Published: 10/08/26
Thursday’s lead isn’t a patch. The FBI and Secret Service say FortiBleed is still logging in to exposed FortiGate firewalls with stolen passwords, and some owners are getting locked out of their own gear. Behind it: Cisco’s scheduled Nexus release with four critical NX-OS fixes, a botnet mining crypto on forgotten AI servers, and the Atlassian bug from yesterday’s brief, which now has a public exploit and attackers using it.
Lead Story
FortiBleed is still locking admins out of their own FortiGates — reset logins and lock down management today
An FBI/USSS joint advisory on October 6 says the campaign has compromised more than 86,644 FortiGate devices in 194 countries. Attackers use leaked and cracked credentials, add their own admin accounts, sometimes delete the real ones, and pass access to INC/Lynx and Payload ransomware affiliates. There’s no CVE and no firmware fix.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters: A patched firewall with a stolen admin password is still somebody else’s firewall.
Also Worth Your Attention
Before you book the Nexus upgrade, check which of Cisco’s four critical NX-OS advisories actually apply to your switches
Cisco’s October 7 bundle has four 9.8-rated NX-OS advisories. One hardening release applies to Nexus 3000/7000/9000, MDS and UCS fabric interconnects regardless of configuration. The other three depend on NX-API, NGOAM or MPLS OAM being enabled. License On-Prem also has an unauthenticated password reset. Nothing is exploited yet.
Why it matters: A scheduled patch only stays scheduled if you schedule it.
That LiteLLM box someone spun up for a pilot may be mining crypto for a stranger
Lumen’s Black Lotus Labs says the PoeLLM botnet has hijacked more than 3,400 exposed LiteLLM, Ollama, Gotenberg and Gitea servers since April. It mines crypto on them and uses them to scan for the next victim, and it finds its command server by reading a poem on GitHub.
Why it matters: The same box holds your model-provider API keys.
Patch Jira and Confluence today: attackers are now testing the Atlassian bug we flagged yesterday
watchTowr published a working exploit for CVE-2026-21589 on Tuesday. Previdian logged attempts within about two hours, and a Nuclei template is out. In Crowd-integrated Jira, the file read can end with an attacker adding their own administrator.
Why it matters: “Patch this week” just became “patch this morning.”
One more for the desktop team: Chrome 155 (155.0.8059.39/.40 on Windows and Mac, .39 on Linux) shipped this week with 247 security fixes, four of them critical. Google reports none exploited. Restart the browser and the rollout does the rest.
Thursday brief: FortiBleed (FBI/USSS, Oct 6) is still logging in to FortiGates with stolen creds and locking admins out. Kill sessions, reset admin + VPN passwords, phishing-resistant MFA, admin off the internet, audit admin accounts. Cisco Oct 7: four critical NX-OS fixes; check NX-API / NGOAM / MPLS OAM and plan the upgrade. PoeLLM: pull exposed LiteLLM / Gotenberg / Ollama off the internet and update LiteLLM. Atlassian CVE-2026-21589 is now exploited; patch Data Center today.
Go Deeper
Identity & Access Management → · Cybersecurity Tools →
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
