Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
Product
FortiWeb
- Mentions · 7d1
- Mentions · 30d7
- All mentions9
- First seenAug 12, 2026
- Last mentioned4d ago
Timeline
9 articles · newest firstk0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
78
k0t steals credentials from FortiGate, FortiWeb and GlobalProtect
Group-IB reports more than 70,000 exposed credentials and active use of CVE-2025-64446 and CVE-2026-0257.
78
PAN-OS and Panorama affected by unpatched PHP2Shell flaws
Palo Alto has no fixed PAN-OS builds yet; Fortinet is still checking 12 products and Cisco 31 products and services.
74
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
78
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
Silent Lynx used a WinRAR flaw and phishing to plant reverse shells on CIS government targets.
76
TAG-193’s Regional Espionage Operations
TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.
76
Content-Encoding WAF Evasion
FortiWeb WAF policies can be bypassed by unauthenticated attackers using crafted Content-Encoding requests (CVSS 4.8).
22
Broken access control in the RADIUS type admin group
FortiWeb RADIUS admin authentication flaw (CVSS 8.8) permits remote GUI/CLI login with random credentials under specific non-default settings.
48
Related CVEs
by mentions- CVE-2025-6444691%9.8Unauthenticated Path Traversal in Fortinet FortiWeb Enables Admin Command Execution
- CVE-2026-025795%7.8Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2025-808894%8.4WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution
- CVE-2025-25257100%9.8Critical Unauthenticated SQL Injection in Fortinet FortiWeb (CVE-2025-25257)
- CVE-2026-1146251%9.4SQL injection in Arista VeloCloud Orchestrator grants superuser
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2019-66937%6.5Hard-Coded Encryption Key in Fortinet FortiOS Configuration Backups
- CVE-2026-1102641%10.0Unauthenticated RCE in GitLab CE/EE via regex integer overflow
Appears with
- Fortinetvendor · 9
- Palo Alto Networksvendor · 5
- FortiGateproduct · 4
- k0tthreat actor · 4
- GlobalProtectproduct · 4
- PAN-OSproduct · 3
- Group-IBorganization · 3
- UAT-6275threat actor · 2
- NyxLaborganization · 2
- FoalShellmalware · 2
- TAG-193threat actor · 2
- Recorded Futureorganization · 2
- Laplasmalware · 2
- AdaptixC2malware · 2
- Cisco Talosorganization · 2
- Fortinetorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.