Fortinet path traversal flaw CVE-2025-61624 added to CISA KEV

🚨 ACTIVE EXPLOITATION

• Fortinet path traversal flaw CVE-2025-61624 in FortiOS, FortiPAM, FortiProxy, FortiSwitchManager added to CISA KEV CVE-2025-61624
  CISA has added CVE-2025-61624, a path traversal vulnerability in multiple Fortinet products, to its Known Exploited Vulnerabilities catalog.
  • Affects FortiOS 7.6.0-7.6.4 and 7.4.0-7.4.9 (plus all 7.2/7.0/6.4), FortiPAM 1.7.0 and all 1.0-1.6, FortiProxy 7.6.0-7.6.4 and 7.4.0-7.4.11, and FortiSwitchManager 7.2.0-7.2.7 and 7.0.0-7.0.6.
  • The CWE-22 path traversal flaw in the CLI lets an authenticated admin with read-write permissions write or delete arbitrary files via crafted command arguments.
  • Exploitation requires local CLI access with compromised or malicious admin credentials, enabling configuration tampering, file deletion, or denial of service.
  • CISA KEV due date for federal patching is 2026-10-19; Fortinet fixed releases include FortiOS 7.6.5/7.4.10 and FortiPAM 1.7.1.
  Sources 📄 Source: fortiguard.fortinet.com · 📎 Coverage: nvd.nist.gov · 👁 via CISA KEV

🕵️ RESEARCH & DEEP DIVES

• Citizen Lab ties Candiru zero-click spyware infections at Al Jazeera to Discover-Tech online ads
  Citizen Lab has confirmed that Israeli ad-tech firm Discover-Tech delivered Candiru spyware to Al Jazeera devices through zero-click targeted online advertisements.
  • At least 45 Al Jazeera devices were targeted in 2024–2025 with Candiru spyware via the 'AdFection' attack — the first publicly confirmed zero-click infection through targeted ads.
  • Ads placed by Discover-Tech carried code that sent the device's advertising ID and IP to a Discover-Tech server; if the device matched a target, it returned attack code for the browser or app to execute — meaning no click was required and ad networks saw nothing malicious.
  • Discover-Tech's ads reached roughly 200,000 websites and apps, ~10 million ads daily, and appeared on networks of NATO, the UN, EU bodies, and governments in about two dozen countries; an exposed server leaked 4 billion ad bid records.
  • The spyware collects files, browser data, keystrokes, screenshots, microphone/webcam input, and messages, using encrypted channels and chunked data exfiltration to evade detection.
  • Indicators include SHA-256 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 and Discover-Tech ad server domain mtrtb[.]com; Google and IAB Europe removed the company from their vendor registries in early October.
  Sources 📎 Coverage: thehackernews.com · 👁 via SecurityWeek

📋 ADVISORIES

• Drupal patches critical Field UI and Entity List RCE flaws, warns exploits may emerge fast
  Drupal has patched two critical remote code execution vulnerabilities in its core Field UI module and the contributed Entity List module.
  • Affects all supported Drupal core versions; fixes shipped October 14, 2026 in Drupal 10.6.19, 11.3.19, 11.4.10, and Entity List 3.0.10
  • CVE-2026-108097: critical RCE (19/25) in core's Field UI module; CVE-2026-108099: critical RCE in the Entity List contributed module
  • Neither flaw is exploitable via core/module alone, but contributed modules or custom code open multiple exploit paths, at least one requiring no authentication
  • The Field UI bug involved the table element's pre-render step executing arbitrary PHP callables via #region_callback through call_user_func_array; the fix stops calling that callback
  • Drupal 11.2.x and below, 10.5.x and below, and Drupal 8/9 are end-of-life and receive no fix; Drupal 12 pre-releases before beta2 are also affected
  • No public exploit code or in-the-wild attacks reported as of October 15; Drupal had pre-announced the release on October 12 warning exploits could appear within hours or days
  Sources 📄 Source: drupal.org · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

🔓 CVEs & KEV

• CVE-2026-110916 — Google Chrome — CVSS 9.6 — Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 ...

• CVE-2026-110914 — Google Chrome — CVSS 8.8 — Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed ...

• CVE-2026-110915 — Google Chrome — CVSS 8.8 — Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed...

• CVE-2026-110920 — Google Chrome — CVSS 8.8 — Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a rem...

• CVE-2026-110921 — Google Chrome — CVSS 8.8 — Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote...

• CVE-2026-110919 — Google Chrome — CVSS 8.8 — Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote...

• CVE-2026-110913 — Google Chrome — CVSS 8.8 — Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a re...

• CVE-2026-110922 — Google Chrome — CVSS 8.8 — Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a...