Here are today’s top cybersecurity stories for Friday, October 23, 2026.
Hackers Breach Fortinet and Palo Alto Firewalls and VPNs, Exposing More Than 70,000 Credentials
Group-IB and NyxLab attribute the campaign to a threat actor tracked as k0t, which has links to the Qilin and The Gentlemen ransomware groups. The actor scanned for exposed FortiGate, FortiWeb, GlobalProtect, and PAN-OS devices, then exploited CVE-2025-64446 and CVE-2026-0257 or brute-forced logins. The actor lists the United States and Canada as its first priorities. The Hacker News
Exposed Server Shows Ransomware Affiliates Used AI Agents to Run Intrusions
SOCRadar found an open directory with 8,257 messages across 133 sessions tied to affiliates of INC and The Gentlemen. A framework called Phantom drove OpenCode and commercial models through OpenRouter, with a human approving each step. The operation targeted about 62 organizations, with industrial, manufacturing, and energy firms most affected. The Hacker News
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
Arista reports active exploitation of CVE-2026-114625, a CVSS 9.9 SQL injection in on-premises VeloCloud Orchestrator. An authenticated user gains operator privileges. Fixed versions are 5.2.3.18, 6.1.3.10, and 6.4.2.12, and hosted deployments are already patched. SecurityWeek
PHP Warns of Another Unpatched Code Execution Risk Two Days After PHP2Shell Fixes
PHP published an advisory for CVE-2026-115560, which affects a narrow session configuration. PHP calls the risk unlikely in practice and reports no exploitation. The project advises setting session.upload_progress.enabled to 0 until the next bugfix release. BleepingComputer
Quest Diagnostics Confirms Breach of Its Quanum LSM Platform
Quest learned of unauthorized access on October 21 and filed an SEC disclosure. The company believes some patient records were exposed but has not named a number or data types. Quest shut down Quanum LSM and paused access to Essential Insights and LabHQ. BleepingComputer
HPE Patches Eight Maximum-Severity Flaws in Aruba AOS
CVE-2026-79844 through CVE-2026-79851 cover authentication bypasses, unauthenticated command injection, buffer overflows, and SQL injection in AOS-8 and AOS-10. HPE patched 72 flaws in total. HPE knows of no public exploit code and urges administrators to restrict management interfaces. BleepingComputer
BlackX UEFI Bootkit Bypasses Secure Boot on Windows Systems Missing Revocations
Kaspersky found the bootkit in attacks on diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan, and suspects a link to APT41. BlackX abuses the patched Baton Drop flaw CVE-2022-21894. Systems stay exposed until the Windows Production PCA 2011 certificate is added to the DBX revocation list. The Hacker News
Critical Pillow Flaws Allow Code Execution Through a Crafted Image
Pillow versions 2.6.0 through 12.3.0 carry an EPS flaw, CVE-2026-112900, which passes attacker-controlled filenames to Ghostscript. Two further flaws, CVE-2026-112403 and CVE-2026-112393, cover JPEG thumbnail and TIFF memory errors. Pillow 13.0.0 fixes them. The Hacker News
Critical x402 SDK Flaws Allow Malicious APIs to Drain AI Agent Token Balances
V12 rated three x402 flaws critical. The default client set no spending limit, a Solana facilitator accepted token approvals as transfers, and the client signed login messages without checking the requesting site. Fixes ship in version 2.23.0 and later. The Hacker News
Stay tuned for today’s in-depth analysis posts.
