// incident-log -- week of Oct 19-25, 2026
FortiMail Zero-Day CVE-2026-104286 Actively Exploited
Fortinet disclosed a critical zero-day in its FortiMail email gateway -- rated CVSS 9.8 -- that allows an unauthenticated attacker to write arbitrary files to the underlying system using crafted HTTP/HTTPS requests. The flaw combines a path traversal vulnerability (CWE-22) with improper NULL byte handling (CWE-158).
CISA added it to the Known Exploited Vulnerabilities (KEV) catalog immediately. US federal agencies were ordered to patch or apply workarounds by October 4. Affected versions span FortiMail 7.2.x through 8.0.x -- upgrade to 7.6.7, 7.4.9, or 8.0.2 to stay protected.
This is a pre-authentication exploit, meaning attackers don't need a username or password -- anyone on the internet can trigger it. This maps directly to CompTIA Tech+ Objective 4.2 (common threats) and Security+ Application/service attacks. When a flaw is added to CISA KEV, patching becomes urgent for any organization using that product.
China-Linked Hackers Exploit BeyondTrust Zero-Day CVE-2026-102764
Google and Mandiant linked a critical zero-day in BeyondTrust Remote Support software to ARMORY CASTLE, a suspected Chinese state-sponsored threat group. The flaw (CVSS 9.3) is an improper origin validation vulnerability that lets a remote attacker perform file operations on an appliance without authentication.
After gaining access, attackers deployed the SAWFLY PHP webshell, escalated to root, harvested credentials from BeyondTrust's secrets database, and deployed a tunneler called BARECLAW to maintain persistent access. SaaS customers were auto-patched by Oct 9; self-hosted customers must manually apply patch BT26-05-RS.
Nation-state threat actors are called Advanced Persistent Threats (APTs) because they have the resources and patience to find and exploit zero-days before vendors know they exist. This incident shows the full attack chain: initial access via zero-day, privilege escalation, credential harvesting, persistence. A key Security+ concept is recognizing that privileged access management (PAM) tools themselves can become targets.
LiteLLM Malicious PyPI Package Steals AI API Keys
Attackers published a malicious release of the popular LiteLLM AI gateway library to PyPI (Python Package Index) and Docker Hub. Developers who updated their packages unknowingly downloaded a version that harvested cloud credentials, developer secrets, and AI API keys -- including keys for Anthropic Claude, OpenAI GPT, and Google Gemini models.
This is a classic supply chain attack: instead of attacking users directly, adversaries poison a trusted tool used by thousands of developers. Any project using LiteLLM during the compromise window should immediately rotate all credentials and API keys. The legitimate publisher restored a clean version, but the damage window allowed credential exfiltration.
Supply chain attacks target the tools developers trust, not the end application directly -- making them very hard to detect. This connects to CompTIA Tech+ Objective 4.3 (social engineering & software threats) and the broader concept of software integrity verification. Best practice: always pin dependency versions in production and monitor for unexpected package updates.
Microsoft October Patch Tuesday: 1,411 Fixes Including Actively Exploited Zero-Day
Microsoft's October 2026 Patch Tuesday fixed 1,411 vulnerabilities, including one zero-day being actively exploited in the wild: CVE-2026-96951, a Windows Shell security feature bypass that lets attackers defeat Mark of the Web (MotW) -- a Windows defense that warns users when opening files downloaded from the internet.
Two additional zero-days were publicly disclosed but not yet exploited: CVE-2026-108398 bypasses Windows Defender Application Control (WDAC), and CVE-2026-92707 causes a denial-of-service in a .NET component. All Windows users and IT teams should prioritize applying this update immediately.
Patch Tuesday happens every second Tuesday of the month -- it's a core part of any organization's vulnerability management cycle. Mark of the Web is a real defense you can observe on your own Windows computer: right-click a downloaded file, go to Properties, and look for the "Unblock" checkbox. When attackers bypass it, they can trick users into running malicious files Windows would normally flag. Relates to CompTIA Tech+ Objective 4.1 (security controls).
Ransomware Shuts Down Oneonta City Schools in New York
Oneonta City School District in Oneonta, New York confirmed a ransomware attack on October 23 that forced the district to close schools for at least two days -- Friday Oct 23 and Monday Oct 26 -- while staff assessed the damage. The district's media coordinator confirmed the attack but said they were still determining whether student records or personal information had been compromised.
No threat actor claimed responsibility publicly. School districts have become high-value ransomware targets because they hold large amounts of sensitive student data but typically have smaller cybersecurity budgets than private companies. Ransomware groups Qilin, SafePay, and others have been increasingly targeting education in 2026.
Ransomware in schools isn't just a headline -- it means real students lose access to digital learning tools, teachers lose lesson materials, and administrators must decide whether to pay criminals or rebuild from scratch. This scenario directly applies to CMCSS as a large school district. Offline backups, network segmentation, and incident response plans are the key defenses. This connects to CompTIA Tech+ Objective 4.4 (incident response basics).
Ransomware Groups Still Exploiting Patched Palo Alto VPN Flaw
Five months after its May 2026 patch, CVE-2026-0257 -- an authentication bypass in Palo Alto Networks GlobalProtect VPN -- remains actively exploited by ransomware groups Qilin and Inc. The flaw lets attackers forge authentication cookies and open unauthorized VPN sessions, bypassing multi-factor authentication entirely.
After gaining VPN access, attackers use legitimate IT tools like Cobalt Strike, BloodHound, and SharpHound to move laterally through networks. Targets include healthcare, education, government, and energy organizations. ReliaQuest assessed that exploitation was "highly likely to continue." Organizations that haven't patched yet are still at serious risk.
This story illustrates why patch timing matters: a flaw patched in May is still being exploited in October because some organizations move slowly. This is called the exploitation window. VPNs are especially attractive targets because they're designed to give remote access -- if an attacker can masquerade as a legitimate VPN user, they're "inside the perimeter." Relates to CompTIA Tech+ Objective 4.2 and the concepts of least privilege and network segmentation.
5.7 Million+ California Students' Data Stolen in ETS Breach
Educational Testing Service (ETS), which runs standardized tests for California's Department of Education, disclosed that attackers used compromised login credentials to access its secure file transfer (SFTP) server between May 22 and September 18, 2026 -- nearly four months of unauthorized access before detection.
Stolen data potentially affects all students from the past three school years, covering over 5.7 million enrolled students. Exposed records include: names, Statewide Student Identifiers (SSIDs), dates of birth, home addresses, demographic info, disability status, program participation, and standardized test scores. Social Security numbers and financial data were not involved.
This breach shows how third-party vendors can put your data at risk -- ETS isn't a school, but they hold student data on behalf of schools. The four-month window before detection is a major red flag: strong organizations use intrusion detection systems (IDS) and log monitoring to catch unauthorized access much faster. Student data has special legal protections under FERPA (Family Educational Rights and Privacy Act). Relates to CompTIA Tech+ Objective 3.1 (data security basics).
Siemens Software Center Used in ClickFix DLL Hijack Campaign
Attackers exploited CVE-2026-110936 (CVSS 8.4), a DLL side-loading vulnerability in Siemens Software Center, as part of a malware campaign using the ClickFix platform -- a distribution service that serves malicious content through fake software installers. Because Siemens Software Center is a trusted, digitally signed application, Windows doesn't flag it as suspicious.
When the software starts, it loads attacker-controlled DLL files from its own folder, executing LegionLoader malware. A related campaign also abused a legitimate Stardock application in the same way. Siemens version 4.0.9.8 fixes the flaw and should be applied when the software next launches.
DLL side-loading exploits the way Windows loads code libraries -- by placing a malicious DLL in the same folder as a trusted application, attackers "piggyback" on that app's trusted reputation. This technique is part of a broader strategy called living-off-the-land (LotL) -- using legitimate software to hide malicious activity. ClickFix is a growing delivery platform for cybercriminals. Relates to CompTIA Tech+ Objective 4.3 (malware categories).
Signal Flaw CVE-2026-113380 Lets Callers Listen After You Hang Up
A CVSS 9.3 flaw in Signal's RingRTC calling library (used by Signal on Android, iOS, and Desktop) allows a malicious caller to flood the call event queue so the receiver's hang-up command never actually ends the call. The caller's microphone -- and potentially their camera -- stays active and transmitting without the victim knowing.
The vulnerability affects Signal RingRTC versions before 2.72.0. Researcher Imahian discovered and reported the issue. Signal has released a fix -- users should update their Signal app immediately. This is particularly concerning because Signal is widely promoted as a secure, end-to-end encrypted communication tool trusted by journalists, activists, and privacy-conscious users worldwide.
Even apps designed for security and privacy can have serious bugs. The lesson: no software is 100% secure -- which is why updating apps promptly matters. This flaw is a state management vulnerability: the app's internal "call state" gets confused by a flood of events. The CVSS 9.3 score reflects high severity because it requires no user action beyond answering a call. Connects to CompTIA Tech+ Objective 2.4 (software security concepts).
PingCAP: Source Code and Customer Records Stolen via Stolen Service Account Credentials
Database company PingCAP (makers of TiDB, a popular open-source distributed database) disclosed that attackers used stolen service account credentials to access internal systems from September 9 to October 7, 2026 -- a nearly month-long undetected intrusion. Stolen data includes source code, customer email addresses, SQL editor content, encrypted API key values, and billing details.
PingCAP detected and terminated the unauthorized access on October 7. The use of a "service account" -- an automated account systems use to communicate with each other -- highlights a common security gap: these accounts often have broad permissions but don't receive the same monitoring attention as human user accounts.
Service account credentials are a hidden attack surface: they're automated, often over-privileged, and easy to overlook in security audits. Attackers love stealing them because service account activity blends in with normal system traffic. Credential hygiene -- regularly rotating passwords, applying least privilege, and monitoring for anomalous behavior -- is essential. The 28-day undetected window shows why SIEM (Security Information and Event Management) tools matter. Connects to CompTIA Tech+ Objective 4.1 (identity and access management).
DHS Bans DeepSeek AI Models From All Federal Civilian Agencies
A Department of Homeland Security (DHS) order published October 19 bars all US federal civilian agencies from using DeepSeek AI products -- Chinese-developed large language models that have gained popularity for their performance and low cost. China's Foreign Ministry objected to the ban, calling it politically motivated.
This mirrors a growing pattern of technology restrictions tied to national security concerns: similar bans have targeted TikTok, Huawei equipment, and other Chinese-origin technology on government networks. The concern centers on potential data exfiltration and the possibility that AI models could embed backdoors or be used for influence operations serving Chinese state interests.
This story sits at the intersection of AI security and geopolitics. When you use any AI tool, it's worth asking: who made it, where does my data go, and who has access? Federal agencies have strict requirements about data residency and sovereignty. This decision reflects supply chain risk applied to AI software: where your tools come from matters as much as what they do. Connects to CompTIA Tech+ Objective 1.4 (security as a shared responsibility) and emerging AI/cloud security concepts.
// key-terminology -- week of Oct 19-25
// verified-sources