Loki Intelligence — Security Briefs · Published
Daily Security Brief: PAN-OS MFA Bypass, FortiSIEM PoC, eMudhra CA Keys
Today's picture centers on edge and trust infrastructure: patched but still exploited PAN-OS, a critical FortiSIEM flaw with a public PoC, and compromised intermediate CA keys. Teams should prioritize patching internet-facing security products, moving access decisions ahead of vulnerable gateways, and applying browser and client trust updates.
Signal 01 · The Hacker News
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks says ransomware actors are still exploiting CVE-2026-0257 (CVSS 7.8), an authentication bypass in PAN-OS and Prisma Access that has already been patched. The headline links the activity to the Qilin and INC groups and to bypassing MFA.
Why it matters: A patch only protects systems where it is applied, so confirm affected PAN-OS and Prisma Access deployments are updated and review authentication logs for unexpected access.
Source: The Hacker News
Signal 02 · The Hacker News
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Researchers published a proof-of-concept for CVE-2026-106173 (CVSS 9.4), a recently patched critical path traversal flaw in Fortinet FortiSIEM that can lead to arbitrary code execution.
Why it matters: Public PoC code shortens the time before wider exploitation, so apply the vendor fix to FortiSIEM now and restrict network exposure of the management interfaces.
Source: The Hacker News
Signal 03 · The Hacker News
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
A researcher observed a Chinese-speaking criminal operator directing autonomous AI agents at company websites with little manual involvement, after the operator's control panels were left exposed on the internet. The report says over 1,200 sites were targeted.
Why it matters: Automated, agent-driven probing raises the pace of attacks on web applications, so keep internet-facing apps patched, monitor for unusual request patterns, and validate defenses through authorized testing such as LOKI's bounded web, API and AI agent assessments.
Source: The Hacker News
Signal 04 · Cloudflare Security
Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
Cloudflare describes CVE-2026-88771, which allows command execution on NetScaler Gateway before sign-in, and argues that because patching takes time, the authentication decision should be placed in front of the vulnerable code.
Why it matters: Putting an access-control layer ahead of exposed gateways can reduce risk during the patch window, but it does not replace applying the vendor update.
Source: Cloudflare Security
Signal 05 · Cloudflare Security
8 eMudhra certificates are compromised. Here's what you need to know
Cloudflare reports that eight eMudhra intermediate certificates use weak keys and says it is deploying mitigations and releasing client updates, with guidance for customers and developers.
Why it matters: Teams should review Cloudflare's guidance, update client software and trust stores, and check whether any of their systems rely on the affected certificates.
Source: Cloudflare Security
Signal 06 · The Hacker News
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
Mozilla and Google's Chrome Root Program confirmed on October 20 that the private keys of eight eMudhra intermediate CA certificates are compromised. Because intermediate CAs sign the certificates websites present, a key holder could issue certificates for sites.
Why it matters: Keep browsers, operating systems and libraries current so distrust measures reach your users and services, and monitor certificate transparency logs for your domains.
Source: The Hacker News
Signal 07 · The Hacker News
Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election
Citizen Lab said on October 19 that NSO Group's Pegasus spyware infected the iPhone of a University of Belgrade rector in 2026, with the finding coming six days before an election.
Why it matters: High-risk individuals and the organizations supporting them should keep devices updated and use the platform's enhanced protection modes where available.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.