Threat Briefing: October 9, 2026

This week’s cybersecurity news highlighted AI-driven threats, persistent phishing and credential theft, and third-party risk. Google Threat Intelligence Group reported surging vulnerability exploitation, with attackers using AI to weaponize new flaws faster.

The FBI warned that the FortiBleed campaign remains active, with compromised Fortinet VPNs enabling ransomware, while an unpatched Oracle PeopleSoft platform led to a third-party breach. Researchers also uncovered Milk Dragon, a global phishing operation using fake social media discounts to steal card data and one-time passcodes.

Finally, the DOJ charged a ransomware recovery company owner with concealing ransom payments and misleading clients, underscoring the need to vet recovery vendors carefully.

• AI Speeds Up Vulnerability Exploitation – Google’s Threat Intelligence Group reports monthly vulnerability disclosures doubled from 5,045 in January to over 10,740 in August 2026. Already, 141 vulnerabilities have been exploited this year, more than all of 2025. Google attributes the surge to AI and LLM tools that help attackers quickly weaponize patched flaws rather than find new zero-days. The Record
• Missed Patch Exposes FBI Employee Data – The FBI removed an Accenture contractor after a breach of its Oracle PeopleSoft HR platform exposed personal information of thousands of employees. FBI cyber chief Brett Leatherman said the contractor failed to apply a patch issued specifically for the platform. SecurityWeek
• FortiBleed Attacks Lock Admins Out of FortiGate Devices – The FBI warns that FortiBleed attacks remain active, with attackers using stolen credentials tied to 86,644 compromised FortiGate firewalls and SSL VPN gateways to lock out administrators. Ransomware affiliates, including INC/Lynx and Payload, have adopted the technique for initial access. BleepingComputer
• Milk Dragon Phishing Kit Steals Payment Data with Fake Discounts – Group-IB identified Milk Dragon, active since October 2025, which uses fake brand discount posts on Facebook and TikTok to send victims to fraudulent WooCommerce stores. The kit is linked to 258 phishing pages, victims in 66 countries, and impersonation of 21 brands and 36 financial institutions. Help Net Security
• Ransomware Recovery Firm Owner Charged with Fraud – The Justice Department charged Zohar Pinhasi, owner of Florida-based MonsterCloud, with wire fraud and conspiracy. He allegedly paid ransoms to cybercriminals while charging victims inflated fees and falsely claiming to use proprietary decryption tools. Pinhasi collected $19 million from clients while paying about $8 million in ransoms, and faces up to 20 years in prison if convicted. The Record