Security Bulletin

❓What:

• The FBI and US Secret Service issued a warning on October 6 that the FortiBleed campaign against Fortinet FortiGate firewalls and SSL VPN gateways is still ongoing. infosecurity-magazine

• The notice cites SOCRadar figures of 86,644 compromised devices across 194 countries. infosecurity-magazine

• The advisory cites no CVE. Fortinet believes attackers are reusing previously stolen credentials and brute-forcing devices with weak passwords and no MFA. dailysecurityreviewcybersecuritydive

• Attackers create new accounts and, in some cases, delete existing ones to block organizations from their own devices. helpnetsecurity

❓What:

• Attackers are exploiting two critical flaws in Citrix NetScaler ADC and NetScaler Gateway, and both were exploited before a patch existed. thenextweb

• CVE-2026-88771 lets an attacker run commands without logging in and affects all NetScaler ADC and Gateway deployments, including the default setup. thenextweb

• CVE-2026-88772 is a memory overflow that can lead to remote code execution or a crash; it requires DTLS, which is enabled by default on VPN servers. thenextweb

• Both flaws carry CVSS 4.0 scores of 9.5. bankinfosecurity

❓What:

• F5 Labs disclosed an automated mass-scanning campaign, observed in August 2026, exploiting CVE-2026-39364 (CVSS 8.2), a high-severity Vite vulnerability

• The flaw lets an unauthenticated attacker bypass Vite's server.fs.deny protections using query parameter manipulation (e.g., ?raw, ?import&raw, ?import&url&inline) appended to /@fs/ requests

• Exploitation requires three conditions: the dev server is exposed to the network (via --host or server.host), the target file exists within server.fs.allow directories, and it's a file normally blocked by server.fs.deny

• Under default config, Vite binds to localhost only — exposure typically results from developers passing --host, setting server.host, or misconfigured Docker port mappings

❓What:

• Arctic Wolf is tracking an active cluster (PREY-0058) using voice phishing to compromise Microsoft 365 and connected SaaS platforms — no software vulnerability involved

• Actors impersonate IT/Helpdesk staff via phone calls or texts, directing victims — primarily Directors, VPs, and executives — to Adversary-in-the-Middle (AiTM) phishing pages

• AiTM pages capture credentials and MFA tokens in real time, defeating standard MFA

• Static residential proxy infrastructure (NodeMaven, seen in the majority of cases) is used to mimic legitimate login behavior and evade detection