🔴 FortiClient zero-day exploited ⚠️ Apache httpd pre-auth RCE 🎯 ClearFake blockchain C2 🇨🇮 CISA LiteSpeed KEV 🛡️ Notepad++ RCE ⚡ Roundcube SQLi

The FortiClient EMS zero-day is the day's defining story. Arctic Wolf observed active exploitation of CVE-2026-35616, an unauthenticated access control flaw that lets attackers issue privileged administrative requests to exposed EMS instances on port 8013. Operators modified Remote Access Profiles so endpoints run a malicious script on IPsec connect, delivering EKZ, an unreported infostealer disguised as a Fortinet patch. A management server flaw is worse than a product flaw: it turns every managed endpoint into a deployment target. FortiClient EMS zero-day

The Apache HTTP Server double-free is the second headline. CVE-2026-23918 in mod_http2 crashes worker processes with one TCP connection and two HTTP/2 frames, and on Debian-derived systems researchers confirmed a working remote code execution chain built on the scoreboard's fixed shared-memory mapping. Multi-threaded MPM is the default; 2.4.67 is the only fix. The LiteSpeed cPanel plugin flaw (CVE-2026-48172, CVSS 10.0) joined CISA's KEV with a May 29 federal deadline: any authenticated cPanel user can execute scripts as root.

Two developments erode assumptions defenders rely on. ClearFake moved payload delivery into BNB Smart Chain testnet smart contracts, making its command channel immutable and immune to sinkholing. The FBI separately warned that Silent Ransom Group physically sends associates to attach storage devices at law firm offices when remote access fails, making caller verification and hardware MFA operational requirements.

Watchlist: patch FortiClient EMS and restrict port 8013, upgrade Apache to 2.4.67 and the LiteSpeed plugin, and plan behavioral detection for blockchain-resident C2.