FBI botnets/appliance/router/iOS/AI/EDR/Windows zero-days (BlueHammer/Fortinet/Flowise/FortiClient/ClamAV/Flatpak/NetScaler/Docker)
Key Questions
What router brands were targeted by APT28 hackers?
APT28 (Fancy Bear) targeted SOHO routers like MikroTik, TP-Link, and Ubiquiti, compromising over 18,000 devices to steal tokens. This created a global spy network for credential theft.
What is the BlueHammer Windows vulnerability?
BlueHammer is an unpatched Windows zero-day local privilege escalation (LPE) exploit publicly released by a disgruntled researcher. It combines time-of-check to time-of-use flaws, with Microsoft urged to patch urgently.
How does the Docker CVE-2026-34040 work?
This flaw allows attackers to bypass security controls and take over hosts in Docker environments. It enables full host compromise from containers, highlighting the need for immediate patching.
What is the Flowise vulnerability being exploited?
Flowise's CVE-2025-59528 (CVSS 10) is a critical RCE flaw actively exploited by attackers. Along with Langflow, it poses high risks to AI/dev tools, requiring patch and hunt strategies.
What Fortinet vulnerabilities were targeted?
Attackers exploited zero-days in Fortinet FortiClientEMS (CVE-2026-35616 & CVE-2026-21643) and other products for RCE, bypassing authentication. Hot patches are available, with EDR monitoring critical.
What is Citrix NetScaler Bleed3?
CVE-2026-3055 (CVSS 9.3) is a memory disclosure flaw in Citrix NetScaler ADC/Gateway, actively exploited alongside SharePoint RCE. It contributes to a 56% surge in exploits.
What Chrome vulnerability is in the wild?
Chrome CVE-2026-5281 is being exploited, part of multiple zero-days including iOS, Android, and Windows. Patching and threat hunting are essential amid rising exploit activity.
Why are router hacks by Russian actors significant?
Russian hackers like APT28 hijacked routers for password and Microsoft token theft, affecting thousands globally. This botnet activity stresses the need for firmware updates and zero-trust on appliances.
APT28 routers; BlueHammer LPE; Fortinet RCE; Flowise/Langflow/ClamAV OpenClaw CVE-2025-20128 zero-click RCE; Flatpak sandbox leak; Chrome exploited; 56% exploits surge, patch critical.