Latest Threat Intelligence — Week of October 26, 2026
Our security analysts track vendor advisories, CISA alerts, and live attack campaigns, then translate each one into what it means for a business that has to keep working. At the top of the feed right now: a hidden implant on Fortinet firewalls, planted after attackers breached an IT service provider’s management console, that lets the attacker’s VPN sessions skip security checks — and patching does not undo the firewall settings and passwords already stolen; attackers abusing a flaw in a Nextcloud document-editing add-on to plant backdoors and hunt for password vaults; an Arista VeloCloud flaw, exploited before the fix, that turns any read-only user into a full administrator; and emergency PHP fixes for two flaws that let a stranger run code on a web server, with exploit attempts starting before the patches shipped. Notice the pattern: the update closes the door, but it does not tell you whether someone already walked through it. Patched is not the same as clean. What decides the cost of an incident is whether anyone checks for that earlier visit, and what evidence you can hand the bank, the insurer and your customers afterward.
