VulnHub

Researchers have disclosed a significant vulnerability in Fortinet's FortiSIEM product that could allow attackers to execute arbitrary code without authentication. This flaw, identified as CVE-2026-106173, has a CVSS score of 9.4, indicating its critical nature. An unauthenticated attacker could exploit this path traversal vulnerability to run unauthorized commands on affected systems. Given the potential for severe impacts, organizations using FortiSIEM need to take this threat seriously. The release of a proof-of-concept exploit makes it imperative for users to apply security patches promptly to safeguard their environments.

Palo Alto Networks has reported ongoing exploitation of a significant security flaw in its PAN-OS and Prisma Access products, identified as CVE-2026-0257. This vulnerability, which has a CVSS score of 7.8, allows attackers to bypass multi-factor authentication and create unauthorized VPN connections. Although the flaw was patched in May 2026, ransomware groups, including Qilin and INC, are still actively using this exploit to target organizations. This is particularly concerning for businesses relying on these systems for secure remote access, as it can lead to unauthorized access to sensitive data. Companies should ensure they have applied the latest patches and monitor their systems for any signs of exploitation.

A Chinese-speaking hacker has exploited an AI penetration testing tool called Cairn to automate attacks on hundreds of websites worldwide. Notable targets include major companies like John Deere, SharkNinja, and Cummins, leading to significant data theft and potential financial losses. The use of Cairn, typically designed for security testing, in this manner raises concerns about the accessibility of such tools for malicious use. This incident highlights the ongoing risks businesses face from cybercriminals who can leverage advanced technologies to carry out large-scale attacks. Companies need to enhance their cybersecurity measures to defend against these evolving threats.

Vladan Đokić, the rector of the University of Belgrade, had his iPhone infected with Pegasus spyware, a product of the NSO Group. This infection was confirmed by Citizen Lab on October 19, 2026, just six days before Serbia's snap parliamentary election on October 25. The spyware was delivered through a zero-click exploit, meaning Đokić didn't need to interact with any malicious content for the infection to occur. This incident raises concerns about the surveillance of political figures and the potential manipulation of the electoral process in Serbia. The timing of the attack, close to a major election, suggests a deliberate attempt to undermine or influence political activities in the country.

OVHcloud, a French cloud and hosting provider, has alerted users about a serious security incident involving their open-source command-line interface (CLI) tool. Attackers managed to compromise the tool and inject malware designed to steal sensitive developer information. This incident raises significant concerns, especially for developers using the CLI for cloud services, as it could lead to unauthorized access to credentials and other confidential data. Users are urged to check their installations and consider removing the compromised version of the CLI tool. This serves as a reminder of the vulnerabilities that can affect open-source software, where users must remain vigilant against potential threats.

On October 19, 2023, an attacker compromised a contributor's GitHub account and replaced the download files for five versions of OVHcloud's command-line interface (CLI) tool. These altered files contained malware designed to steal sensitive information from the machines running them. The malicious versions were available on GitHub for approximately 94 minutes, from 12:47 to 14:21 UTC, before being removed. This incident poses a significant risk to users who downloaded the compromised versions, as their stored secrets could be accessed by the attackers. OVHcloud's response underscores the need for vigilance in open-source projects, where account security is crucial to prevent similar incidents.

Siemens has released a fix for a significant vulnerability in its Siemens Software Center, identified as CVE-2026-110936, which has been actively exploited in attacks known as ClickFix. This high-severity flaw allows attackers to execute malicious code by placing a specially crafted dynamic link library (DLL) in a directory that the application searches. The vulnerability poses a serious risk as it enables unauthorized access with the same privileges as the application itself. Users of the Siemens Software Center should prioritize applying the latest updates to mitigate potential threats. This incident serves as a reminder of the importance of maintaining software security and regularly updating systems to protect against exploitation.

Researchers have identified a new malware delivery platform called ROMULUS, which is being used to spread Legion Loader and other malicious software. This platform operates by using deceptive ClickFix-style lures on fake landing pages, tricking users into executing harmful commands that lead to infections on their devices. The findings from Forescout Research - Vedere Labs indicate that unsuspecting users are particularly vulnerable, as they may unknowingly participate in their own compromise. This situation poses serious security risks not only to individuals but also to organizations that rely on their workforce to maintain cybersecurity hygiene. Users and companies need to be aware of these tactics to better protect themselves from such malware attacks.