# Today's Top Stories

CVE-2026-104286, a critical-severity path traversal zero-day in Fortinet FortiMail, is being actively exploited in the wild, allowing attackers to write arbitrary files to affected systems. Security teams running FortiMail should treat this as a priority patch given Fortinet's history as a high-value target for nation-state actors. Urgent action is required as exploitation is confirmed prior to widespread patching.

The China-linked threat actor 'Warlock' is actively exploiting Microsoft SharePoint vulnerabilities — both old and new — to disable security tools and deploy ransomware against critical infrastructure, government, and education organizations in Portuguese- and Spanish-speaking countries. Symantec and Carbon Black Threat Hunter Team observed the campaign, which has been ongoing since at least July 2025. Organizations running on-premises SharePoint should audit exposure and apply all available patches immediately.

A previously undocumented backdoor dubbed 'Antino,' attributed to a China-nexus threat actor by Cisco Talos, is targeting government and policy organizations across Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar. Antino uses Microsoft Outlook and OneDrive for command-and-control communications, a living-off-the-land technique designed to blend into legitimate cloud traffic and evade detection. The campaign represents a significant espionage threat against Asian government entities.

GitLab patched a critical 9.9 CVSS vulnerability in its AI Gateway component that could allow an authenticated user with Duo Agent Platform access to execute arbitrary commands on self-hosted gateway servers. Fixed versions are 19.2.4, 19.3.2, and 19.4.1; only organizations self-hosting the AI Gateway are affected and must apply patches immediately. The flaw sits at the intersection of AI infrastructure and privilege escalation — a growing attack surface as enterprises deploy AI-integrated DevOps pipelines.

A suspected member of the ShinyHunters hacking group, known online as 'Rey,' has been detained in Jordan and is reportedly cooperating with the FBI to identify other members of the group responsible for a string of high-profile data breaches and extortion campaigns. ShinyHunters is linked to major incidents including the Ticketmaster and Santander breaches. This arrest represents a significant law enforcement development against one of the most prolific cybercriminal groups of recent years.

Android 17's Advanced Protection mode now restricts access to Android's accessibility services API exclusively to applications verified as Accessibility Tools, blocking a major malware attack vector widely abused by banking trojans and stalkerware. Google identified accessibility API abuse as a primary conduit for financial fraud on Android. This change has significant implications for both legitimate accessibility app developers seeking verification and threat actors who have relied on this API for years.

Dell has released patches for two maximum-severity vulnerabilities in its Container Storage Modules (CSM), which integrate Dell enterprise storage arrays with Kubernetes environments, and is urging administrators to patch immediately. The flaws could allow attackers to compromise storage infrastructure in enterprise Kubernetes deployments. Given CSM's role in enterprise storage orchestration, exploitation could result in data loss or full storage cluster compromise.

Unknown attackers hijacked Microsoft's official X account — which has over 13 million followers — and used it to promote a Clippy-themed cryptocurrency token in what appears to be a coordinated pump-and-dump scheme. The incident demonstrates the continued risk of high-profile social media account compromise for amplifying crypto fraud at scale. Microsoft has not publicly disclosed the attack vector used to gain access to the account.

Frontline Education, a major software provider for K-12 school districts, is notifying districts of a data breach in which attackers exploited a vulnerability in third-party software to access employee data including Social Security numbers. The breach potentially affects employees across numerous U.S. school districts that rely on Frontline's platform for HR and administrative functions. The use of a third-party software vulnerability underscores supply chain risk in the education sector.

Denmark's Technical University (DTU) disclosed a breach of its identity and access management system, with hackers downloading data belonging to up to 200,000 users. The attack targeted DTU's IAM infrastructure — a high-value target that could expose credentials and access controls across the institution. The breach is particularly significant given DTU's role in sensitive research and its international academic collaborations.