by sig9
Hacker Wars - October 08, 2026
Your daily dose of infosec chaos
Fortinet edge devices are having a rough stretch: the FBI says FortiBleed crews are still breaking into exposed FortiGates and locking the legitimate admins out. Oracle Health’s breach tally meanwhile ballooned to nearly 20 million patients, and the Shai-Hulud worm swallowed another npm package for breakfast. On the entertainment side, a ransomware “recovery” CEO got charged for allegedly just paying the ransom, and Pwn2Own researchers parted a Galaxy S26 from its dignity three more times.
FBI Warns FortiBleed Attackers Are Locking Admins Out Of FortiGates
The FBI says FortiBleed attacks are alive and well: intruders are hitting exposed FortiGate firewalls and SSL VPN gateways, creating rogue admin accounts, and deleting existing accounts and passwords so nobody legitimate can log back in. Nothing says “you’re evicted” quite like losing the admin login to your own edge device - and these attackers change the locks on their way in.
What to do: If a FortiGate is or was internet-facing, treat its credentials as burned - rotate everything, audit local accounts for strangers, and get the box off the open internet.
Oracle Health Breach Tally Swells To Nearly 20 Million
The number of individuals affected by the Oracle Health breach has climbed to nearly 20 million, far beyond the counts in the initial filings and patient notifications. The gap between what gets disclosed first and what gets admitted months later is doing a lot of heavy lifting for the “trust us” school of breach notification.
What to do: If you run clinical operations on Oracle Health, do your own risk assessment instead of waiting for the final tally - and check your breach notification obligations before Oracle’s calendar does.
Shai-Hulud Worm Gulps Down Another npm Package
Version 0.5.144 of the “tensorlake” TypeScript SDK shipped with obfuscated credential-harvesting malware, the latest casualty of the Shai-Hulud supply chain worm that keeps chewing through npm. A worm that spreads via stolen maintainer tokens needs no new exploit - the ecosystem’s trust model is the exploit.
What to do: Pin dependencies by hash, roll back anything that auto-upgraded to 0.5.144, and rotate every credential that touched a machine that ran it.
Ransomware “Recovery” CEO Charged Over Secret Ransom Payments
US prosecutors charged the owner of MonsterCloud with defrauding victims out of more than $19 million, alleging he secretly paid attackers for decryptors while claiming proprietary recovery tools were saving the day. “We never negotiate with criminals” apparently came with fine print - and the fine print is now an indictment.
What to do: Put ransom-negotiation transparency clauses in your IR retainer, and side-eye anyone promising miracle decryption without explaining where the keys came from.
Pwn2Own Researchers Keep Dismantling The Galaxy S26
Day two of Pwn2Own Ireland paid out $232,500 for 45 unique zero-days, including three more successful attacks against Samsung’s flagship Galaxy S26. Every exploit gets handed to the vendor, so enjoy the gap between “researcher demo” and “patched fleet” - that window is your threat model on mobile.
What to do: Keep mobile patch SLAs tight and treat “flagship device” as a pricing statement, not a security guarantee.
That’s the chaos for today. Stay sharp out there.
Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown
This bulletin is provided for informational purposes. Contact us for tailored security analysis.