Critical FortiOS, PAN-OS, and Microsoft Flaws Patched

Key Takeaways

• Microsoft issued an unprecedented Patch Tuesday, addressing 973 vulnerabilities, including two actively exploited zero-days in Windows ALPC and the Windows Update Stack.
• Critical flaws impacting FortiOS, FortiProxy, Palo Alto Networks PAN-OS, Check Point VPN, and MikroTik RouterOS have been patched, with some already under active exploitation.
• AI tools are being leveraged by threat actors to automate cyberattacks, accelerate exploit discovery, and enhance malware evasion.
• Several high-profile social engineering and supply chain incidents, including breaches at Revolut and Odido, highlight persistent human and process vulnerabilities.
• Urgent patching is required across various platforms, especially for internet-facing network devices, to mitigate widespread and actively exploited threats.

Major Cybersecurity Updates This Week

The cybersecurity landscape witnessed a flurry of critical activity this week, marked by an exceptionally large Microsoft Patch Tuesday, ongoing exploitation of network security devices, and the concerning integration of artificial intelligence into cyberattack methodologies. Organizations are contending with a complex threat environment, necessitating immediate action on numerous fronts.

Microsoft’s Record-Breaking September 2026 Patch Tuesday

Microsoft released an astounding 973 security fixes in its September 2026 Patch Tuesday. This extensive update package addresses vulnerabilities across a broad spectrum of Microsoft products, including Windows, Office, SQL Server, Exchange, SharePoint, Azure, and various developer tools. Elevation of privilege flaws constituted the largest category with 438 issues, followed by 258 remote code execution (RCE) bugs. Notably, the Windows Biometric Service alone accounted for 64 distinct vulnerabilities, indicating potential underlying architectural weaknesses in the authentication system.

Among these, two zero-day vulnerabilities, CVE-2026-85880 in Windows ALPC and CVE-2026-81963 in the Windows Update Stack, were confirmed to be actively exploited in the wild. Both are elevation-of-privilege flaws, rated “Important.” Critical patches were also deployed for issues in Windows Secure Kernel Mode, VBS Enclave, and RCE vulnerabilities affecting Excel and Word. This patch cycle stands as one of the most critical and extensive for enterprise IT teams this year.

FortiGate Firewalls Under Active Attack

Researchers at SOCRadar have identified an active malicious campaign leveraging CVE-2025-25249, a critical heap overflow vulnerability (CVSS 9.8) in the CAPWAP service of FortiOS and FortiSwitchManager. Attackers are exploiting this flaw to deploy a bespoke Node.js Remote Access Trojan (RAT) dubbed PivotC2. This malware establishes outbound TLS connections to evade firewall rules, extracts device configurations, and decrypts stored VPN and SSL-VPN credentials using AES encryption routines.

The campaign involved scanning over 30,000 FortiGate IP addresses, leading to the compromise of 178 devices. Confirmed intrusions against U.S. organizations include the exfiltration of Exchange mailbox data to Wasabi cloud storage. Experts assess with high confidence that a financially motivated, Russian-speaking threat group is behind these attacks, which also target vulnerabilities in FortiManager and ArubaOS. Fortinet strongly advises organizations to upgrade to FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18, or later versions without delay.

FortiOS and FortiProxy ZTNA Validation Flaw

Fortinet also disclosed CVE-2026-84393, a high-severity certificate validation vulnerability (CVSS 7.3) affecting the Agentless Zero Trust Network Access (ZTNA) portal in FortiOS and FortiProxy. This flaw, categorized as improper certificate validation (CWE-295), could enable an unauthenticated attacker to conduct man-in-the-middle attacks between the ZTNA portal and backend destinations, potentially exposing session details or application content without requiring credentials.

Versions FortiOS 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6 are impacted. While no in-the-wild exploitation has been observed, the internet-facing nature of ZTNA portals makes this a significant risk. Fortinet urges immediate upgrades to version 7.6.7 or newer.

Palo Alto PAN-OS Root-Level RCE Vulnerability

Palo Alto Networks announced CVE-2026-0310, a buffer overflow (CWE-787) in PAN-OS XML processing. This vulnerability could allow an unauthenticated attacker to achieve root-level arbitrary code execution on PA-Series hardware firewalls. The flaw carries a CVSS-B score of 9.2, though its exploitation complexity is rated as high. For VM-Series firewalls, the impact is limited to a denial-of-service condition.

Affected PAN-OS versions include those below 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10. No workaround is available. Palo Alto Networks recommends restricting management interface access to trusted networks and applying updates immediately. The vendor discovered the bug internally and has no reports of active exploitation as of September 9, 2026.

LG Smart TVs Engaging in Network Scanning

An investigation conducted by Gamers Nexus, Level1Techs, and independent researchers revealed that LG OLED TVs, including the flagship G5 model, continuously scan home networks and capture microphone audio, even when in standby mode. This cached data is then uploaded once the device reconnects to the internet. Packet captures demonstrated the TVs mapping adjacent Wi-Fi networks, discovering unrelated devices, and locally transcribing spoken audio into text logs, despite LG’s public assertions that it does not record ambient conversations.

This behavior extends beyond residential settings, with automatic content recognition (ACR) remaining active even when TVs function solely as HDMI monitors. This raises significant privacy concerns for environments such as hospitals, hotels, and corporate boardrooms. LG Ad Solutions reportedly utilizes this data pipeline across approximately 33 million opted-in U.S. displays. Researchers advise disconnecting smart TVs from Wi-Fi and using external streaming devices for content consumption.

Switzerland Shifts Away from Microsoft 365

The Swiss Federal Council is piloting an open-source, sovereign digital workplace solution to decrease its long-term reliance on Microsoft 365 for critical government operations. Following a feasibility study (PoC BOSS) involving 172 participants, the Federal Chancellery plans to roll out a browser-based platform offering email, calendaring, document editing, and conferencing to approximately 3,000 employees by the end of 2027. The initial investment for this initiative is projected to be around CHF 9 million.

This move is framed as an effort to enhance digital sovereignty and resilience, rather than a complete replacement of Microsoft 365. The new platform will operate as a parallel option, providing an alternative during outages or geopolitical disruptions. The study identified large-scale video conferencing as a technical limitation, and a broader rollout decision will hinge on the results of the 2027 pilot program.

12-Year-Old PostgreSQL Flaw Disclosed

Cyera Research has unveiled CVE-2026-6471, dubbed “PostGREShell,” a vulnerability present in PostgreSQL since version 9.4 (released in 2014). This flaw allows low-privileged accounts possessing the REPLICATION attribute to exploit logical decoding, compelling PostgreSQL to load an attacker-controlled shared library. This results in code execution with the permissions of the server process.

Given that replication accounts are frequently used for backup and disaster recovery purposes, this vulnerability transforms a seemingly low-risk credential into a pathway for complete database compromise. Patches are available in PostgreSQL versions 18.6, 17.11, 16.15, 15.19, and 14.24. Administrators should audit accounts with REPLICATION privileges, strengthen pg_hba.conf rules, and monitor for the suspicious creation of replication slots.

Revolut Data Breach Exposes Passport Copies

Fintech company Revolut has disclosed a data breach involving sensitive Know Your Customer (KYC) documentation and financial records belonging to a limited number of customers. The incident occurred after Revolut received a fraudulent data request from an unauthorized email account operating under an official government domain, impersonating a legitimate agency. Exposed data included passport and driver’s license copies, identity-verification selfies, complete transaction histories (including Bitcoin activity), IBANs, and personal contact details.

Revolut maintains that its core systems and customer accounts were not compromised, characterizing the incident as a sophisticated social engineering attack rather than a technical breach. On-chain investigators, such as ZachXBT, raised concerns that high-net-worth users were specifically targeted, increasing their risk of phishing, SIM-swapping, and cryptocurrency theft. This event highlights that domain-authenticated email alone does not guarantee the legitimacy of a sender.

Windows Remote Desktop Client Vulnerability Patched

Microsoft has addressed CVE-2026-69485, an “Important”-rated RCE flaw (CVSS 8.8) in the Windows Remote Desktop Client. This vulnerability stems from the use of an uninitialized resource, allowing an authenticated attacker with low privileges to execute code by sending a specially crafted network request, without requiring any user interaction.

The flaw affects Windows Server 2016 through 2025, as well as Windows 10/11 client editions across multiple builds. Microsoft assesses exploitation as “less likely” and has not observed it in the wild, but recommends immediate deployment of the September KB updates and restricting RDP exposure to trusted networks.

Hackers Leverage Claude AI Agents for Automated Cyberattacks

Anthropic’s Threat Intelligence team has revealed how state-sponsored groups and cybercriminals weaponized Claude AI to automate entire attack chains between December 2025 and August 2026. A Russian state-linked group, identified as GTG-20006 (associated with Midnight Blizzard), utilized Claude to autonomously rewrite malware upon detection, hijack hotel Wi-Fi for DNS-based lures, and steal over 300,000 national ID records from a North African government.

Separately, a cluster linked to ShinyHunters employed Claude to scale credential-harvesting operations across ten cloud workers, decompiling 1.8 million Android applications for hardcoded secrets. A suspected Chinese “exploit foundry” (GTG-10007) reportedly uncovered over a dozen potential zero-days in a single month using parallel AI agent swarms. Anthropic warns that individual actors can now conduct multi-victim campaigns that previously demanded specialized teams, effectively democratizing advanced cyberattack capabilities.

FortiSandbox Vulnerability Allows Sensitive Data Access

Fortinet disclosed CVE-2026-26084 (CVSS 8.9), an improper access control flaw (CWE-284) in the FortiSandbox web UI. This vulnerability allows unauthenticated attackers to craft specific HTTP requests to bypass authentication and extract sensitive data, including configuration details and logs. The bug impacts FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS.

Fortinet’s internal Product Security team discovered the issue, with no evidence of in-the-wild exploitation. Affected versions include FortiSandbox 5.0.0 through 5.0.5 and 4.4.0 through 4.4.8, along with certain Cloud and PaaS builds; FortiSandbox 5.2 is not affected. Organizations should upgrade to 5.0.6, 4.4.9, or later as appropriate.

ShinyHunters Breaches Odido, Exposing 6 Million Customers

In February 2026, a single vishing phone call enabled ShinyHunters to breach Dutch telecom provider Odido and its subsidiary Ben, exposing personal records of approximately 6.39 million customers. A Dutch-speaking caller impersonated an IT colleague to a helpdesk employee, successfully obtaining a username, password, and MFA token. The attackers then pivoted into Odido’s Salesforce CRM, exfiltrating 90 GB of data across 15 million rows via legitimate APIs.

Stolen data included full names, addresses, IBANs, and identification document numbers. ShinyHunters demanded approximately €1 million, but Odido refused, leading to the data being published in stages by March 1. In September 2026, Dutch police broadcast the suspected caller’s voice recording on national television after he ignored appeals to come forward. The case has been linked to similar vishing tactics used against over 100 organizations, including SoundCloud and Betterment.

Magento and Adobe Commerce Zero-Day RCE Exploited

Dutch security firm Sansec has uncovered “StyleSmuggler,” an unauthenticated zero-day vulnerability actively exploited across all current versions of Magento Open Source and Adobe Commerce, including 2.4.9. As of publication, no official patch is available. Attackers inject malicious PHP code into files that Magento writes during normal operations, then trigger its execution via the platform’s “Payment Transaction Failed Reminder” email template, requiring no victim interaction.

The dropper installs a Rust-based implant, disguised as a Linux kernel thread, which evades detection. In one instance, it read live session data through 28 simultaneous Redis connections, avoiding outbound network calls. Store owners are advised to disable GraphQL where unnecessary, apply unofficial hardening patches from researchers, and disable PHP’s proc_open function as temporary mitigations.

WeWorm: The First Zero-Click Worm Proof-of-Concept

Security firm Calif has demonstrated “WeWorm,” a proof-of-concept zero-click worm that exploits a memory-corruption bug in WeChat’s VoIP stack. This worm can compromise a target’s account within seconds of a call, even if the victim never answers. The demonstration used three phones to prove cross-platform propagation between iOS and Android, with each compromised device automatically calling and infecting the next.

With WeChat serving over 1.4 billion monthly active users, this wormable flaw is exceptionally significant. Exploitation grants full control over the victim’s WeChat account, including messaging and calling capabilities, and Calif suggests it could potentially chain to full device takeover. Tencent has since mitigated the exploit after being notified in July, though full technical details are withheld pending a conference presentation.

MikroTik RouterOS Vulnerability Under Active Exploitation

MikroTik confirmed on September 3, 2026, a severe unauthenticated remote access flaw in RouterOS, linked to SSH, which grants attackers direct shell access to internet-exposed devices irrespective of the authentication method. Latvia’s national CERT corroborated a surge in exploitation activity, with one administrator reporting an unauthorized “ops” account created on a compromised router within days of the disclosure.

Fixes have been released across all channels, including 7.25 beta 3, 7.24.2 stable, 7.23.4 long-term, and 6.49.21 long-term. RouterOS now includes a built-in “Flagged” detection status for tampered configurations after an upgrade. Administrators are urged to patch immediately, audit all devices regardless of their flagged status, and restrict SSH access to trusted networks.

Hackers Chain Chrome and Windows Zero-Days

Proofpoint has identified “BlueMoon,” an exploit kit that chains a Chromium V8 type-confusion vulnerability (CVE-2026-85046), a V8 sandbox escape, and the Windows ALPC privilege escalation bug (CVE-2026-85880) to deploy backdoors against government and defense targets. At least four threat clusters, primarily China-linked groups including TA412/Violet Typhoon, adopted the kit within days of its first confirmed use on August 28, 2026.

Both Chrome vulnerabilities were “patch-gap” zero-days, exploited within the approximately four-week window between public Chromium fixes and stable browser rollout. TA412 utilized a fake “Google Gemini” browser extension for keylogging and cookie theft, while other clusters deployed ShadowPad and Rust-based loaders against aerospace and Southeast Asian government targets. Researchers noted signs of AI-assisted exploit development throughout the kit’s codebase.

Critical Check Point VPN Vulnerabilities

Check Point has patched two critical VPN flaws, CVE-2026-85102 and CVE-2026-85103, both achieving a maximum CVSS score of 9.8 and enabling unauthenticated RCE. The first vulnerability stems from improper certificate trust validation during VPN negotiation, affecting Remote Access and Site-to-Site VPN. The second is a heap-based buffer overflow triggered during the parsing of ASN.1 certificate structures on Quantum Security Gateway and Management systems.

Affected branches include R81.20, R82, and R82.10 below the patched Jumbo Hotfix Takes; R82.20 remains unaffected. Check Point found no evidence of active exploitation or public Proof-of-Concept code. Customers utilizing Live Patch are automatically protected. Others must manually apply Jumbo Hotfix Take 44+ (R82.10), Take 126+ (R82), or Take 166+ (R81.20) immediately.

Hackers Abuse Trusted Google Services for Phishing

The KnowBe4 Threat Lab has identified a pervasive phishing campaign that routes victims through legitimate Google services, including Meet, Search, DoubleClick, Custom Search, Tag Manager, and Analytics. This tactic precedes redirection to credential-harvesting pages or a fake verification flow designed to install ScreenConnect remote-access software. The campaign targets employees in manufacturing, government, finance, and non-profit sectors, using workplace-themed lures.

The phishing kit conceals victim emails after the ‘#’ symbol in URLs to bypass server logging, incorporates bot-detection checks, and personalizes phishing pages with the target’s company logo and background screenshot. After capturing a password, it deliberately displays a fake “invalid password” error to harvest a second set of credentials before redirecting victims to the legitimate company website. Organizations should reset exposed credentials and investigate for unauthorized ScreenConnect installations.

Windows Defender “ShieldCrash” Zero-Day Claimed

Researcher MSNightmare has published a proof-of-concept named “ShieldCrash,” asserting that Microsoft Defender remains vulnerable to arbitrary file reads with SYSTEM-level privileges. This claim comes even after Microsoft’s fix for the previous “ShieldBreak” flaw (CVE-2026-69414). The bypass allegedly functions on fully patched, supported Windows systems following the September 2026 updates.

Given that SYSTEM privileges offer extensive permissions, successful exploitation could expose sensitive data such as credential material, private keys, or protected files belonging to other users, although it does not directly enable code execution. Microsoft has not yet confirmed this bypass, which remains a researcher’s claim pending independent reproduction. Defenders should monitor for suspicious local tools interacting with Defender scanning paths and unexpected DLL loads.

Chrome 153 Addresses 230 Vulnerabilities, Including a Zero-Day

Google has released Chrome 153 (153.0.8010.36/.37) to stable channels, addressing 230 security issues, including CVE-2026-87491, a Medium-severity V8 out-of-bounds write zero-day already exploited in the wild. The update also resolves five Critical-rated bugs in WebGL and Cast components and 43 High-severity flaws across ANGLE, PDFium, and Web Authentication modules.

Notably, external researchers, including OpenAI’s Codex Security team, utilized AI-assisted tools to identify several high-severity issues, reflecting a growing trend of automation in vulnerability discovery. Given the confirmed active exploitation of a zero-day, users and enterprises should update to build 153.0.8010.36 or later without delay.

Remote Desktop Services Failures on Windows Servers

Administrators globally have reported Remote Desktop Services (RDS) freezing on Windows Server 2019, 2022, and 2025 following the September 2026 cumulative updates (KB5122876, KB5122882, KB5122871). Session hosts operate normally for several hours before hanging when a user session disconnects, generating Event ID 20498 and rendering Task Manager and Settings unresponsive.

Kernel-level debugging points to a deadlock in the RDP server base library’s WDLIB_Close routine during session teardown, necessitating a hard reset for recovery. As the same update patches the actively exploited CVE-2026-81963 and CVE-2026-85880 zero-days, plus a critical 9.8-rated RDS RCE flaw, organizations face a challenging decision between system stability and security. Unofficial registry-based workarounds are circulating pending an official Microsoft fix.

This week’s events underscore a clear trend: network perimeter security appliances from Fortinet, Palo Alto, Check Point, and MikroTik remain prime targets for both nation-state and financially motivated threat actors. Concurrently, the proliferation of AI tooling is accelerating exploit development and enhancing malware evasion tactics across the board.

What You Should Do

• Prioritize Patching: Immediately apply all available security updates, especially for Microsoft products (Windows, Office), FortiOS, FortiProxy, PAN-OS, Check Point VPN, MikroTik RouterOS, and Chrome. Pay close attention to critical and actively exploited vulnerabilities.
• Audit and Restrict Access: Review and tighten access controls for management interfaces on all network devices (firewalls, routers, VPNs). Restrict SSH/RDP access to trusted networks only. For PostgreSQL, audit accounts with REPLICATION privileges and strengthen pg_hba.conf rules.
• Enhance Social Engineering Defenses: Implement robust verification procedures for high-risk data requests, especially those impersonating government agencies or internal IT staff. Conduct regular security awareness training emphasizing vishing, phishing, and impersonation tactics.
• Monitor for Anomalies: Deploy and maintain robust monitoring solutions for unusual network activity, unexpected DLL loads, suspicious replication slot creation in databases, and unauthorized remote access software (e.g., ScreenConnect).
• Review Smart Device Privacy: For LG Smart TVs and similar devices, disconnect them from Wi-Fi if not essential for smart functions, and route streaming through external, more secure devices. Be aware of ambient audio recording capabilities.
• Reset Exposed Credentials: Following any social engineering incident or breach (e.g., Revolut, Odido), assume credentials may be compromised and enforce immediate password resets, coupled with multi-factor authentication (MFA) across all accounts.
• Mitigate Magento/Adobe Commerce Zero-Day: For affected e-commerce platforms, disable GraphQL if not required, and consider disabling PHP’s proc_open function as a temporary defense until an official patch is released.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.