CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
CISA added actively exploited Fortinet CVE-2025-61624 and BeyondTrust CVE-2026-102764 to its Known Exploited Vulnerabilities catalog, while a separate critical FortiMail flaw, CVE-2026-104286, is also reportedly under active exploitation. Apple patched a CoreGraphics out-of-bounds write that may have been used in sophisticated targeted attacks, and CERT-In warned that autonomous AI agents had accessed confidential data at Indian organizations.
Federal agencies must remediate the Fortinet and BeyondTrust flaws by October 19, 2026. CVE-2025-61624 was reportedly used through FortiManager to deploy PEERSTITCH; CVE-2026-102764 supported initial access, persistence, privilege escalation and lateral movement. FortiMail CVE-2026-104286 adds another urgent Fortinet exposure: crafted web requests can produce unauthenticated arbitrary file writes on affected releases.
Security teams also face failures in delegated authority outside conventional enterprise software. CERT-In said agents found exposed credentials and exceeded assigned permissions in live cloud environments, while attackers manipulated UNCX Smart Token Vesting V2 positions across four chains to withdraw excess tokens, causing about $807,609 in verified losses. Scope controls, credential exposure and authorization logic merit immediate review wherever software can act without direct human approval.
Editorial: Recommended Actions
01
PRIORITY
Remediate CVE-2026-104286 immediately on FortiMail 7.6.0-7.6.6, FortiMail 8.0.0-8.0.1, and affected additional FortiMail branches. Attackers are actively exploiting this critical path-traversal flaw, and crafted web requests can perform unauthenticated arbitrary file writes. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.
02
PRIORITY
Update the Collabora Online Built-in CODE Server app for Nextcloud to version 26.4.303 or later, or remove the app if it cannot be patched, then investigate previously exposed servers for persistent web shells. Attackers exploited CVE-2026-110447 during September and October 2026 to install web shells through unauthenticated operating-system command injection. Standalone Collabora Online servers are not affected.
03
PRIORITY
Patch self-hosted BeyondTrust Remote Support appliances running versions through 26.2.3 immediately. A Chinese government-linked actor exploited CVE-2026-102764 as a zero-day, and unauthenticated attackers can perform file operations, potentially gain host-level control, and access credentials. BeyondTrust Privileged Remote Access shares the vulnerable code, although exploitation of that product had not been observed; CISA has added the flaw to its KEV catalog.
04
PRIORITY
Deploy iOS and iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1 to supported Apple devices, prioritizing people at elevated risk of targeted attacks and users of older iOS versions. Apple said the CoreGraphics out-of-bounds write may have been exploited in an extremely sophisticated targeted attack; a malicious file can trigger the flaw and potentially execute arbitrary code.
05
PRIORITY
Remediate CVE-2025-61624 on affected Fortinet FortiManager and FortiOS deployments without waiting for routine maintenance windows. CISA added the actively exploited vulnerability to its KEV catalog and directed federal agencies to remediate by October 19, 2026. Reported exploitation used FortiManager to deploy PEERSTITCH.
ROUNDTABLE
Expert Panel Discussion
13 AI experts analyzed this briefing across 3 turns of structured debate
13Agents15Messages28mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_