack compromised the personal and medical data of nearly 20 million people, per a Texas attorney general report.- Affects patients of hospitals and clinics using Oracle Health's legacy Cerner EHR systems, including Christus Health, Tri-City Medical Center, and at least 29 health systems; Oracle's healthcare clients include the Department of Defense and Department of Veterans Affairs.
- Stolen data includes names, Social Security numbers, addresses, medical record numbers, doctors, diagnoses, medicines, test results, and images.
- The attacker used stolen customer credentials to access two legacy Cerner servers after January 22, 2025, and copied patient data to a remote server before migration to Oracle Cloud.
- A lone extortion actor known as 'Andrew' demanded millions in cryptocurrency and set up public websites to pressure victims; Texas filings list ~3 million affected residents, with South Carolina and Washington filings at ~283,000 and ~69,000.
ASOS confirms data breach after hackers send 'ASOS HACKED' alert via its own app
Hackers breached a third-party platform used by ASOS and sent rogue 'ASOS hacked' notifications to customers, exposing detailed customer data.- Affects ASOS shoppers (16.5 million active customers in over 100 markets) who use the ASOS mobile app or shop on the site.
- Attackers accessed an ASOS employee account by impersonating a trusted contact to obtain login credentials, then downloaded customer data including names, addresses, phone numbers, emails, customer numbers, and search history.
- The attackers used ASOS's own app push notification system to send a message reading 'Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it' to potentially millions of users on 6 October 2026.
- The group, calling itself Xuanye Group (or Xuanyewen), claimed the breach on a newly created Telegram channel and said they used Simon AI, a platform built on Snowflake, to access the data.
- ASOS says payment-card information and account passwords were not impacted; Snowflake says it has found no compromise of its platform.
- ASOS shares fell roughly 11% following the incident, which follows 2025 cyberattacks on UK retailers including Marks & Spencer, the Co-op, and Harrods.
🕵️ RESEARCH & DEEP DIVES
Cisco Talos tracks UAT-11985 spear-phishing Taiwan researchers with AI-crafted lures and Google AitM kit
Cisco Talos identified an APT spear-phishing campaign, tracked as UAT-11985, targeting individuals affiliated with Taiwan research organizations.- Targets are individuals affiliated with Taiwan research organizations; the actor impersonated the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute.
- Stolen data: Google account credentials and multi-factor authentication challenges, intercepted in real time via an adversary-in-the-middle phishing framework.
- Delivery: personalized event-invitation emails likely produced with AI-assisted content generation, using legitimate public event details as cover and disguised hyperlinks that display benign Google Forms URLs while redirecting to actor-controlled phishing sites.
- The campaign also used quishing, altering QR codes in legitimate event posters so secondary victims scanning printed materials reach phishing pages.
- The phishing kit impersonates Google Forms and login pages, uses a hybrid HTTP and WebSocket architecture to sync authentication flows, and was originally developed in Simplified Chinese before localization to Traditional Chinese and English.
Cisco Talos details 'A3' malware that embeds plaintext prompts to evade AI analysis
Cisco Talos documents a class of malware that embeds natural-language instructions to manipulate AI-based analysis tools.- Applies to AI-based malware analysis pipelines in commercial and open-source tooling used to triage and classify samples.
- Malware families FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE (84 samples, Jan 2025–Jul 2026) embed plaintext 'For LLM and AI' instructions claiming the file is benign.
- Technique targets the text-extraction/LLM analysis layer above binary analysis; best techniques steered analysis outcomes in the attacker's favor in ~35% of test runs.
- Progressions include template-generated evasion text (PLOTSAFE), 'template spraying' across seven LLM chat formats plus fake packer sections (HOLLOWCLAD), and intimidation notes aimed at AI assistants.
- The FRUITSHELL comment spread verbatim to nine additional scripts by at least four distinct actors over 15 months, including the more capable ROZESHELL collection.
MALFEX npm Malware Hides Executables in PNG Files to Infect Windows Developers
A long-running npm supply-chain campaign called MALFEX has delivered RATs and info stealers to Windows developers via eight malicious packages.- Targets Windows developers; eight malicious npm packages (of twelve by one operator) accumulated 40,767 downloads by October 1, 2026, with the operator publishing since August 2023.
- Payloads include Overlord RAT (open-source Go RAT), the movinlike Node.js stealer targeting Discord tokens, browser credentials, Telegram sessions, and crypto wallets, and a downloader hidden in function-flag.
- Delivery path 1: preinstall/postinstall scripts fetch a Windows PE disguised as image/png (actually an IExpress archive) containing a signed AutoIt interpreter and encrypted script revealing Overlord via XOR, RC4, and LZNT1 decoding.
- Delivery path 2: packages load a PNG polyglot with AES-encrypted data appended after the image end marker (key: malfexteam2027), fetching movinlike from 104.234.65.75:700; this runs at package load, so disabling npm lifecycle scripts does not stop it.
- Malicious packages include function-flag (versions 1.7.3, 4.0.0, 3.0.0, 2.3.5–2.3.9), function-color, cdn-img-fetch, img-to-native, native-runner, tlxbnhd, tldriver, and mxdriver; three remained installable with incomplete or missing advisories as of late September 2026.
empire-market-owner-sentenced — BleepingComputer
wazza-phishkit — The Hacker News
poellm-github-c2 — Cyber Security News
📋 ADVISORIES
SEC Consult details TP-Link Aginet router flaws cited in four state lawsuits
SEC Consult published technical details on five TP-Link Aginet vulnerabilities cited in lawsuits filed by four US states.- Affects TP-Link's Aginet line of ISP-managed mesh systems, routers, and modems — 65 affected devices including ISP-customized variants.
- Five flaws, CVE-2025-30237 through CVE-2025-30241, include authentication bypass, privilege escalation, root command injection, hardcoded encryption keys, and a USB physical-access exploit.
- CVE-2025-30237 lets an unauthenticated attacker on the same network create a super-admin account and enable SSH; CVE-2025-30239 hardcoded keys allow recovery of user passwords, Wi-Fi credentials, and ISP remote-management credentials.
- Florida, Iowa, Montana, and Nebraska sued TP-Link Systems on October 6, alleging misleading security claims and undisclosed China ties; Texas filed a similar suit in February.
- Fixes were reported starting December 2024 and rolled out via ISP-distributed firmware into 2026; SEC Consult withheld PoC code because many devices remain unpatched.
Gitea patches 27 flaws in 28.0.0/28.1.0, incl. critical SSH auth bypass and SSRF
Gitea has released security updates fixing 27 vulnerabilities across versions 28.0.0 and 28.1.0, including a critical SSH authentication bypass and SSRF weaknesses.- Affects Gitea instances: 19 flaws impact 1.27.3 and earlier (fixed in 28.0.0); 8 more impact up to 28.0.0 (fixed in 28.1.0); severity ranges up to CVSS 9.8.
- CVE-2026-103059 (CVSS 9.1): the built-in SSH server's case-insensitive SQL LIKE key lookup let a crafted case-variant RSA key match another user's account, enabling authentication as that victim on SQLite and similar databases.
- CVE-2026-96404: re-running the web installer against an existing database issued an authenticated admin session without verifying the password.
- Multiple SSRF flaws (CVE-2026-70357, CVE-2026-101027, CVE-2026-101029, CVE-2026-89430) let repository migrations and mirrors bypass egress rules via