Guessed FortiGate passwords, coding agent hijack, Brotli beyond Node | Cyber Security News Oct 26

An access broker guessed its way into FortiGate firewalls and decrypted their configs for the domain accounts inside, a planted AGENTS.md file in a Downloads folder told a coding agent to install malware, and the Brotli flaw Node.js patched last week turns out to live in Google's decoder. Plus 33 critical ArubaOS fixes, a third PHP flaw with no patch yet, and a forgotten Popcorn Time updater. Every version number and every fix in this episode was checked against the vendor's own advisory before it aired. Today's question: Where does your team let coding agents start, and who decided? Reply in the comments or at [email protected].

1. Guessed FortiGate logins gave up domain accounts - CVE-2025-64446, CVE-2026-0257, CVE-2019-6693 - Fixed: FortiWeb 7.0.12, 7.2.12, 7.4.10, 7.6.5 or 8.0.2 - Do: Take Fortinet admin logins off the internet - https://fortiguard.fortinet.com/psirt/FG-IR-25-910

2. AGENTS.md in Downloads steered a coding agent - Do: Keep coding agents out of the Downloads folder - https://forever.security/blog/hijacking-ai-agents-via-downloads-folder

3. Update: the Brotli flaw reaches far past Node.js - CVE-2026-111497 - Fixed: Brotli 1.0.10, 1.1.1 or 1.2.1 - Do: Patch every copy of the Brotli decoder - https://research.jfrog.com/post/brotli2shell-beyond-node2shell-and-http2shell/

4. ArubaOS fixes 33 critical flaws - CVE-2026-79844, CVE-2026-79845, CVE-2026-79846 (+ 2 more) - Fixed: 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24 - Do: Upgrade ArubaOS and restrict management access - https://cyber.gc.ca/en/alerts-advisories/hpe-security-advisory-av26-1079

5. Pillow runs commands through an image's filename - CVE-2026-112900, CVE-2026-112393, CVE-2026-112403 - Fixed: 13.0.0 - Do: Upgrade Pillow in every Python project - https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh

6. Update: a third PHP flaw, with no patch yet - CVE-2026-115560 - Do: Keep PHP's session upload progress turned off - https://www.php.net/archive/2026.php#2026-10-23-1

7. Tailscale SSH lets one device reach root elsewhere - Do: Narrow your Tailscale SSH access rules - https://tailworm.com/

8. Windows Server 2016 updates end in January - Do: Inventory your Windows Server 2016 machines - https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016

9. Researchers switched off a Popcorn Time updater - CVE-2026-30612 - Do: Find and remove Time4Popcorn from company machines - https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/