Friday, October 2, 2026 · 3 MIN READ
FortiMail Under Attack, WordPress Malware Keeps Coming Back
IT BRIEFING FOR BUSINESSES
An actively exploited FortiMail flaw and a persistent WordPress backdoor lead today's briefing for Ohio businesses. Other alerts cover connected equipment, Android protections, ransomware enforcement, and the handling of sensitive company information.
FortiMail Users: Put This Flaw First
CISA has added Fortinet FortiMail vulnerability CVE-2026-104286 to its Known Exploited Vulnerabilities catalog after evidence of attacks. Rated 9.8 in severity, the flaw lets attackers write arbitrary files to the underlying system without signing in.
For businesses using FortiMail, this is an active threat—not just a theoretical weakness. Ask your IT provider to check whether your deployment is affected and prioritize the applicable vendor remediation.
SOURCES:CISA Advisories The Hacker News
WordPress Cleanup May Need a Second Look
Researchers have described a WordPress backdoor called SC that uses files, the database, and shared memory to maintain its presence. Its overlapping persistence methods allow the malicious payload to return after cleanup without a fresh infection.
For a business website, removing one suspicious file may leave the underlying compromise in place. If your WordPress site has been affected, ask your website support team to investigate all three locations rather than treating file removal as a complete fix.
SOURCES:The Hacker News
Check the Systems That Control Your Building
CISA warns that flaws in Armatura One could expose databases, allow code execution with the highest privileges, or give attackers control of physical access systems. Affected releases are earlier than 4.7.2, or earlier than 4.6.1 for the USA edition. Separately, certain Johnson Controls EasyIO Neo EC and CW controller versions could disclose information useful in further attacks.
These alerts matter beyond office computers: they concern equipment supporting physical operations. Ask your building-system contractor to compare installed versions with the advisories and identify the appropriate remediation.
SOURCES:CISA Advisories CISA Advisories
Connected Devices and Charging Services Face Control Risks
CISA reports that Meari IoT Cloud Platform OpenAPI weaknesses could let attackers change device settings, trigger unauthorized behavior, or access credentials, owner details, and network information. A separate Monta monta.app advisory describes risks of unauthorized administrative control over charging stations and disruption of charging services. Both advisories list all versions as affected.
Businesses relying on these services could face exposed information or interrupted operations. Ask your device or charging-service provider whether your equipment uses either platform and what protections or remediation are available.
SOURCES:CISA Advisories CISA Advisories
ABB Management Software Needs a Version Check
CISA has flagged two vulnerabilities in ABB Protection and Control IED Manager PCM600, affecting version 2.14 and earlier. Successful exploitation could let an attacker gain additional privileges or overwrite files.
For businesses using this software in energy-related operations, those capabilities could undermine control over the management system. Have your operational technology support team check installed versions and review ABB's remediation guidance.
SOURCES:CISA Advisories
Android Tightens a Route Used by Malicious Apps
Google has announced that Android 17 will restrict accessibility-service access to verified Accessibility Tools when Advanced Protection is enabled. The change targets an interface that malicious Android apps have abused for malware and financial fraud.
For businesses using Android phones, the protection could help reduce a known attack route, but it depends on Advanced Protection being enabled. Ask your mobile-device administrator to evaluate the feature and check compatibility with accessibility tools employees need.
SOURCES:The Hacker News
KillSec Arrests Highlight Data-Extortion Pressure
Spanish police arrested three people on September 30, including a 16-year-old suspected of running the KillSec ransomware group. Authorities also took control of its leak site and servers. The group is accused of stealing organizational data and demanding payment to keep it from being published.
The case highlights a business risk that goes beyond unavailable computers: stolen information can become leverage. Review your incident-response plan so it covers threatened publication of company or customer data, not just restoring systems.
SOURCES:The Hacker News
Sensitive Information Needs Clear Handling Rules
OpenAI parted ways with three safety-team members over violations of policies governing access to and handling of sensitive company information, according to reporting by The Wall Street Journal. The report described leaks of private information.
For smaller businesses, the takeaway is that internal information handling deserves attention alongside outside attacks. Review who can access sensitive material and make sure employees understand the rules for sharing it.
SOURCES:The Hacker News