Cybersecurity briefing, 2026-10-12

FortiBleed is still driving account lockouts on Fortinet firewalls and SSL VPNs, with attackers using stolen credentials to seize admin control.

• Bricksforge upload flaw turns form files into PHP
• Qilin and Settra turn Palo Alto VPN into access path
• CyberXero uses Claude Code to scale WordPress break-ins
• Danfoss refrigeration controllers turn a cyberattack into spoilage
• AhsayCBS flaws are being used as footholds
• Ledger implant in reseller-sold wallets drained millions
• GitLab emergency patch closes a code execution hole
• PaperCut exploitation stays open after advisory
• FortiBleed shifts into firewall lockout
• Registry Hijack Minted Valid Google Certificates
• SonicWall SMA1000 flaw exploited days after patch
• P7 DarkSword reaches into SpringBoard and wallet data
• AnyDesk Linux exploit reaches root over port 7070
• AI agents shrink the OT defense window
• Splunk patches multiple trust-boundary flaws
• Dubrovsky arrest puts ransomware negotiators in frame
• Snowflake thefts came from old stolen logins
• Citrix NetScaler SAML flaw allows remote code execution

Recent editions

• Sunday, October 11, 2026: FBIjobs probe names a ransomware-response executive · 3 stories
• Saturday, October 10, 2026: FBIjobs probe names a ransomware-response executive · 18 stories
• Friday, October 9, 2026: Fortinet FortiMail path traversal is actively exploited · 19 stories
• Thursday, October 8, 2026: PoeLLM turns exposed AI servers into scouts · 20 stories
• Wednesday, October 7, 2026: PoeLLM turns exposed AI servers into scouts · 20 stories
• Tuesday, October 6, 2026: ClingSTUN Switched From Discovery to Active Exploitation · 19 stories
• Monday, October 5, 2026: Rejetto HFS Cookie Forgery Opens Remote Code Execution · 18 stories