Cybersecurity News — 2026-10-09

Generated: 2026-10-09 | Sources: FBI, CISA, Citrix, SonicWall, Atlassian, Patchstack, watchTowr, Previdian, Island, Apiiro, Bitdefender, US Department of Justice, Italian Garante, The Hacker News, SecurityWeek, BleepingComputer

1. A Flaw in a WordPress Form Plugin on 500,000 Sites Is Being Used to Create Hidden Admin Accounts

Ninja Forms is one of the most widely installed contact-form plugins for WordPress, running on more than 500,000 sites — it is the thing behind "get in touch", quote requests and booking enquiries on a great many small-business websites. CVE-2026-94504 is a stored cross-site scripting flaw, which means an attacker can leave malicious JavaScript inside a form submission; the code does nothing until a logged-in administrator opens the submission to read it, at which point it runs with that administrator's own permissions. Patchstack found a campaign using it, and what it does next is the serious part: it installs a plugin disguised as "WP Smart Thumbnails" and leaves four separate ways back in — a visible administrator account, a hidden one, a secret login URL and a file manager that needs no password. Versions 3.15.3 and earlier are affected; 3.15.4 fixes it. Patchstack identified the same campaign hitting a different WooCommerce plugin on 4 October and Ninja Forms on 5 October, and describes exploitation so far as limited.

Why it matters for your business: the trigger here is the ordinary act of reading your own enquiries, so "we don't click on anything suspicious" is no protection. Update Ninja Forms to 3.15.4 today — Plugins, then Update, and it takes under a minute. Then, because this plugin's whole purpose is to be exploited before anyone notices, check the two things the campaign leaves behind: Users in the WordPress dashboard, where every administrator account should be a person you can name, and the plugin list, where anything you did not install deliberately should go. If you find either, assume the site needs rebuilding rather than tidying.

2. Attackers Were Hitting a Critical Atlassian Flaw Within Hours of the Research Being Published

Atlassian makes Jira, Confluence and Bitbucket — the systems many businesses use for tracking work, keeping internal documentation and storing source code. CVE-2026-21589, rated 9.3 out of 10, affects the self-hosted Data Center editions, the ones a company runs on its own server rather than paying Atlassian to host. It lets an attacker with no login read files from the server, provided they know the exact name and path. That sounds narrow, and the researchers at watchTowr showed why it is not: in deployments that use Atlassian's Crowd for sign-on, one of the readable files holds a username and password in plain text, which is enough to create a brand-new administrator through Crowd's own interface — and, in some setups, administrator access to Confluence and Bitbucket too. The timeline is the lesson. Atlassian disclosed the flaw on 5 October, watchTowr published its analysis and working proof-of-concept code on 6 October, and the exploitation-tracking firm Previdian saw attack attempts against its decoy systems within about two hours of that publication — 190 attempts from 32 addresses by 8 October.

Why it matters for your business: the window between "this is now public" and "this is now being attacked" has effectively closed, and that changes what a sensible patching schedule looks like. For anything reachable from the internet, "we patch monthly" is no longer a policy, it is a gamble on nobody publishing research in the meantime. If you self-host any Atlassian product, patch it now and, if you cannot, do what Atlassian suggests and take it off the internet until you can — an internal work tracker almost never needs to be publicly reachable. If Atlassian hosts it for you, there is nothing for you to do here, which is itself a reason to prefer hosted versions of internal tools.

3. Citrix Has Now Asked the Same Customers to Patch Four Times in a Fortnight

This briefing covered two actively exploited NetScaler flaws last week. What has changed is that there are now two more, and the most recent arrived after customers had already patched twice. NetScaler ADC and Gateway are the appliances that handle staff logging in from outside the office. On 4 October Citrix released an emergency fix for CVE-2026-88779, rated 8.7, which it classifies as denial of service — it crashes the appliance — and which was already being used against deployments using SAML, a common single-sign-on arrangement; CISA added it to its known-exploited list and gave US federal agencies until 7 October. Administrators had been reporting appliances rebooting repeatedly, including ones already on the previous patch. Then on 8 October Citrix disclosed CVE-2026-107406, rated 9.5, also in SAML configurations, which can allow remote code execution as well as a crash, and which also reaches Secure Private Access Hybrid deployments. Citrix says it is not aware of exploitation of this newest one. The fixed versions are 14.1-73.46 and 13.1-64.29, with 13.1-37.283 for FIPS and NDcPP builds — later than the versions issued days earlier.

Why it matters for your business: if you have one of these, the practical instruction is to go and check the running version against those numbers rather than trusting that you patched recently, because "we're up to date" meant something different on Monday. The more general point is worth sitting with: four flaws in one product line in two weeks is a pattern, not bad luck, and it tells you something about where attackers are concentrating. Every flaw under active attack this week — this one, the Atlassian flaw above, and the Fortinet problem below — is in a system whose job is to let people log in from outside. Those deserve your fastest patching and your closest attention, ahead of the laptops.

4. The FBI Says Attackers Using Leaked Fortinet Passwords Are Now Deleting the Administrators

In June, a server was found exposed that held usernames and plaintext passwords tied to 73,932 firewall web addresses across 194 countries — a collection now known as FortiBleed. It is worth being precise: this is not a software flaw and there is no CVE to patch. It is a pile of working credentials for FortiGate firewalls, and the security firm SOCRadar now counts 86,644 affected devices and has linked its use to the INC and Lynx ransomware operations. On 7 October the FBI warned that attacks are ongoing. Attackers sign in to exposed FortiGate SSL VPN endpoints using the leaked passwords, credentials harvested by information-stealing malware, or password guessing at scale; they pull further authentication data off the device and crack the password hashes offline on a cluster of graphics cards. In some incidents they then create their own administrator account and delete or change the password of the real ones — locking out the people who would otherwise evict them — before moving further into the network. The FBI's blunt opening point is that patching and resetting passwords may not be enough.

Why it matters for your business: the FBI's own list is the right checklist and most of it is a phone call to whoever runs your firewall. Ask them to restrict management access so the device cannot be administered from the internet, to terminate every active VPN session so a stolen session cannot be reused, to turn on multi-factor authentication for VPN logins if it is not on, and to read the device's logs for administrator accounts or configuration changes nobody authorised. One item is more technical and worth quoting at them directly: store administrator passwords using PBKDF2 rather than the older SHA-256 hashing, because the old format is what makes offline cracking practical. If your supplier cannot answer whether that has been done, that is itself the answer.

5. SonicWall Patched a Remote-Access Gateway Flaw Rated the Maximum 10 out of 10

SonicWall's SMA1000 is a secure remote-access gateway — the box that lets staff reach internal systems from home. CVE-2026-102255 scores a full 10 out of 10 and is a pre-authentication server-side request forgery flaw: the short version is that an attacker with no password can make the appliance go and fetch things on their behalf, which SonicWall says could let them reach internal functionality and perform operations they should not be able to. It arises from an unintended alternative route into the appliance's WorkPlace interface, and SonicWall rates the attack as low-complexity, meaning there is no clever trick required. The affected models are the SMA1000 6210, 7210 and 8200v; the fixes are versions 12.5.0-03082 and 12.4.3-03670. Two things are genuinely reassuring. SonicWall says it has no evidence that any of the flaws in this release are being exploited. And the related products are explicitly not affected — the SMA 100 Series, and the SSL-VPN built into SonicWall firewalls, which is the one far more small businesses actually have. Shadowserver counts over 400 of these appliances exposed to the internet, some of which will already be patched.

Why it matters for your business: this is the comfortable case — a serious flaw, a patch available, and no attacks yet — and the comfortable case is the only one where you choose the timing. Earlier SMA1000 flaws this year were exploited as zero-days before fixes existed, so the window is not guaranteed to stay open. Check with your IT supplier whether you have an SMA1000 specifically rather than the much more common SSL-VPN on a SonicWall firewall; if you do, this is a this-week job, and if you do not, you can stop reading and note that you got lucky on model numbers rather than on anything you did.

6. Fake AI Sign-In Pages Are Stealing Advertising Accounts — and the Codes From Your Authenticator App

Browser security firm Island published research on 6 October into a phishing operation that impersonates ChatGPT, Gemini, Claude and Perplexity, along with a fake advertising product tied to Meta's AI agent. The lure is aimed at agency staff, media buyers and anyone who administers advertising accounts: the fake tool offers to plan or audit campaigns, and asks you to "connect" your account. Pressing Connect opens what looks exactly like a Google sign-in window, complete with an address bar reading accounts.google.com. It is not a window at all — it is a picture of one, drawn inside the page. This is called a browser-in-the-browser attack, and the one reliable way to spot it is that a fake window cannot be dragged outside the browser or resized, because it is part of the web page. The kit handles Google, Meta, TikTok and Okta sign-ins, and a human operator watches in real time: they can reject a code to make you enter another, or park you on a "please wait" screen while they use the one you just gave them. It captures passwords, SMS codes, authenticator codes, Okta push approvals and Google prompts. The prize is the advertising account, where a balance can be spent on fraudulent campaigns or the access resold — and agency accounts often reach many downstream clients.

Why it matters for your business: this is the specific, demonstrated way that multi-factor authentication gets defeated, and the fix is not to abandon it but to use a form that cannot be read out, typed in or approved by mistake — a passkey, or a hardware security key. Those are tied to the real website address, so a convincing copy gets nothing. Turn that on for your advertising accounts, your email and anything handling money, in that order of how much a stranger could spend. And give your team one habit: never sign in to anything through a window that opened inside another site. Go to the service yourself, in your own tab, from your own bookmark.

7. ASOS Was Breached After Someone Impersonated a Trusted Contact to Get a Staff Password

The online retailer ASOS confirmed a data breach after customers received push notifications through its own app on 6 October — messages from a group calling itself Xuanye Group claiming to hold stolen customer data and inviting staff to make contact on Telegram. ASOS says an unauthorised party obtained an employee's login credentials by impersonating a trusted contact, and used them to reach information held on certain third-party platforms the company uses. Exposed data covers full names, contact details and some non-personal account information; ASOS says payment card details and account passwords were not accessed. It has locked down the affected platforms, brought in external investigators and notified law enforcement and regulators, and is telling customers no action is needed on their accounts but to be wary of unsolicited calls or messages claiming to come from ASOS. The company has not said how many customers are affected and the investigation continues. This is worth connecting to the week's other breaches: the FortiGate attacks above run on leaked passwords, the Oracle Health breach below began with stolen customer credentials, and the fake sign-in pages in the story above exist to harvest them. Four separate incidents, and not one of them needed a software vulnerability — they needed a working login.

Why it matters for your business: the attack here was a conversation, which means the control is a procedure rather than a product. Decide now how a password reset or an access request gets verified in your business, write it in one sentence, and make it something an impersonator cannot satisfy — a call back on a number already in your own records, never a number supplied in the request itself. Tell staff plainly that nobody will ever be in trouble for taking ten minutes to check. Then note the second half of what happened to ASOS: one employee's password opened data held on third-party platforms. Ask which outside services hold your customer data and which of your staff logins reach them.

8. The Oracle Health Breach Is Now Reported at Nearly 20 Million People

This is an old breach with a new number, which is the only reason it is here. Oracle Health — formerly Cerner, the company whose software holds patient records for a large number of hospitals — was breached in early 2025: Oregon filings put unauthorised access from 22 January 2025 through to 1 April, with Oracle becoming aware on 20 February. Attackers used stolen customer credentials to reach a legacy server that had not yet been moved to Oracle's cloud, and copied data off it. An individual going by "Andrew", who has not claimed any link to a known ransomware group, demanded millions in cryptocurrency and set up public websites about the breach to apply pressure. What changed this week is the scale. Earlier filings and notifications pointed to far smaller figures — roughly 2,992,244 people in Texas, about 283,000 in South Carolina, about 69,000 in Washington — and on 5 October Bloomberg reported, citing the Texas attorney general, that the total is close to 20 million. Oracle has not publicly confirmed a count. Data may include names, Social Security numbers and medical details such as diagnoses, medications, test results and images.

Why it matters for your business: the useful thing here is not the breach but the arithmetic. The first number you are given after an incident is an early estimate drawn from whatever has been examined so far, and it moves — in this case by more than a factor of six, eighteen months later. If you are ever on the wrong end of this, two practical consequences follow. Tell customers what you know and when you knew it, rather than committing to a figure you will have to revise, because the revision does more damage than the original number. And if your business holds data on behalf of clients, check what your contracts actually require you to tell them, and how quickly — that clock starts on the day you discover it, not the day you finish counting.

9. The Owner of a Ransomware Recovery Firm Is Accused of Secretly Paying the Ransoms and Billing a Huge Markup

Zohar Pinhasi, owner of the Florida ransomware remediation company MonsterCloud, was indicted by a federal grand jury on 23 September on one count of conspiracy to commit wire fraud and two counts of wire fraud; he has pleaded not guilty and was released on a $2 million bond, and faces up to 20 years if convicted. Prosecutors allege the company advertised its own decryption techniques for recovering data without paying criminals but had no such technology, and that dealing with the ransomware operators was usually its first step rather than its last. The figures in the indictment are the substance of the allegation: in one case about $8,200 paid to a gang and about $150,000 charged to the victim; in another about $236,000 paid and about $380,000 charged. Across June 2018 to June 2023, prosecutors allege more than $8 million in ransom payments facilitated and more than $19 million charged to hundreds of companies in the US and Canada. They say some contracts did disclose that the firm might communicate with or pay criminals, but only as a last resort if other decryption failed, and that sample files decrypted by the attackers were presented to clients as proof of the firm's own capability. These are allegations that have not been tested at trial.

Why it matters for your business: a business in the middle of a ransomware attack is the least capable buyer in the world — frightened, losing money by the hour, and in no position to evaluate a technical claim. That is exactly when you will be choosing an incident-response firm, which is the argument for choosing one before you need it, while you can still ask awkward questions. Two are worth asking any provider: will you tell us, in writing, if paying a ransom is part of your proposed recovery, and how exactly will you recover our data if nobody pays? There is also a UK-specific reason not to let someone pay on your behalf without your knowledge. Paying a ransom to an entity under UK sanctions is a legal problem for your business, and you cannot assess that if you do not know a payment was made.

10. 17,610 Fake Code Repositories Were Pushed to GitHub in a Few Days to Spread an Information Stealer

GitHub is where the world's software is kept, and a convincing-looking project page there carries an air of legitimacy that a random download site does not. The campaign known as FakeGit, tracked by Apiiro, resumed on 4 October and now spans 17,610 repositories — more than 13,000 of them pushed in 34 hours, peaking at 2,999 an hour. Each has a plausible README file with a Download button pointing at a ZIP archive containing SmartLoader, a first-stage program whose job is to fetch the real payload: the StealC information stealer, which harvests saved passwords, browser session cookies and cryptocurrency wallets. Island, which named the operation in July when it involved 7,600 fake repositories, found roughly 800 of them posing as AI "skills" or MCP servers listed in public AI catalogues — add-ons that extend an AI assistant's abilities, a category where nobody yet has a settled instinct for what a trustworthy source looks like. Most of the accounts are disposable, but researchers found at least 700 that appear to belong to real developers, and Apiiro's striking observation is that the operator largely reused existing repositories rather than creating new ones: "nobody had to create a single new repo." Takedowns consequently keep missing copies in forks, releases and issue attachments.

Why it matters for your business: this is aimed at the person who installs software, so it matters to you through whoever builds or maintains your website, app or internal tools — including you, if you have been assembling things with an AI assistant. The rule that holds is to install only from a vendor's own site or official registry, and to look at who owns a repository before running anything from it. If you have a developer or agency, send them one question: do we install AI skills or MCP servers from public catalogues, and who checks the source? And if anyone suspects they ran one of these, treat it as a stolen-credentials event rather than a malware clean-up — revoke active sessions and access tokens, because the saved logins are the thing that was taken.

11. Cheap Android Phones Were Found Arriving With Malware Already Built In

Bitdefender published research on 8 October into a campaign it calls Midnight Mimosa, found in the firmware of low-cost Android phones using MediaTek chips — the named models include the Doogee S200 X and the Cubot KINGKONG X, alongside devices imitating Samsung and Apple products. The malware is not downloaded by the owner; it is part of the operating system as shipped, which means it runs with system-level privilege and can install and remove apps, grant itself permissions and run code fetched from elsewhere. It does two jobs. The first is advertising fraud through around 32 apps disguised as weather tools, file managers, app locks and audio utilities, some displaying ads in invisible windows. The second is turning the phone into a residential proxy — renting out the owner's home internet connection so that someone else's traffic appears to come from their address — though Bitdefender could confirm only that the control server accepted registrations, not that traffic was actively being forwarded. It also briefly disables the Play Store during installations to avoid Google's own checks, then switches it back on. Bitdefender found thousands of devices across more than 150 countries over about two years, most in Mexico, France, Italy, the US, Germany, Brazil and Spain. How it got into the firmware is unclear; one owner reported an official update reinfecting a device, while others said later updates cleaned theirs.

Why it matters for your business: the uncomfortable part is that nothing the owner did caused this and very little they can do will fix it — removal means firmware-level work or disabling components over a developer connection, which is beyond most people. So this is a purchasing decision rather than a security task. If you buy handsets for staff, or hand down a cheap second phone for work calls and two-factor codes, buy from a manufacturer that publishes security updates and states how long a model will receive them, and be wary of unfamiliar brands and of "Samsung" or "Apple" devices priced far below the real thing. A phone that receives your login codes deserves the same scrutiny as a laptop; in most small businesses it gets none.

12. A Health Data Company Was Fined €7 Million Over Data It Described as Anonymous

Italy's data protection authority fined IQVIA's Italian division €7 million (about $7.8 million) under the GDPR, in a decision taken in September following an investigation opened in April 2025. IQVIA had built a database of health information on roughly one million patients by aggregating records from 800 general practitioners, replacing names with a unique code. The regulator's central finding is the part that generalises: the code was consistent enough to track an individual over time, and combined with other details in the records it could be used to single someone out again — so the data was pseudonymised, not anonymised, and remained personal data subject to the full weight of the law. The authority found processing without an appropriate legal basis and without informing patients, no retention periods set at all with some records going back to 2001, and that for 3,300 patients the database also held names, tax identification numbers, addresses and contact details outright. IQVIA says it uses pseudonymisation and encryption as safeguards, that the dataset is not used in its clinical research or trial services, and that it reserves the right to appeal; it has 120 days to comply.

Why it matters for your business: the distinction that cost €7 million is one many small businesses get wrong in good faith, usually when asked to share data with a supplier, an analytics tool or an AI service. Replacing names with customer numbers feels like anonymising, and it is not: if you can still tell that these twelve orders belong to the same person, or re-identify them by combining a postcode with a purchase date, it is still personal data and UK GDPR still applies in full. Two practical consequences. If you have ever told a customer or a regulator that data you share is "anonymised", check whether that is true by the standard used here. And set retention periods, because "we keep everything" was a separate finding in its own right — data you no longer need is pure liability, and deleting it is the cheapest security measure that exists.

Sources

Summaries are compiled from public threat-intelligence feeds and security news sources. This digest is for awareness purposes only and does not constitute professional security advice.

Cybersecurity News