INJ3CTOR3 steals FreePBX credentials so toll fraud survives cleanup
A September installer uploads secrets from 17 telephony, database, and mail files; researchers saw no live theft.
64
Organization
Fortinet
- Mentions · 7d4
- Mentions · 30d30
- All mentions41
- First seenAug 12, 2026
- Last mentioned1d ago
Timeline
41 articles · newest firstXWorm loader reused in phishing against Colombia and the UK
The Colombian chain uses a .NET DLL whose hash matches a September UK case, but payloads and C2 differ.
58
CSO ranks incumbent security vendors adapting to AI threats
Palo Alto’s Prisma AIRS hit $100 million ARR, and the company bought CyberArk for $25 billion.
22
Fortinet lists Node.js flaws including Brotli decoder RCE
One issue, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that permits remote code execution.
64
Commentary: Caribbean outages show shared-platform cyber risk
A Curaçao ransomware incident and a shared court outage hit services used by six jurisdictions, the author argues.
24
INTERPOL Serengeti III nets 1,462 arrests and $105 million
Agencies in 21 countries identified 65,929 victims and losses exceeding $385 million from June 29 to August 31.
54
Interpol operation disrupts nearly 11,000 cybercrime networks in Africa
Serengeti III brought 1,462 arrests, identified 65,929 victims, and recovered more than $105 million.
56
INTERPOL Africa sweep arrests 1,462 and recovers over $105 million
Operation Serengeti III, from June 29 to August 31, linked networks to over $385 million in losses and 65,929 victims.
60
PHP core OOM handling can lead to RCE, Fortinet PSIRT says
CVE-2026-109618 is scored CVSS 9.8; the notice, also naming CVE-2026-109619, was revised on October 21.
68
New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory
Unit 42 details PEERSTITCH, a memory-resident implant used against FortiGate firewalls at a telecom MSP.
80
PoC Released for Critical Fortinet FortiClient EMS Authentication Bypass Vulnerability
A public PoC targets critical FortiClient EMS flaw CVE-2026-35616, which Fortinet says was exploited.
84
PoC Exploit Code Released for Fortinet FortiClient EMS Authentication Bypass Flaw
Public exploit code is out for FortiClient EMS flaw CVE-2026-35616, exploited since spring 2026.
88
ZDI-26-772: Fortinet FortiSandbox Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability
ZDI disclosed a CVSS 4.9 authenticated denial-of-service flaw in Fortinet FortiSandbox admin profile handling.
28
Persistent Denial of Service in Admin Profile
A privileged attacker can persistently deny FortiSandbox GUI and CLI access, CVSS 4.8.
24
SQL command injection in webmail
Authenticated FortiMail webmail SQL injection can let attackers run commands, rated CVSS 7.7.
58
Arbitrary file write in grpc phQueryMaster
Fortinet warns of a CVSS 9.4 FortiSIEM path traversal letting unauthenticated attackers run commands.
74
12th October – Threat Intelligence Report
Check Point's weekly report covers a Denmark registry breach of 8.8 million people, ransomware, and exploited enterprise flaws.
82
Casbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websites
Casbaneiro hides its main command channel until Latin American victims open targeted banking sites.
58
FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins
FBI says ongoing FortiBleed attacks still lock FortiGate VPN admins out using leaked and cracked credentials.
84
FortiBleed hit 86,000 firewalls by exploiting something nobody can patch away
FBI and Secret Service say FortiBleed credential campaign compromised 86,644 Fortinet FortiGate firewalls across 194 countries, selling access to ransomware affiliates.
82
FortiBleed is still active, with attackers locking admins out of Fortinet firewalls
FBI and Secret Service warn FortiBleed attackers continue compromising Fortinet firewalls — 86,644 devices verified — locking admins out and selling access to ransomware affiliates.
87
FortiBleed still a bleeding nuisance as FBI confirms ongoing attacks
FBI and Secret Service confirm ongoing FortiBleed attacks on 86,644 Fortinet devices across 194 countries, with INC/Lynx and Payload ransomware affiliates using stolen access.
80
Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine
Earth Sirrush has spear-phished Ukrainian government and logistics since 2022, possibly feeding Sandworm.
78
New Linux malware turns vulnerable IoT devices into proxy nodes
Fortinet says ClingSTUN Linux malware exploits known IoT flaws to turn devices into STUN-backed proxy nodes.
72
ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities to Gain Persistent Remote Access
Fortinet documents ClingSTUN, a Linux IoT backdoor exploiting multiple vendor flaws to build persistent proxy nodes with STUN-based control.
60
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure
Fortinet reports ClingSTUN, a Linux IoT backdoor that hides operator traffic using public STUN servers.
76
Stellar Cyber 7.0 adds measurable workflows for AI-powered SOCs
Stellar Cyber 7.0 adds measurable AI case triage, richer evidence, and broader automated SOC response.
34
Fortinet FortiMail Path Traversal Flaw Actively Exploited to Compromise Servers
Attackers are exploiting critical FortiMail path-traversal CVE-2026-104286 to write files and compromise email appliances.
85
Critical Fortinet FortiMail 0-Day Vulnerability Actively Exploited in Attacks
Attackers are exploiting critical FortiMail zero-day CVE-2026-104286 to write files without authentication.
88
Improper limitation of a pathname to a restricted directory
Fortinet warns of a CVSS 9.8 path traversal that lets unauthenticated attackers write arbitrary files, with in-the-wild exploitation reported.
88
Fortinet Uncovers SectopRAT Variant Hidden Inside Tampered Legitimate Windows Software
Fortinet found SectopRAT hidden in tampered Italian audio software, using DLL tampering, scheduled tasks, and in-memory loading for remote control and credential theft.
45
SectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets
SectopRAT hides in tampered legitimate software and steals browser credentials and crypto wallets.
60
11 Best GCP Security Tools Compared (2026): Features & Pricing
A 2026 buyer's guide ranks 11 GCP security tools, leading with Security Command Center and Wiz.
20
Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
Unauthenticated RCE CVE-2026-58138 in Orkes Conductor is actively exploited; Fortinet blocked ~7,000 attacks; patch to 3.30.2.
82
Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension
Fortinet patched 10 vulnerabilities including two critical authentication flaws, CVE-2026-84390 (CVSS 9.6) and CVE-2026-84388 (CVSS 9.1), in FortiMonitorOnSight and the FortiPAM Chrome extension.
58
KRBanker Targets South Korea Through Adware and Exploit Kits
Unit 42 details KRBanker banking trojan targeting South Korean bank users via KaiXin exploit kit and NEWSPOT adware, using pharming and process hollowing.
42
Stack buffer overflow in WAD
FortiOS explicit proxy WAD daemon stack buffer overflow (CVSS 5.1) allows code execution only with Kerberos and SOCKS configured.
24
Content-Encoding WAF Evasion
FortiWeb WAF policies can be bypassed by unauthenticated attackers using crafted Content-Encoding requests (CVSS 4.8).
22
UI DoS attack
FortiOS web interface is vulnerable to unauthenticated slow HTTP denial-of-service attacks via crafted requests (CVSS 5.0).
20
FGFM Authentication Weakening via CLI Configuration
FortiManager FGFM flaw (CVSS 7.3) lets an attacker with a valid certificate impersonate any managed FortiGate under a specific CLI option.
40
Related CVEs
by mentions- CVE-2026-3561694%9.8Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
- CVE-2026-1042865%9.8Unauthenticated path traversal file write in Fortinet FortiMail
- CVE-2025-3275631%9.8Stack-based overflow RCE in Fortinet FortiMail, FortiVoice, FortiNDR, FortiFone
- CVE-2026-2158999%9.3Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2023-38831100%7.8Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion
- Sensitive Information in Source Code in Fortinet FortiMonitorOnSight (CVSS 9.8)
- CVE-2024-702943%8.7Commands can be injected over the network and executed without authentication
- A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a…
- A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into…
Appears with
- Fortinetvendor · 24
- FortiGateproduct · 5
- FortiOSproduct · 4
- FBIorganization · 4
- SOCRadarorganization · 4
- Team Cymruorganization · 3
- Payloadorganization · 3
- Kasperskyorganization · 3
- Check Pointorganization · 3
- Lynxthreat actor · 3
- FortiManagerproduct · 3
- FortiSandboxproduct · 3
- FortiGuard Labsorganization · 3
- Group-IBorganization · 3
- Interpolorganization · 3
- FortiMailproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.