Threat Alerts

A large-scale intrusion campaign attributed to the k0t threat actor is targeting internet-facing network edge devices, particularly Fortinet FortiGate, FortiWeb, and Palo Alto GlobalProtect appliances. The operators identify exposed systems using public attack-surface search engines and gain initial access through a combination of vulnerability exploitation and credential brute-forcing. Observed exploitation includes CVE-2025-64446, affecting FortiWeb, and CVE-2026-0257, affecting certain PAN-OS GlobalProtect configurations.

Following initial compromise, the attackers harvest credentials and configuration data from affected devices, establish VPN access using OpenConnect, and conduct hands-on-keyboard activity inside victim environments. The campaign has also deployed legitimate remote-management tools such as MeshCentral/MeshAgent and Atera, alongside AdaptixC2, to maintain persistent access. More than 70,000 exposed credentials and configuration-related records were identified in the campaign dataset, including network-device and LDAP-related credentials.

Compromised environments have experienced additional credential theft, attempts to escalate toward domain-administrator access, and data exfiltration.

A critical vulnerability, tracked as CVE-2026-110264 (CVSS 10.0 – Critical), affects GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw is caused by an integer overflow in the regular expression compiler and can be triggered when GitLab processes a specially crafted regular expression. Under certain conditions, an unauthenticated remote attacker could exploit the vulnerability to execute arbitrary code on the GitLab server, without requiring user interaction or existing privileges.

The vulnerability affects GitLab CE/EE versions 7.0 through affected 18.x and 19.x releases. Fixed versions include 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. GitLab.com has already been patched, while GitLab Dedicated environments running 19.3.5-internal0, 19.4.2-internal0, or later already contain the fixes. GitLab also released detections for potential exploitation attempts involving native worker crashes and bursts of Org-mode rendering errors.

The same security release addresses 11 additional vulnerabilities in GitLab, including two high-severity issues involving account takeover through OmniAuth-to-LDAP auto-linking and OAuth/OIDC discovery cache poisoning, as well as several medium- and low-severity access control, information exposure, and authorization issues.

Oracle released its October 2026 Critical Patch Update, delivering 1,295 security patches addressing approximately 1,209 unique vulnerabilities across 33 product families. Among the most severe is CVE-2026-101809 (CVSS 10.0), a critical vulnerability affecting the Workflow Notification Mailer component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw allows unauthenticated attackers to remotely compromise the affected component over HTTP, potentially gaining complete control of Workflow and compromising its confidentiality, integrity, and availability. Another critical vulnerability, CVE-2026-101767 (CVSS 9.8), affects the Oracle Application Object Library Core component in the same E-Business Suite versions. It can also be exploited remotely without authentication or user interaction, potentially resulting in a complete compromise of the affected component.

Additional critical vulnerabilities include CVE-2026-75803 (CVSS 9.8), affecting the OpenSSL component of Oracle Database Server, which could allow unauthenticated attackers to compromise the affected component through TLS network access, and CVE-2026-101521 (CVSS 9.8), affecting Oracle APEX, which enables unauthenticated takeover through HTTPS. Although active exploitation of these newly disclosed vulnerabilities has not been confirmed, Oracle has warned of successful attacks against customers running unpatched systems. Previous exploitation campaigns targeting Oracle E-Business Suite, including attacks associated with CVE-2025-61882, further emphasize the risks posed by vulnerabilities in enterprise applications.

Cisco released security updates addressing multiple vulnerabilities in its Expressway Series, including a critical remote code execution flaw tracked as CVE-2026-76466 (CVSS 9.8). The vulnerability affects Cisco Expressway Core (Expressway-C) and Expressway Edge (Expressway-E) devices configured in clusters, including both physical and virtual deployments. The flaw originates from the use of persistent cookies and insufficient client certificate validation when TLS verification is enabled for clustering. An unauthenticated remote attacker in possession of the required cookies could connect to the database service and invoke specific remote procedure call (RPC) commands, potentially executing arbitrary operating system commands with root privileges. Successful exploitation could result in complete compromise of affected devices, including unauthorized access to sensitive information and disruption of communication services.

The update also addresses eight additional high-severity vulnerability groups, tracked as CVE-2026-76490 through CVE-2026-76497, with CVSS scores reaching 8.6. These include improper resource permissions, code injection, insecure temporary files, and vulnerabilities that could affect system availability. Unlike the critical RCE flaw, which specifically affects clustered deployments, these additional vulnerabilities affect Expressway-C and Expressway-E devices regardless of their configuration. Cisco has released version X15.5.20 to address the vulnerabilities, while systems running X14 or earlier require migration to a supported fixed release. No workarounds are available, and Cisco has not reported evidence of active exploitation.

The Node.js project released security updates for the 26.x, 24.x, and 22.x release lines to address multiple vulnerabilities. The highest-severity issue, CVE-2026-111497 (CVSS 9.2), is an out-of-bounds write vulnerability in the Brotli decoder that could allow remote code execution when processing crafted compressed data. The release rates the issue High across all three supported release lines. Other vulnerabilities affect different combinations of the supported versions with some limited to Node.js 26.x and 24.x or exclusively to 26.x.

The updates also address vulnerabilities in bundled third-party dependencies, including c-ares, Undici, OpenSSL, and SQLite, with affected components varying by release line. The security fixes are available in updated releases of Node.js 26.x, 24.x, and 22.x. Given the potential for remote code execution through the Brotli decoder, administrators should prioritize upgrading to a patched version

Fortinet has released a coordinated set of security updates addressing critical and high-severity vulnerabilities across several products, including FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator. The vulnerabilities were identified as part of proactive security testing and are being addressed through new fixed releases. Fortinet has urged customers to treat the updates as a priority security change, particularly for internet-facing appliances.

Affected FortiOS releases include versions across the 8.0, 7.6, 7.4, and 7.2 branches, while corresponding vulnerable versions of FortiManager and FortiAnalyzer are also affected. FortiMail and FortiAuthenticator received separate fixed releases. Fortinet has not yet disclosed the individual CVEs, CVSS scores, or detailed exploitation conditions and plans to publish the associated PSIRT advisories on November 10, 2026.