VulnHub

Researchers have disclosed a significant vulnerability in Fortinet's FortiSIEM product that could allow attackers to execute arbitrary code without authentication. This flaw, identified as CVE-2026-106173, has a CVSS score of 9.4, indicating its critical nature. An unauthenticated attacker could exploit this path traversal vulnerability to run unauthorized commands on affected systems. Given the potential for severe impacts, organizations using FortiSIEM need to take this threat seriously. The release of a proof-of-concept exploit makes it imperative for users to apply security patches promptly to safeguard their environments.

Palo Alto Networks has reported ongoing exploitation of a significant security flaw in its PAN-OS and Prisma Access products, identified as CVE-2026-0257. This vulnerability, which has a CVSS score of 7.8, allows attackers to bypass multi-factor authentication and create unauthorized VPN connections. Although the flaw was patched in May 2026, ransomware groups, including Qilin and INC, are still actively using this exploit to target organizations. This is particularly concerning for businesses relying on these systems for secure remote access, as it can lead to unauthorized access to sensitive data. Companies should ensure they have applied the latest patches and monitor their systems for any signs of exploitation.

A Chinese-speaking hacker has exploited an AI penetration testing tool called Cairn to automate attacks on hundreds of websites worldwide. Notable targets include major companies like John Deere, SharkNinja, and Cummins, leading to significant data theft and potential financial losses. The use of Cairn, typically designed for security testing, in this manner raises concerns about the accessibility of such tools for malicious use. This incident highlights the ongoing risks businesses face from cybercriminals who can leverage advanced technologies to carry out large-scale attacks. Companies need to enhance their cybersecurity measures to defend against these evolving threats.

A security researcher observed a Chinese-speaking hacker group using autonomous AI agents to breach over 1,200 websites belonging to more than 100 companies, including well-known names like Deere. The hackers operated these AI agents with minimal supervision, allowing them to exploit vulnerabilities in the targeted sites. Remarkably, the attackers left their control panels exposed online, which enabled the researcher to witness the activity in real-time. This incident raises serious concerns about the security of corporate websites and the potential for widespread data breaches. Companies must take immediate action to secure their systems and prevent similar attacks in the future.

Researchers at Pillar Security have raised alarms about a critical remote code execution (RCE) vulnerability that was patched by OpenCode without notifying users. This oversight means that many users may remain unaware of the security risk they are exposed to, potentially putting their systems at risk. RCE flaws allow attackers to execute arbitrary code on a victim's machine, which can lead to severe data breaches or system compromises. The silent nature of the patch could leave users unprepared to protect themselves, as they might not realize their systems were vulnerable in the first place. This incident serves as a reminder of the importance of timely communication regarding security updates to ensure users can take necessary precautions.

A Nigerian national has been sentenced to eight years in prison for stealing $3.3 million from U.S. taxpayers through a series of spearphishing attacks that began in 2019. The individual targeted tax preparation businesses, using deceptive emails to gain access to sensitive information. This case is significant as it highlights the ongoing threat of cybercrime and the financial impact it can have on both individuals and the government. The actions of this hacker not only resulted in substantial financial loss but also raised concerns about the security measures in place within the tax preparation industry. As cyber threats continue to evolve, this incident serves as a reminder of the importance of vigilance against phishing attacks.

Vladan Đokić, the rector of the University of Belgrade, had his iPhone infected with Pegasus spyware, a product of the NSO Group. This infection was confirmed by Citizen Lab on October 19, 2026, just six days before Serbia's snap parliamentary election on October 25. The spyware was delivered through a zero-click exploit, meaning Đokić didn't need to interact with any malicious content for the infection to occur. This incident raises concerns about the surveillance of political figures and the potential manipulation of the electoral process in Serbia. The timing of the attack, close to a major election, suggests a deliberate attempt to undermine or influence political activities in the country.

Threat actors have been exploiting the AI platform Cairn to gain unauthorized access to over 100 organizations, leading to significant financial theft. At least three different groups are involved in these attacks, which have allowed them to maintain persistent access to their victims' systems. This situation raises concerns not only for the affected organizations but also for the broader business community, as it highlights vulnerabilities in AI platforms that could be targeted for malicious purposes. Organizations using Cairn should take immediate steps to assess their security measures and consider implementing stronger access controls to prevent similar breaches.