Weekly Cybersecurity Roundup: Zero-Days, Firewall Attacks, AI-Powered Threats and Major Data Breaches

The cybersecurity landscape remained highly active this week, with attackers targeting enterprise firewalls, operating systems, browsers, databases and cloud environments. Security teams also faced a record-scale Microsoft Patch Tuesday, multiple vulnerabilities under active exploitation, and growing evidence that artificial intelligence is being integrated directly into offensive cyber operations.

Among the most significant developments were two Microsoft zero-days exploited in the wild, attacks against FortiGate devices, a critical PAN-OS vulnerability capable of root-level code execution, a major Revolut data exposure incident, and new research showing threat actors using AI agents to automate complex attack chains.

Microsoft Releases 973 Security Fixes

Microsoft's September 2026 Patch Tuesday addressed 973 vulnerabilities across Windows, Office, SQL Server, Exchange, SharePoint, Azure and other products.

Two vulnerabilities were confirmed as actively exploited:

• CVE-2026-85880 – Windows ALPC elevation-of-privilege vulnerability
• CVE-2026-81963 – Windows Update Stack elevation-of-privilege vulnerability

The release also included critical fixes affecting Windows Secure Kernel Mode, VBS Enclave and Microsoft Office applications.

The scale of the update makes vulnerability prioritization particularly important for enterprise security teams. Organizations should identify internet-facing and actively exploited vulnerabilities first, followed by flaws affecting privileged systems and widely deployed applications.

FortiGate Devices Targeted in Active Attacks

Researchers identified an active campaign exploiting CVE-2025-25249, a critical vulnerability affecting FortiOS and FortiSwitchManager.

The vulnerability carries a CVSS score of 9.8 and has been used to deploy a custom Node.js-based remote access trojan known as PivotC2.

Investigators reported scanning activity involving more than 30,000 FortiGate IP addresses, with approximately 178 devices identified as compromised.

The attackers reportedly harvested firewall configurations and VPN-related credentials while establishing outbound encrypted communications with their infrastructure. Some compromised organizations also experienced mailbox data theft.

Organizations running affected Fortinet products should prioritize firmware updates and investigate firewall, VPN and authentication logs for suspicious activity.

FortiOS and FortiProxy ZTNA Flaw Could Enable Traffic Interception

Fortinet also disclosed CVE-2026-84393, a certificate-validation weakness affecting the Agentless ZTNA portal in FortiOS and FortiProxy.

The vulnerability is rated CVSS 7.3 and could allow an unauthenticated attacker positioned to perform a man-in-the-middle attack to intercept communications between the ZTNA portal and backend destinations.

Affected versions include several FortiOS 7.6.x and FortiProxy 7.6.x releases.

Fortinet recommends upgrading to the fixed versions, particularly because ZTNA portals are commonly exposed to the internet.

Critical PAN-OS Vulnerability Can Lead to Root-Level Code Execution

Palo Alto Networks disclosed CVE-2026-0310, a buffer-overflow vulnerability in PAN-OS XML processing.

The vulnerability carries a CVSS-B score of 9.2 and could allow an unauthenticated attacker to execute arbitrary code with root privileges on affected PA-Series hardware firewalls.

VM-Series deployments have a different impact profile, with exploitation potentially resulting in denial of service rather than the same level of code execution.

No active exploitation was reported by Palo Alto Networks at the time of disclosure, but organizations should restrict firewall management interfaces to trusted networks and apply the appropriate software updates.

PostGREShell: Long-Standing PostgreSQL Vulnerability Enables Code Execution

Researchers disclosed CVE-2026-6471, a vulnerability that has existed in PostgreSQL since the PostgreSQL 9.4 era.

The flaw can potentially be abused by low-privileged database accounts possessing the REPLICATION attribute. Attackers could abuse logical decoding functionality to cause PostgreSQL to load an attacker-controlled shared library, ultimately executing code with the privileges of the database server process.

The issue is particularly significant because replication privileges are frequently granted to accounts used for backup and disaster-recovery operations.

Fixed releases include:

PostgreSQL Branch	Fixed Version
PostgreSQL 18	18.6
PostgreSQL 17	17.11
PostgreSQL 16	16.15
PostgreSQL 15	15.19
PostgreSQL 14	14.24

Administrators should review accounts with replication privileges and restrict database connectivity through pg_hba.conf.

Revolut Data Exposure Reveals Sensitive Customer Information

Financial technology company Revolut disclosed a security incident involving sensitive information belonging to a limited number of customers.

The incident resulted from a fraudulent information request that appeared to originate from a legitimate government agency. Attackers abused an unauthorized mailbox operating under an official government domain to convince Revolut to provide customer information.

Potentially exposed information included:

• Names and contact information
• Dates of birth
• Passport and driver's license copies
• Identity-verification selfies
• IBAN information
• Account statements
• Transaction histories
• Cryptocurrency transaction information

Revolut said its core systems and customer funds were not compromised.

The incident demonstrates why organizations cannot rely solely on email-domain authenticity when handling highly sensitive information. Requests involving customer records should undergo independent verification through trusted channels.

AI Agents Are Becoming Part of the Attack Chain

One of the most significant trends highlighted this week was the increasing use of AI by threat actors.

Anthropic reported cases in which state-sponsored groups and financially motivated attackers used Claude to support reconnaissance, exploitation, malware development, credential theft and data exfiltration.

In one case, a Russian-linked threat group used AI-assisted workflows to modify malware after security products detected it, creating a feedback loop in which the malware was repeatedly changed and redeployed.

Another criminal operation used AI to scale credential harvesting and analyze approximately 1.8 million Android applications for exposed secrets.

These developments indicate that AI is no longer limited to generating phishing emails or writing small scripts. Threat actors are increasingly integrating AI into multi-stage operational workflows.

FortiSandbox Authentication Bypass Could Expose Sensitive Data

Fortinet also patched CVE-2026-26084, an improper-access-control vulnerability affecting FortiSandbox.

The vulnerability has a CVSS score of 8.9 and could allow unauthenticated attackers to bypass access controls and obtain sensitive information from the platform, including configuration data and logs.

Affected products include FortiSandbox and associated cloud/PaaS deployments.

Organizations should upgrade affected installations to the vendor-provided fixed versions and review access logs for unexpected requests.

Chrome 153 Fixes 230 Security Issues

Google released Chrome 153 with fixes for approximately 230 security vulnerabilities.

Among them was CVE-2026-87491, a V8 out-of-bounds write vulnerability that had already been exploited in the wild.

The release also addressed multiple Critical- and High-severity vulnerabilities affecting components including WebGL, Cast, ANGLE, PDFium and Web Authentication.

Because browser vulnerabilities can provide an initial foothold for attacks against employees, organizations should ensure managed Chrome installations receive security updates quickly.

Attackers Chain Chrome and Windows Vulnerabilities

Researchers also identified an exploit chain combining browser and Windows vulnerabilities.

The campaign, referred to as BlueMoon, reportedly chained a Chromium V8 vulnerability, a V8 sandbox escape and the Windows ALPC privilege-escalation vulnerability CVE-2026-85880.

Several threat clusters reportedly adopted the exploit chain, including China-linked groups targeting government and defense organizations.

The campaign demonstrates the danger of combining vulnerabilities across security boundaries: a browser compromise can become significantly more serious when attackers can escape the browser sandbox and subsequently obtain higher privileges on Windows.

Check Point VPN Products Face Critical Vulnerabilities

Check Point disclosed two critical vulnerabilities:

CVE	Severity	Potential Impact
CVE-2026-85102	9.8	Unauthenticated remote code execution
CVE-2026-85103	9.8	Heap-based memory corruption / RCE

The vulnerabilities affect VPN-related components in several Check Point product branches.

Although the vendor reported no confirmed exploitation at disclosure, organizations should apply the relevant Jumbo Hotfix updates and ensure VPN infrastructure is not unnecessarily exposed.

Attackers Abuse Legitimate Google Services for Phishing

Security researchers identified a phishing campaign that abuses legitimate Google services to make malicious traffic appear more trustworthy.

Attackers routed victims through services such as Google Meet, Search, DoubleClick, Tag Manager and Analytics before directing them toward credential-harvesting infrastructure.

The campaign also used company branding and fake verification pages to increase credibility.

In some cases, victims were deliberately shown an incorrect-password message after entering credentials, encouraging them to provide another password before being redirected to the legitimate company website.

Organizations should investigate suspicious authentication activity and unauthorized installations of remote-access software such as ScreenConnect.

Windows Defender "ShieldCrash" Claim Raises New Concerns

Security researcher MSNightmare published a proof-of-concept claiming that Microsoft's previous fix for the ShieldBreak vulnerability can be bypassed.

The reported technique, called ShieldCrash, allegedly enables arbitrary file reads with SYSTEM-level privileges on fully patched Windows systems.

Microsoft had not independently confirmed the bypass at the time of reporting.

If independently validated, the technique could potentially expose sensitive files, credentials and cryptographic material. Security teams should therefore monitor for unusual local activity involving Defender scanning processes and suspicious DLL loading until the issue is clarified.

Windows Remote Desktop Services Problems After September Updates

Administrators also reported Remote Desktop Services instability after installing September 2026 Windows Server updates.

Affected environments reportedly included Windows Server 2019, 2022 and 2025.

Some systems experienced RDP session freezes and server instability after users disconnected from sessions. Reports pointed toward problems during RDP session teardown.

The situation presents a difficult operational balance because the same security updates address actively exploited vulnerabilities. Organizations should avoid removing security updates without carefully assessing the exposure and should monitor Microsoft guidance for an official fix.

What Security Teams Should Prioritize

This week's incidents point to several immediate priorities:

Patch internet-facing infrastructure first. Firewalls, VPN gateways, remote-access platforms and security appliances remain high-value targets.

Prioritize actively exploited vulnerabilities. Vulnerabilities such as the Microsoft zero-days and exploited browser flaws should move ahead of routine patching queues.

Audit privileged accounts. PostgreSQL replication accounts, firewall administrators and cloud identities can provide attackers with significant leverage when compromised.

Strengthen verification procedures. The Revolut incident demonstrates that even requests originating from apparently legitimate government domains require independent validation.

Monitor AI-related activity. Security teams should begin accounting for AI agents, automated API activity and unusual AI-assisted workflows within enterprise environments.

Hunt beyond endpoints. Firewall logs, identity-provider telemetry, VPN activity, cloud audit logs, browser events and database activity can provide critical evidence that endpoint-only monitoring may miss.

Final Takeaway

The week's incidents reinforce a broader shift in the threat landscape. Attackers are increasingly targeting security infrastructure itself, exploiting vulnerabilities in firewalls, VPN gateways, browsers, databases and remote-access platforms.

At the same time, AI is accelerating the operational side of cyberattacks by helping threat actors automate reconnaissance, vulnerability discovery, malware modification and data theft.

For defenders, the priority should not simply be deploying more security tools. Organizations need faster vulnerability prioritization, stronger identity controls, continuous monitoring of internet-facing infrastructure and well-tested incident-response procedures.

The combination of actively exploited zero-days, vulnerable edge devices and AI-assisted attacks makes rapid detection and response increasingly critical for enterprise security teams.

SEO Meta Description:
Weekly cybersecurity roundup covering Microsoft zero-days, FortiGate attacks, PAN-OS flaws, PostgreSQL vulnerabilities, Revolut data exposure, Chrome zero-days and AI-powered cyberattacks.