Attackers exploit CVE-2026-104286, a 9.8 FortiMail vulnerability allowing unauthenticated file writes. CISA adds it to KEV. Apply the workaround.

#Fortinet #FortiMail #CVE2026104286 #PathTraversal #CISAKEV #ActivelyExploited #ZeroDay

https://securityonline.info/fortimail-vulnerability-cve-2026-104286/?utm_source=mastodon&utm_medium=jetpack_social

🚨 NEW on CISA KEV — exploited in the wild

🛡 Fortinet FortiMail
Fortinet FortiMail Path Traversal Vulnerability
CVE: CVE-2026-104286 · patch by 2026-10-04

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-104286
#cybersecurity #KEV #CVE #infosec

⚠️ CVE-2026-104286 (https://vulnerability.circl.lu/vuln/CVE-2026-104286) — FortiMail, vulnérabilité critique et déjà exploitée comme 0-day.

S’il fallait encore des exemples sur le rythme auquel il faut désormais suivre les correctifs des équipements exposés : après Cisco, Citrix, Zimbra… voilà à nouveau FortiMail. 🙃

Sans authentification, un attaquant peut écrire des fichiers et exécuter du code via l’interface de gestion.

"Bien évidemment", il s’agit d’une bonne vieille traversée de chemin .../.../... :dumpster_fire_gif:

➡️ En attendant les versions corrigées : désactiver IBE ou restreindre strictement l’accès à l’interface d’administration.

🩹
👇 https://fortiguard.fortinet.com/psirt/FG-IR-26-175

#Fortinet #FortiMail #CVE

Critical Threat Advisory: CVE-2026-104286 Fortinet FortiMail

Immediate CISA KEV threat advisory for CVE-2026-104286 affecting Fortinet FortiMail. Includes behavioral workflow analysis, BOD 26-04 patch compliance guidance, and multi-vendor SOC detection queries....

https://thecybermind.co/t645

Critical Fortinet FortiMail Zero-Day (CVE-2026-104286) Actively Exploited: Unauthenticated File Write Flaw Exposes Email Security Gateways Worldwide

https://thecybersecguru.com/exploits/fortimail-cve-2026-104286-zero-day/

🚨 Fortinet sounds the alarm over actively exploited FortiMail zero-day

｢ The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 and affects multiple versions of Fortinet's email security platform ｣

https://www.theregister.com/security/2026/10/02/fortinet-sounds-the-alarm-over-actively-exploited-fortimail-zero-day/5300803

#fortinet #fortimail #cybersecurity

Attackers have been #exploiting critical #Zimbra flaw to steal emails

#Hackers have been exploiting a critical #vulnerability in the #ZimbraCollaborationSuite in an attempt to obtain email backups and authentication credentials of #vulnerable organzations, #Microsoft has warned.

The vulnerability, tracked as CVE-2026-73570, lets attackers remotely issue operating system commands without #authentication. Zimbra maintainer Synacor issued a patch on July 20, but didn’t disclose the vulnerability for more than three weeks after that. The security-focused #Shadowserver Foundation said last week that its scans found that 274 separate instances of the Zimbra Collaboration Suite had been compromised. The number of #servers running the software has fluctuated from 19,000 in the week following the patch to about 12,000 in the weeks following that. Currently, Shadowserver is tracking about 10,000 instances.
#privacy #security

https://arstechnica.com/security/2026/09/attackers-have-been-exploiting-critical-zimbra-flaw-to-steal-emails/

Zimbra leckt mal wieder

https://borncity.com/blog/2026/10/01/kritische-schwachstelle-cve-2026-73570-in-zimbra-patchen-ist-angesagt/

Setzt jemand #Zimbra ein? Sicherheitslücken patchen!
https://borncity.com/blog/2026/10/01/kritische-schwachstelle-cve-2026-73570-in-zimbra-patchen-ist-angesagt/

Go hack more AI shit.
Go hack more Gitlab.

But most importantly, hack more Gitlab AI shit: https://db.gcve.eu/vuln/cve-2026-90970

Go hack more AI shit.

https://nvd.nist.gov/vuln/detail/cve-2026-90970

sev:CRIT 9.9 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.

This Week in Security: ShinyHunters Won’t Dox the FBI, Pentagon Data Stolen, and OBS Vulnerable

404 Media reports that the ShinyHunters group who stole multiple terabytes of FBI employee data say they do not plan to release the data.

Known for ransomware and extortion of innumerable companies and government agencies, ShinyHunters used a zero-day vulnerability in Oracle PeopleSoft to compromise the employment site of the FBI and pivot into scraping the content of FBI AWS instances, claiming to have the full employment and health data of all FBI agents, employees, and spouses.

The hacker group took exception to an FBI press release that claimed that the group over-stated stolen data and that they directly harass victims and victim’s families. The group publicized the FBI data breach, demanding a retraction of the statements, and it was generally assumed that the group would follow their typical methods of releasing the data publicly if the demands were not met.

The group has told 404 media that they had always agreed internally to not release the stolen data, saying “This was all a marketing campaign to protect our business and actively combat disinformation”. Meanwhile the FBI continues the investigation, and Shiny Hunters may be hoping to defer some of the ire.

Pentagon Data Breach

A data breach at the Defense Manpower Data Center lasted for nine months before it was discovered, and allowed unknown attackers to exfiltrate information on military personnel.

The information stolen includes social security numbers and “operational specialty” data about where a service member is employed within the armed forces. The DMDC handles data on 60 million current and former service members, but the report does not specify the number impacted.

Currently the source of the attack is unknown; the attackers may be a typical data ransom or theft group, but information about service members could easily be used by foreign intelligence groups.

This is, of course, a different attack and leak of US government employee data, independent of the attack on the FBI.

OpenAI Hacked Australian Government Databases

The Australian Prime Minister, Anthony Albanase, has released a statement that OpenAI was involved in a hacking incident against the Australian government health services site.

This is independent of other incidents involving OpenAI agents hacking live Internet sites during testing; OpenAI says the hack was discovered on September 10, 2026, but the incident occurred in June of 2026, prior to the hack of the HuggingFace site.

In the Hugging Face attack, AI agents were asked to complete a cyber security challenge and responded by finding and utilizing vulnerabilities to steal the solutions. A report by Translucence (an AI research lab) finds however that in this instance, the agents were tasked with non-cyber related research and opted to exploit not only the Australian health services site but also the University of New Mexico digital library and Data USA, a platform for collecting and visualizing US government data.

OpenAI says the review of the incident remains ongoing, and that no private patient data was compromised. The Australian government, obviously, has stronger opinions about how the incident occurred and the length of time before they were notified. If agents are defaulting to exploiting live Internet sites for normal queries, we’re likely to keep finding more stories like this.

Physical Attack Against MacOS Lockdown Mode

Researcher Kevin Kessler at glyph.sh discloses a new vulnerability in macOS that can allow keyboard attacks even when lockdown mode is enabled.

MacOS has built-in protection measures against malicious USB devices. Readers using macOS may have seen prompts to allow a USB device to connect the first time it is plugged in; additionally, new USB devices are ignored if a Mac has been locked for more than an hour.

In the extra-paranoid “Lockdown Mode”, macOS will also prevent connections to USB devices entirely while the device is locked. Lockdown mode also disables other operating system features that are suspected of being less secure, like custom web fonts, just-in-time compilation of JavaScript to native code, and direct messaging from unknown contacts. This attack defeats all of these protections.

Due to the architecture of USB, if a USB hub is connected to macOS and trusted, all devices plugged into that hub are automatically trusted. A composite USB device — a device that presents as multiple types of USB interfaces on a single connection — can identify as both a serial port and a keyboard in a single device.

Typically macOS would prompt the user that a new keyboard has been connected, but does not prompt the user when a new USB serial port device is connected to a trusted hub. Presenting as both a serial device and a keyboard, key presses are accepted automatically, with no user prompt.

Kessler demonstrates copying sensitive user data like SSH keys and cloud provider authentication tokens directly over the USB serial device, a trick which may bypass endpoint protection tools looking for copied files.

Apple told the researcher that the behavior is expected when a USB hub has been trusted, and that composite USB devices are outside the scope of the protection mechanisms. If so, perhaps it needs to be more clearly communicated to users the risk of trusting any USB hub or dock if an attacker could conceivably get physical access.

Spying with File Update Notifications

New attacks against the file notification systems of all major operating systems — Windows, macOS, Linux, and Android — will be shown at the November 2026 ACM security conference.

File notification systems are a crucial part of almost all modern operating systems, letting the UI and background services receive alerts that file content has changed, instead of constantly querying file modification times. Unfortunately, it seems like all of them have major issues and allow bypassing permissions and access restrictions.

The researchers call out Windows as the worst offender: it allows a notification to be set for any file modification, system wide, regardless of access permission or what user owns it. To be fair, it seems like Linux, macOS, and Android aren’t too far behind however.

On Linux, the inoti.fyi researchers discovered that while notifications can’t be set on files the user isn’t allowed to access, notifications can still be set on readable parent directories, and will still report changes to the files. Leveraging this oversight against the /dev/input directory, events are raised for every keystroke, and they reference decades of research on using keystroke timing to guess what was typed.

For Android, permission oversights allow one application to set notifications for the private storage of other applications. Normally, each application runs in a separate sandbox and has no insight into the behavior of other apps, using the Android file notification API, they demonstrate monitoring WhatsApp to log the exact time messages and photos are received.

The Windows vulnerability may be the most immediately severe, where the inoti.fyi team is able to monitor the cache and local storage directories of browsers. Browsers like Firefox create files with the name of the website; by monitoring the cache directories, it’s possible to monitor the websites loaded by any user on the system.

The team has been working with vendors to address the issues, however in most cases there are no fixes available yet.

OBS Streaming Platform Vulnerable

OBS is a popular tool for streamers, compositing multiple cameras, screen and video capture, and more. A large percentage of streamers on the Internet use OBS.

Orange Cyberdefense Switzerland reports vulnerabilities in OBS due to the embedded Chromium browser source. Chromium is the open-source engine behind Chrome, Opera, Microsoft Edge, Vivaldi, and many other browsers; OBS embeds the browser engine to allow embedded web content and web-based applications inside a stream.

Streamers often have an embedded display of the chat associated with their stream, encouraging audience participation. These embeds usually use a browser window to stylize the chats and embed images, which exposes them to whatever the content of the chat message is. Astute readers may already guess how this is a problem.

In a typical browser, each tab is isolated in an independent sandbox, preventing it from interacting with other tabs or the browser itself, but in the OBS embedded browsers, sandboxes are disabled. OBS also used a two-year-old Chromium engine that contained a publicly known and patched bug in the V8 JavaScript engine. The bug had already been exploited in the wild by North Korean hackers, but the impact was limited thanks to the sandbox mechanism isolating each tab. With no sandbox, malicious HTML and JavaScript rendered by a web view could directly execute code on the system, taking over the OBS instance or the whole system.

The researchers at Orange have worked with OBS to update the embedded Chromium version, but also offer the advice that untrusted HTML should be avoided whenever possible: No OBS widget should ever render user or chat content as HTML.

DIVD Hacked

DIVD, the Dutch Institute for Vulnerability Disclosure, announced that they were the victims of a recent hack themselves.

DIVD says that the attackers got in through two previously unknown bugs in the Zammad help desk software, and that the attackers appear to be AI agents. Within seconds, attackers hijacked Zammad sessions, gained code execution, and then gained root access to the system. DIVD says the attackers immediately began to exfiltrate data from the impacted systems, but were blocked from accessing other government systems.

The Institute is using this as a teaching moment, not only releasing an advisory for the Zammad system, but making a candid LinkedIn post discussing the incident and the responses: “So what do hackers do when they get hacked? Handle it the way we think it should be handled. That is open, transparent and honest, even if it sucks.”

Enterprise Networking Vulnerabilities

Major vulnerabilities have been found exploited in the wild for both Cisco Catalyst SD-WAN and Citrix Netscaler enterprise devices. A relatively bland Cisco announcement discloses that all versions of the Cisco Catalyst SD-WAN Manager allow unauthenticated, remote, admin access. (!)

The Citrix Netscaler article, on the other hand, comes from the team at watchTowr. Anyone who has been reading for the past months should know that a post from watchTowr is a guaranteed good read. Not only are the vulnerabilities in Netscaler plentiful and severe, but they were widely known and exploited before Citrix finally released a vulnerability statement.

The Netscaler vulnerabilities include arbitrary commands from unauthenticated users, remote code execution and denial of service attacks against the VPN server, multiple memory overflows, and predictable random generation in some situations.

WatchTower digs into the firmware changes for more details, so if seeing how Perl is still used in 2026 enterprise equipment tickles your fancy, be sure to give them a read.

hackaday.com/2026/10/02/this-w…
RE: 404media.co/.ghost/activitypub…

🚨 Reports of NetScaler Incidents After Latest Patch Raise Concerns Over Continued Exploitation

Multiple Citrix administrators are reporting suspicious activity affecting NetScaler appliances even after updating to version 14.1-73.37.

The reports surfaced on Reddit, where one administrator said multiple customers experienced incidents that caused externally accessible NetScaler appliances to repeatedly reboot.

Other administrators reported similar behavior on newly rebuilt appliances, including systems where Enhanced ISN Generation had already been enabled. Several affected organizations said they collected forensic data and opened cases with Citrix.

It is currently unclear whether the activity represents successful exploitation of a new or existing vulnerability, residual compromise, vulnerability scanning, or an issue with the updated firmware.

The reports come days after Citrix disclosed active exploitation of CVE-2026-88771 and CVE-2026-88772, two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway.

The latest post-patch activity has not yet been confirmed by Citrix as exploitation.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Source: https://www.reddit.com/r/Citrix/comments/1wvwva9/netscaler_active_exploit_after_patch/?rdt=60164

⚠️ CRITICAL: Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks

NetScaler ADC and Gateway instances are being actively exploited via CVE-2026-88771 and CVE-2026-88772 to achieve root access and deploy web shells. Government and finance organizations have been targeted since early September, with attackers moving laterally post-compromise. State-sponsored actors…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CVE-2026-93616 Check Point Management Server path traversal and file upload, unauth RCE, CVSS 9.8. Patch under review, so isolate exposed servers now. https://www.valtersit.com/cve/CVE-2026-93616/ #CVE #infosec #CheckPoint

How to detect the Apple iOS/macOS recent 0-day CVE-2026-86950 in PDF files?
I developed a python tool for that, based on the PoC published two days ago:
https://decalage.info/CVE-2026-86950/

The ShinyHunters extortion gang is bypassing Web Application Firewall (WAF) rules by using URL-encoding tricks to exploit the Oracle PeopleSoft CVE-2026-35273 vulnerability. Mandiant urges organizations to apply the official security update rather than relying on WAF blocks, as attackers continue to deploy web shells and malware to steal sensitive data.
https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/

Recent geopolitical news indicates Russia initiated a winter strike campaign targeting Ukraine's energy infrastructure on September 30. In cybersecurity, CISA added a critical Cisco Catalyst SD-WAN Manager authentication bypass flaw (CVE-2026-76504) to its Known Exploited Vulnerabilities catalog on September 30. On the technology front, Chinese hackers were reported to be impersonating AI experts to target US policy minds on October 1. Additionally, the NSA announced new post-quantum cryptography measures to safeguard national security systems on October 1.

#AnonNews_irc #Cybersecurity #News

Dell Container Storage Modules vulnerabilities CVE-2026-63688 and CVE-2026-63692 (CVSS 10) allow admin takeover. Upgrade to 1.18.0.

#Dell #ContainerStorageModules #CVE202663688 #CVE202663692 #CVE202667269 #Kubernetes #StorageSecurity

https://securityonline.info/dell-container-storage-modules-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Red Hat Directory Server 11: CVE-2026-86345 (CRITICAL, CVSS 9) allows on-path attackers to inject LDAP messages post-StartTLS, risking auth bypass. Restrict access, check Red Hat advisory https://radar.offseq.com/threat/cve-2026-86345-improper-restriction-of-communication-channel-to-intended-endpoints-in-red-hat-red-hat-bc48a6c684134ace #OffSeq #CVE202686345 #RedHat #LDAP #infosec

A 9.9 Foreman RCE flaw, CVE-2026-96658, lets low-privileged users run commands on Red Hat Satellite. A Viewer bug leaks root passwords.

#Foreman #RedHatSatellite #CVE202696658 #CVE202696659 #CVE202686345 #RCE #LDAP

https://securityonline.info/foreman-rce-cve-2026-96658/?utm_source=mastodon&utm_medium=jetpack_social