Fortinet Issues Emergency Patch for FortiClient Zero-Day

DarkReading roundup: Fortinet released an emergency patch for a FortiClient authentication-bypass zero-day (CVE-2026-35616) that has been exploited in the wild. The feed also highlights an F5 BIG‑IP vulnerability reclassified as an RCE and under exploitation (CVE-2025-53521), an automated credential‑harvesting campaign abusing React2Shell in exposed Next.js apps, an Axios NPM package compromise, AI-driven malware (DeepLoad), supply‑chain and GenAI security concerns, and escalating cloud/SaaS account takeover activity tied to groups like TeamPCP.