Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

This week’s roundup covers a massive Microsoft Patch Tuesday with two exploited zero-days, active FortiGate exploitation, a critical PAN-OS root-level RCE flaw, the Revolut KYC data breach, and more than 20 other stories spanning AI-driven cyberattacks, browser and firewall zero-days, and enterprise breach disclosures. Microsoft’s September 2026 Patch Tuesday addressed a staggering 973 vulnerabilities, spanning Windows, Office, SQL Server, Exchange, SharePoint, Azure, and developer tools. Elevation of privilege flaws dominated the release at 438 issues, followed by 258 remote code execution bugs, with Windows Biometric Service alone accounting for 64 separate vulnerabilities, suggesting a systemic weakness in the authentication subsystem. Two zero-days were confirmed under active exploitation: CVE-2026-85880 in Windows ALPC and CVE-2026-81963 in the Windows Update Stack, both elevation-of-privilege bugs rated Important. Critical fixes also landed for Windows Secure Kernel Mode, VBS Enclave, and Excel/Word RCE flaws, making this one of the largest and most urgent patch cycles of the year for enterprise IT teams. SOCRadar researchers uncovered an active campaign exploiting CVE-2025-25249, a critical 9.8-rated heap overflow in FortiOS and FortiSwitchManager’s CAPWAP service, to deploy a custom Node.js RAT called PivotC2. The malware opens outbound TLS connections to bypass firewall restrictions, harvests device configurations, and decrypts stored VPN…