Executive assessment
Today's brief leads with Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials. All 3 selected findings retain their own technical scope, action, observed status, and evidence limits.
Finding 01 — Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
What changed: The k0t intrusion campaign exploited CVE-2025-64446 in FortiWeb and CVE-2026-0257 in PAN-OS and Prisma Access, then used VPN access, credential theft, remote-management tooling, and cloud storage for persistence and exfiltration. Researchers identified more than 70,000 exposed credentials, with 15.8 percent of victims in Europe.
Technical evidence: CVE-2025-64446; CVSS v3.1 9.4; weakness CWE-23; technical confidence High.
Why it matters: Reported active exploitation elevates this above routine patching: validate exposure immediately, remediate, and assess for prior compromise.
Observed status: Observed in-the-wild exploitation is confirmed.
Action: Map CVE-2025-64446 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: thehackernews.com](https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html)
Finding 02 — eMudhra Intermediate Certificates Compromised
What changed: Per NHS England cyber alert CC-4880: weak randomness exposed private keys for eight eMudhra intermediate certificate authorities. The affected intermediates were revoked and major platform vendors blocked them, but stale trust stores remain exposed to fraudulent TLS or code-signing chains; the alert maps vendor remediations to CVE-2026-91403, CVE-2026-111943, and CVE-2026-113470.
Technical evidence: CVE-2026-91403; CVSS v3.1 9.1; weakness CWE-327; technical confidence High.
Why it matters: The Critical priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2026-91403 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: digital.nhs.uk](https://digital.nhs.uk/cyber-alerts/2026/cc-4880)
Finding 03 — BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
What changed: The China-linked BlackX UEFI bootkit abuses CVE-2022-21894 after privileged access to bypass Secure Boot on Windows systems where certificate revocations were not manually applied. Kaspersky observed the bootkit against Central Asian diplomatic targets and linked it to APT41 with medium confidence.
Technical evidence: CVE-2022-21894; CVSS v3.1 4.4; weakness CWE-863; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Action: Map CVE-2022-21894 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
Evidence limits: fixed version or patch state unknown
[Evidence source: thehackernews.com](https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html)