Zero-Days, Certificate Flaws, and Malware: The Week's Top Cybersecurity Threats

This week's roundup of cybersecurity news includes several high-profile vulnerabilities and breaches. Microsoft patched 973 vulnerabilities in its September 2026 Patch Tuesday, including two zero-days under active exploitation. Fortinet disclosed a certificate validation flaw in its FortiOS and FortiProxy products that can be exploited to perform man-in-the-middle attacks.

FortiGate firewalls have been exploited to deploy custom malware, with attackers targeting U.S. organizations and compromising 178 devices. The malware uses Node.js to harvest device configurations and decrypt stored VPN credentials.

Palo Alto Networks disclosed a buffer overflow flaw in its PAN-OS XML processing that can be exploited to achieve root-level code execution on PA-Series hardware firewalls.