Week of October 5, 2026: China-Linked Hacking Enabler Named, FortiBleed Locks Out Admins

Security leaders faced a joint CISA-FBI-NSA advisory naming Integrity Technology Group as an enabler of Chinese state-linked attacks, an active FortiBleed campaign that locked administrators out of compromised Fortinet firewalls, and fresh critical vulnerabilities in Atlassian Data Center products, Dell System Update and Citrix NetScaler appliances. French and U.S. authorities also seized two sites trafficking stolen intimate images, while Google disclosed that hijacked country-code domain registries had been used to obtain unauthorized HTTPS certificates for its domains.

CISA, FBI, NSA and Allies Name Integrity Technology Group as Hacking Enabler

On October 8, 2026, CISA, the FBI, NSA and international partners published a joint advisory describing how Integrity Technology Group, a China-based company with ties to the Chinese government, enabled threat actors to target critical infrastructure sectors worldwide. The advisory said the actors combined large-scale botnets, VPN infrastructure and living-off-the-land techniques, with activity consistent with groups known as Flax Typhoon, Ethereal Panda and Red Juliett. Targeted sectors included government services, critical manufacturing, healthcare, law enforcement and education. Authorities urged network defenders to hunt for compromise and apply mitigations for the listed known exploited vulnerabilities. (CISA)

CISA Adds Exploited NetScaler Crash Flaw to KEV Catalog

CISA added CVE-2026-88779, a memory overflow flaw in Citrix NetScaler ADC and Gateway appliances, to its Known Exploited Vulnerabilities catalog on October 5, 2026, after Citrix observed targeted attacks causing denial of service on unmitigated deployments. Administrators reported crashes and reboots after patching eight vulnerabilities, including two actively exploited zero-days, and attackers appeared to be trying to install webshells. Citrix said the issue affects availability rather than data integrity and pushed signatures to reduce exposure. CISA ordered federal civilian agencies to address the vulnerability and check for compromise by October 7. (Help Net Security)

Exploitation Begins Against Critical Atlassian Data Center Flaw

A day after Atlassian patched a critical arbitrary file access vulnerability, CVE-2026-21589, affecting Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye Data Center products, researchers at watchTowr published technical details and threat intelligence vendor Previdian reported exploitation attempts hitting its honeypot network on October 7, 2026. The flaw, rated 9.3 on CVSS, let unauthenticated attackers read specific files, and watchTowr showed how leaked Crowd credentials could be used to create new administrator accounts in Jira. Atlassian urged customers to upgrade immediately or take vulnerable instances off the internet while they patched. (Help Net Security)

FortiBleed Campaign Still Active, Locking Admins Out of Fortinet Gear

An FBI and U.S. Secret Service advisory published October 7, 2026 warned that the FortiBleed campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways remained active, with some organizations locked out of their own devices after attackers deleted or changed administrator accounts. Citing SOCRadar, the agencies said more than 86,644 compromised devices had been verified across 194 countries. Attackers used cracked credentials from earlier leaks to gain access, enumerated Active Directory accounts, and sold access to affiliates of the INC/Lynx and Payload ransomware groups. The agencies advised against paying ransoms. (Help Net Security)

Hijacked Country-Code Registries Used to Obtain Fraudulent Google Certificates

Google disclosed on October 7, 2026 that attackers had compromised the third-party operators of the .gh, .sl and .as country-code domain registries and altered authoritative DNS records to obtain HTTPS certificates for several Google domains and other large organizations. Google said the incidents did not involve a compromise of its own systems and blocked the unauthorized certificates in Chrome through CRLSets while working with certificate authorities to revoke them. Certificate Transparency logs surfaced additional affected organizations, which Google said it contacted where possible, while cautioning that browser-side blocking alone was not sufficient protection. (Help Net Security)

Dell Patches Critical Root-Privilege Flaw in System Update Tool

Dell urged customers on October 6, 2026 to patch CVE-2026-86360, a critical path traversal vulnerability in Dell System Update carrying a CVSS base score of 9.6, which could let an unauthenticated remote attacker execute arbitrary code with root privileges on PowerEdge server management tools. Dell said successful exploitation could lead to complete compromise of the application and underlying operating system, and recommended upgrading to DSU version 2.3.0.0 or later. The company also fixed four additional high-severity flaws in the same tool, two of which could enable remote code execution and two of which could allow privilege escalation. (Help Net Security)

FBI and French Police Seize Sites Trafficking Stolen Intimate Images

The FBI and French law enforcement announced on October 8, 2026 that they had seized two websites, operating as NudeLeaksTeens, that sold hacked and stolen sexually explicit images and videos of women and girls, some of whom were confirmed to be minors. French police arrested two brothers in northern France in connection with the operation. French authorities said the sites held files tied to more than 17,000 victims worldwide, indexed by age, location and appearance, and investigators seized roughly €700,000ドル in cryptocurrency from the suspects' homes. (Help Net Security)