An Unpatched GeoServer Zero-Day Is Under Active Attack, Fortinet Patches Eight Auth Bypass Flaws, and a New Backdoor Is Hitting Afghan Telecoms

Start with the one that has no patch yet. A bug bounty hunter going by @q1uf3ng dropped a zero-day on X at 10:46 UTC on August 12: an unauthenticated SQL injection in GeoServer's jsonArrayContains function, and on installations backed by Microsoft SQL Server running with admin permissions, it goes straight to remote code execution. No CVE identifier yet. No patch yet. And it didn't sit quiet for long — watchTowr says it detected exploitation attempts within hours of the disclosure, hundreds of them, traced to a small pool of source IPs. "Currently, we're seeing attackers probe to identify vulnerable systems across the internet, triggering errors and not proceeding further," watchTowr's Jake Knott told The Hacker News. Read that correctly: reconnaissance now, payloads later. GeoServer isn't a niche product — it's the open-source backbone for a huge share of the world's geospatial data infrastructure, deployed across government, defense, science, and engineering. If you're running it, don't wait for a CVE number to take this seriously. Restrict public access to any exposed instance today, and start watching logs for the SQL error signatures of injection attempts, because the probing traffic is already out there looking for you.

Fortinet, meanwhile, closed out eight vulnerabilities on its own patch cycle, and two of them deserve more attention than a routine advisory usually gets. CVE-2026-26035, sitting in FortiWeb, is an improper authentication bug that only bites when an administrator account is configured for Remote RADIUS with the "wildcard" setting enabled — non-default, but far from rare in the wild. Under that configuration, FortiWeb will match any username against a defined admin group, which means a remote, unauthenticated attacker can log into the GUI or CLI with a random username and password. Not a weak password. Not a leaked credential. A made-up one. The second, CVE-2026-70468, lives in FortiManager's FGFM protocol and — if a specific CLI option is set and the attacker holds a valid certificate — lets them impersonate any FortiGate device under that FortiManager's management, which opens the door to manipulating firewall policy at scale across an entire fleet. Fortinet also patched a high-severity buffer overflow in FortiClient for Windows. None of these are confirmed under active exploitation yet, and that's exactly the window you want to patch inside of, not after. Check whether wildcard RADIUS is enabled on any FortiWeb deployment you run, and if you don't need it, turn it off regardless of patch status.

On the breach side, Ceva Logistics, one of the larger names in European contract logistics, got hit hard enough to cause real shipment delays across eight warehouses. Details on the intrusion method haven't surfaced publicly yet, but the operational impact has: multiple customers dealing with delayed shipments is not a contained IT incident, it's a supply chain event. Logistics operators sit at a genuinely uncomfortable intersection — deeply networked for efficiency, running a mix of modern and legacy warehouse management systems, and increasingly a preferred target precisely because disruption there cascades outward to everyone downstream. If your organization depends on third-party logistics providers, this is a good week to ask them directly what their incident response and business continuity posture actually looks like, not just what's in the contract.

On the espionage front, Acronis's Threat Research Unit disclosed a new campaign targeting Afghan telecom providers and South Asian critical infrastructure organizations with a previously undocumented backdoor called PATCHCORD. It's a compiled C/C++ implant, and the delivery is sector-specific and well-targeted: fake VPN installers impersonating Afghan Telecom (AFTEL), dressed up alongside legitimate-looking telecom management tools. This isn't spray-and-pray malware — it's built for a specific victim set, which is generally the signature of a state-aligned or state-adjacent operator rather than a financially motivated crew. Telecom-sector defenders in the region, and anyone running AFTEL-branded or similarly regional VPN tooling, should be validating installer sources and checksums before deployment, not after.

And on mobile, Group-IB detailed how SpyNote, a long-running Android RAT, has been weaponized into a real-time NFC card-skimming tool. The malware abuses Android's Accessibility Service to silently sideload and activate an NFC-capture app — no screen sharing, no visible prompt, nothing that would tip off the victim mid-attack. Once active, it captures live payment card data via NFC and transmits it to fraudsters in real time. Distribution runs through the usual social-engineering playbook: phishing, smishing, and vishing lures that talk victims into sideloading the app outside the Play Store. The technical novelty here is the Accessibility Service abuse specifically — it's become one of the most consistently exploited legitimate Android features in the malware landscape this year, precisely because it exists to give apps deep system access for accessibility purposes, and Android has no clean way to distinguish that from abuse at the permission-grant stage. If your mobile device management policy doesn't already flag or restrict Accessibility Service grants for unmanaged apps, this is the week to fix that gap, not the week to file it under "someday."

Zoom out and the pattern across today's stories is consistent, even though the targets are wildly different: authentication is the load-bearing wall in every one of these incidents. The FortiWeb bug bypasses it outright. The FortiManager bug impersonates trusted identity at the device level. PATCHCORD gets in by impersonating a trusted installer. SpyNote gets in by impersonating a legitimate permission request. GeoServer's flaw doesn't touch authentication at all — it doesn't have to, because the endpoint should never have accepted unauthenticated input in the first place. None of this is exotic tradecraft. It's the same fundamental weakness, worn in five different disguises, and it's why identity and input validation still deserve to be the first two things any security review actually checks — not the last two.