China-Linked Hacking Advisory, FortiBleed Lockouts, iRhythm Breach Lead This Week

Security leaders face an October 11 federal patching deadline after CISA, FBI and NSA detailed China-linked Integrity Technology Group attacks on critical infrastructure, while a joint FBI/Secret Service advisory confirms the FortiBleed campaign has compromised more than 86,644 Fortinet devices and is still locking out administrators. Separately, iRhythm disclosed a breach affecting over 360,000 people, Google revealed a ccTLD hijack used to forge HTTPS certificates, new critical flaws surfaced in Atlassian and SonicWall products, and Lumen named a new chief security officer.

CISA, FBI, NSA warn of China-linked Integrity Technology Group hacking critical infrastructure

CISA, FBI, NSA and international partners issued a joint advisory on October 8, 2026, warning that China-based Integrity Technology Group enables threat actors—tracked as Flax Typhoon, Ethereal Panda and Red Juliett—to steal data from government, critical manufacturing, healthcare and IT organizations worldwide. The actors combine botnets, VPN infrastructure and living-off-the-land techniques, exploiting eight CVEs including flaws in ProFTPD, Apache Struts and ONLYOFFICE Docs. CISA added five of these CVEs to its KEV catalog, giving federal agencies until October 11, 2026 to patch or discontinue use. (CISA)

FortiBleed campaign still active, locking admins out of Fortinet firewalls

A joint FBI and U.S. Secret Service advisory published October 7, 2026 says the FortiBleed campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways remains active, with SOCRadar having verified more than 86,644 compromised devices across 194 countries. Attackers are using cracked credentials from earlier leak dumps to log back in, sometimes deleting legitimate accounts to lock administrators out while they move laterally. The agencies say the stolen access is being sold to affiliates of the INC/Lynx and Payload ransomware groups, and advise victims against paying ransoms. (Help Net Security)

iRhythm discloses breach affecting over 360,000 people after June cyberattack

Medical device maker iRhythm began filing breach notices this week after a June 2026 cyberattack exposed data on more than 360,000 people, including 298,647 in Texas and 69,526 in South Carolina. Hackers used social engineering to access third-party-hosted business applications between June 3 and June 8, stealing names, addresses, phone numbers, device serial numbers and insurance numbers. In a June 8-K filing with the SEC, iRhythm disclosed that a threat actor demanded payment to avoid public disclosure; the company says clinical systems and devices were not affected and finances were not disrupted. (The Record)

Hijacked country-code domain registries used to forge HTTPS certificates for Google

Google disclosed on October 7, 2026 that attackers compromised the third-party operators of three country-code domains—Ghana's .gh, Sierra Leone's .sl and American Samoa's .as—and used that access to change authoritative DNS records and obtain valid HTTPS certificates for Google domains and other large organizations. Google said its own systems were not compromised and blocked the unauthorized certificates in Chrome via CRLSets, also working with issuing certificate authorities to revoke them. The company could not say how the registries were compromised, who was responsible, or confirm every affected domain was identified. (Help Net Security)

Critical Atlassian flaw CVE-2026-21589 under active exploitation

Attackers began exploiting a critical Atlassian arbitrary file access flaw, CVE-2026-21589, within hours of watchTowr publishing technical details and one day after Atlassian shipped patches, according to Help Net Security. The vulnerability affects all versions of Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd Data Center, Crucible and Fisheye, and can expose plaintext credentials stored in Crowd deployments, potentially letting attackers become Jira administrators. Atlassian urged immediate upgrades and advised organizations unable to patch quickly to remove vulnerable instances from the internet or block external access. (Help Net Security)

SonicWall patches pre-auth SSRF flaw in SMA 1000 VPN appliances

SonicWall patched four vulnerabilities in its SMA 1000 series SSL VPN appliances, including CVE-2026-102255, a pre-authentication server-side request forgery flaw that could let unauthenticated attackers direct the appliance to issue requests on their behalf and reach internal functionality. The vendor said there is no evidence of in-the-wild exploitation yet, but SMA appliances have repeatedly been targeted by attackers, with two other pre-auth SSRF flaws exploited as zero-days earlier in 2026. Affected physical and virtual models include the 6210, 7210 and 8200v; SonicWall advised customers to upgrade to the latest firmware hotfixes. (Help Net Security)