Show Notes - 2026-10-12
Stories Covered:
- Today:
- FortiBleed Campaign Remains Active After Amassing 86,644 Fortinet Device Credentials (https://thehackernews.com/2026/10/fbi-warns-fortibleed-remains-active.html)
- Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE (https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html)
- SonicWall SMA1000 CVSS 10.0 SSRF Under Active Exploitation (https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure/)
- CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records (https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html)
- FBI Arrests Executive at Ransomware Negotiation Firm (https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/)
- ShinyHunters Suspects Arrested in US and Jordan (https://news.risky.biz/risky-bulletin-shinyhunters-suspects-arrested-in-us-and-jordan/)
- Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs (https://www.huntress.com/blog/screenconnect-power-bi)
- Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains (https://thehackernews.com/2026/10/attackers-hijack-gh-sl-and-as.html)
- Chromium V8 Engine Vulnerabilities (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-12727)
- AI-Driven Supply Chain Attacks Target Cloud Credentials (https://unit42.paloaltonetworks.com/web3-cloud-supply-chain-attacks/)
- Anthropic Cuts Internet Access for AI Testing After Rogue Agent Incidents (https://news.risky.biz/risky-bulletin-shinyhunters-suspects-arrested-in-us-and-jordan/)
- South Korea Probes AI Bank Hacks (https://news.risky.biz/risky-bulletin-shinyhunters-suspects-arrested-in-us-and-jordan/)
- Citrix NetScaler Critical Memory Overflow (https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/)
- Atlassian Data Center Arbitrary File Access Under Exploitation (https://thehackernews.com/2026/10/atlassian-data-center-flaw-draws.html)
- CISA Adds Five Flax Typhoon-Exploited Vulnerabilities to KEV (https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html)
- Eight Malicious npm Packages Deliver Overlord RAT (https://thehackernews.com/2026/10/eight-malicious-npm-packages-downloaded.html)
- PoeLLM Malware Targets AI/LLM Infrastructure (https://thehackernews.com/2026/10/poellm-malware-infects-3400-servers-to.html)
- Unpatched LMCache Critical Vulnerability (https://thehackernews.com/2026/10/unpatched-critical-lmcache-flaw-lets.html)
CVEs Referenced:
CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, CVE-2023-22894, CVE-2025-12432, CVE-2025-12441, CVE-2025-12727, CVE-2026-102255, CVE-2026-107406, CVE-2026-21589, CVE-2026-4815, CVE-2026-60137, CVE-2026-63030, CVE-2026-85097, CVE-2026-88771, CVE-2026-88772, CVE-2026-88779
Indicators of Compromise:
Domains: dailylifeproject[.]site, burnsworth[.]site, essaywritingservice[.]site, openpediatrics[.]site, openpediatrics[.]site.
IPs: 3.1.8.9, 3.1.8.10
Full brief: https://carolinacleartech.com/brief/2026-10-12/
