Daily digest,
PEERSTITCH Malware Compromises 500+ Firewalls via FortiManager… (+6 more)
Vulnerabilities
CVE-2026-104085: Command Injection in SPIP odt2spip Plugin
VulnCheck disclosed CVE-2026-104085, an OS command injection vulnerability in the odt2spip plugin for SPIP CMS versions up to 4.3.0. This flaw allows authenticated authors to execute arbitrary commands by uploading documents with malicious filenames. The vulnerability arises from insufficient sanitization of user-supplied filenames, which can include shell metacharacters. Affected users are those with low-privilege accounts who can upload documents. The risk is significant as it can lead to remote code execution as the web server user. The vulnerability was patched in version 4.4.0, released on 2026-10-07. Current CVSS score is 8.8, indicating a high severity level. No has been reported as of now.
Vulnerability · 2 sources · score 63 · CVE-2026-104085
Ransomware
Malicious Arch Linux AUR Packages Exploit Typos to Gain Root Access
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated popular tools yay and paru. The attack involved typosquatted package names, such as 'yyay', which contained legitimate code combined with a malicious installation script that executed a remote shell script with root privileges. The malicious packages were detected on October 13, 2026, following a warning from user James Smith on the AUR mailing list. The AUR team banned the account 'marchos1as' and removed the malicious packages shortly after confirmation of the threat. Users who downloaded these packages should assume their systems were compromised. This incident follows previous attacks in June and July that also targeted the AUR with malware. The malicious payloads were fetched from a repository hosted on GitFlic, and while there are potential links to a recent npm campaign, no direct connection has been confirmed.
Ransomware · 3 sources · score 71 · Chaos, Dirty Frag, DirtyBlanket
Breaches
Autonomous AI Attacks Using Stolen API Keys on the Rise
A criminal forum is promoting an autonomous hacking tool named MONST3R-AI that utilizes stolen OpenAI, Anthropic, and Google API keys, allowing attackers to conduct scans at the expense of the key owners. The tool reportedly has scanned 199 hosts, yielding 1,072 findings, although these numbers are unverified. The increase in discussions about AI agents and jailbreak techniques has surged, with mentions of open-weight models rising sharply. Meanwhile, ransomware discussions have dropped significantly, indicating a shift in focus among cybercriminals. Notably, the tool bypasses safety protocols by leveraging the API keys of unsuspecting victims. Additionally, a blog post detailed real-world AI-driven intrusions, including command executions and data theft. The CVE-2026-0766 vulnerability was exploited in some of these attacks, showcasing the evolving landscape of AI in cybersecurity threats.
Vulnerability · 2 sources · score 66 · CVE-2026-0766, SmartLoader
Central Ohio Primary Care Cyberattack Exposes 1.4 Million Records
Central Ohio Primary Care Physicians, Inc. reported a cyberattack linked to a vishing incident that may have compromised personal data of approximately 1.4 million patients and employees. The attack, discovered on August 25, 2026, involved a social-engineering phone scam that allowed unauthorized access to files containing protected health information. The organization stated that the incident has been contained and no further unauthorized access has occurred. MyChart (Epic) was not affected, and there are no known instances of misuse of the exposed data. The compromised information may include names, addresses, Social Security numbers, and limited health-related data. COPC is offering complimentary credit and dark web monitoring to those affected and has set up a dedicated call center for support. Written notifications will be sent to impacted individuals, and additional security measures are being implemented.
Breach · 3 sources · score 55
Threat actors and malware
PEERSTITCH Malware Compromises 500+ Firewalls via FortiManager Exploits
In September 2024, a multi-stage network intrusion targeted a telecommunications managed service provider, leading to the compromise of over 500 FortiGate firewalls. The attackers exploited CVE-2024-47575, a critical vulnerability in FortiManager, to gain unauthorized access and exfiltrate sensitive configuration data. Following this, they deployed PEERSTITCH, a novel memory-resident ARM64 malware, by exploiting CVE-2025-61624, a path traversal flaw in FortiOS. PEERSTITCH operates stealthily, leaving no persistent binaries and communicating through legitimate process traffic, making it difficult to detect. The attackers maintained long-term access and could intercept network traffic and establish unauthorized VPN sessions. The investigation by Palo Alto Networks' Unit 42 revealed that the compromised configurations included sensitive data such as routing tables and VPN credentials. The incident highlights significant vulnerabilities in Fortinet's management systems and the potential for widespread impact on client networks. Current protective measures include advanced security products from Palo Alto Networks.
APT · 4 sources · score 72 · CVE-2024-26008, CVE-2024-26009, CVE-2024-47575, CVE-2025-61624, UNC5820
Al Jazeera Condemns Spyware Attacks on Journalists
Al Jazeera Media Network condemned recent spyware attacks targeting its staff, describing them as an assault on press freedom. A report from Citizen Lab revealed that devices used by Al Jazeera and other organizations were infected with spyware from Candiru, an Israeli firm blacklisted by the U.S. government since 2021. The spyware was deployed through a 'zero-click' advertising attack, which allowed it to infect devices without user interaction. Al Jazeera stated that it collaborated with Citizen Lab to document these attacks and emphasized the need for accountability for those responsible. This incident follows a previous spyware attack reported by Al Jazeera four years ago, which affected 100 activists, journalists, and dissidents across ten countries.
APT · 2 sources · score 61 · Candiru
Also worth knowing
FBI Warns of Voice Cloning Scams Targeting 2026 Midterm Election Donations
The FBI issued a warning about scammers exploiting the upcoming 2026 US Midterm Election to commit financial fraud. These fraudsters are using candidates' names, logos, and slogans to solicit fake donations and steal personally identifiable information (PII). They employ AI tools to create realistic impersonations of candidates, making detection difficult for victims. One scheme involves promising guaranteed returns on campaign contributions through a fictitious investment pool. Victims are also targeted with fake voter registration messages to harvest their personal data. The FBI emphasizes that campaign donations are not investments and urges the public to verify solicitations independently. This alert follows a similar warning issued before the 2024 general election.
Other Threats · 5 sources · score 57
New on leak sites
77 victims listed on ransomware leak sites by 13 groups in the 24 hours before this issue. The most active:
Also moving
- APT groups: Candiru, ShadowSilk, ShinyHunters, Silent Lynx, UNC5820
- Ransomware groups: Chaos
- Campaigns: CL-STA-0954, DirtyBlanket, Eunavfor Aspides, Ledger Firmware Update, SmartLoader
- CVEs: CVE-2024-26008, CVE-2024-26009, CVE-2024-47575, CVE-2025-61624, CVE-2026-0766
- Vulnerabilities: Dirty Frag, FortiJump
- Malware: Iocontrol, Peerstitch, Shai-Hulud Worm
Get the next one by email
The digest is free and arrives every morning. One click to leave.
A free account turns the digest into a personal watchlist: choose what you want to follow.