ThreatsDay: Fortinet fixes, PHP2Shell scans, Authenticator token flaw
Fortinet is withholding flaw details until November 10 while Hudson Rock reports 40,573 exposed FortiGate secrets.
64
Vendor
Fortinet
- Mentions · 7d10
- Mentions · 30d80
- All mentions145
- First seenAug 11, 2026
- Last mentioned1d ago
Timeline
145 articles · newest firstLevelBlue: vulnerability exploitation rose to 14% of initial access
The firm's Q1 figure was 20%, while Verizon's 2026 DBIR put exploitation behind 31% of breaches.
36
2026 ranking puts Cortex XSOAR first among SOAR tools
Editorial scores, not lab results, place Splunk SOAR and Tines next, with Torq leading the agentic-AI lane.
16
Fortinet offers FortiAIGate on Oracle Cloud for AI agent controls
The self-hosted gateway inspects prompts, MCP tool traffic, and responses, and can block or redact 35 data types.
28
Volt Typhoon rebuilt Silent Train relay chains since late 2023
Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.
84
Eclypsium report details exploited flaws in firewalls, VPNs and network appliances
InfraTrust tracked 133 new advisories covering 2,813 vulnerabilities in a month; 16 advisories involved actively exploited KEV-listed flaws.
90
FortiBleed 2.0 finds 40,573 cleartext secrets in FortiGate configs
Hudson Rock parsed 1,703 FortiGate configuration reports and 1,689 host identifiers; 975 domain labels were absent from the earlier set.
58
FortiBleed 2.0 finds 40,573 cleartext secrets in exposed FortiGate configs
The follow-up is stolen configuration files, not a new Fortinet flaw, and the records are not confirmed still valid.
66
Check Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
Fortinet patches critical FortiOS flaws, details held to November 10
Fixes cover FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator; Fortinet says public diffs will show attackers where to look.
72
INC and Gentlemen affiliates used AI agents in ransomware intrusions
Exposed logs show 8,257 messages across 133 sessions and an estimated 62 targets, four of which appeared on leak sites.
78
Canadian centre flags Fortinet flaws in six product lines (AV26-1081)
Fixed builds are listed for current branches, while FortiMail 7.2 must move to branch 7.4 or above.
36
k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
78
k0t steals credentials from FortiGate, FortiWeb and GlobalProtect
Group-IB reports more than 70,000 exposed credentials and active use of CVE-2025-64446 and CVE-2026-0257.
78
Fortinet schedules critical fixes for FortiOS, FortiManager, and FortiAnalyzer
Minimum fixed builds are set for October 22, while PSIRT advisories and CVE details are due November 10.
70
PAN-OS and Panorama affected by unpatched PHP2Shell flaws
Palo Alto has no fixed PAN-OS builds yet; Fortinet is still checking 12 products and Cisco 31 products and services.
74
Fortinet urges urgent patches for FortiOS, FortiManager and FortiAnalyzer
October 22 updates precede November 10 PSIRT advisories; Fortinet reports no active exploitation and lists no CVE IDs.
74
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
78
Ransomware affiliates using Claude left chats and tools exposed
SOCRadar found 46 INC encryptor builds, notes on 62 organizations, and more than $23,920 in recorded AI spend.
78
Public exploit released for unauthenticated FortiSIEM RCE (CVE-2026-106173)
Horizon3.ai’s proof of concept writes files via unauthenticated gRPC on port 27918; 7.5.1 fixes 7.5.0, and 7.6 is unaffected.
74
Public PoC turns FortiSIEM file-write flaw into unauthenticated RCE
Horizon3.ai's GitHub PoC targets FortiSIEM 7.5.0 over TCP 27918; Fortinet advises 7.5.1 or later.
74
Public PoC targets critical FortiSIEM unauthenticated RCE (CVE-2026-106173)
Horizon3.ai shows a gRPC path traversal on port 27918 that overwrites a cron-run Redis health script.
67
FortiSIEM gRPC flaw allows unauthenticated file-write RCE
phQueryMaster on tcp/27918 accepts any client, and a crafted query id can overwrite a cron-run script.
76
UNC5820 used Fortinet zero-days to plant PeerStitch at a telecom
CISA added CVE-2025-61624 to KEV; the memory-only implant rides legitimate FortiGate process traffic.
84
U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Fortinet and BeyondTrust flaws to KEV, with a federal fix deadline of October 19.
88
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited Fortinet and BeyondTrust flaws to the Known Exploited Vulnerabilities catalog.
79
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
Unit 42 says PEERSTITCH, planted through FortiManager flaws, exposed material for more than 500 firewalls.
82
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Unit 42 says CL-STA-0954 used Fortinet flaws to deploy memory-resident PEERSTITCH against a telecom provider.
84
CISA lists Fortinet path traversal CVE-2025-61624 as exploited
Authenticated admins with read-write rights can write or delete arbitrary files via CLI; the due date is October 19, 2026.
76
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
Silent Lynx used a WinRAR flaw and phishing to plant reverse shells on CIS government targets.
76
New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory
Unit 42 details PEERSTITCH, a memory-resident implant used against FortiGate firewalls at a telecom MSP.
80
Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Attackers exploited Fortinet flaws at a telecom MSP and deployed the stealthy PEERSTITCH implant on FortiGate firewalls.
82
PoC Released for Critical Fortinet FortiClient EMS Authentication Bypass Vulnerability
A public PoC targets critical FortiClient EMS flaw CVE-2026-35616, which Fortinet says was exploited.
84
PoC Exploit Code Released for Fortinet FortiClient EMS Authentication Bypass Flaw
Public exploit code is out for FortiClient EMS flaw CVE-2026-35616, exploited since spring 2026.
88
ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability
ZDI discloses an unauthenticated hard-coded credential bypass in Fortinet FortiSandbox, CVE-2026-107656 (CVSS 7.3).
58
ZDI-26-772: Fortinet FortiSandbox Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability
ZDI disclosed a CVSS 4.9 authenticated denial-of-service flaw in Fortinet FortiSandbox admin profile handling.
28
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Unit 42 says UNC5820 stole data on 500-plus FortiGates and deployed memory-resident PEERSTITCH malware.
84
TAG-193’s Regional Espionage Operations
TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.
76
Fortinet security advisory (AV26-1037)
Canada's Cyber Centre urges patches for file-write and SQL-injection flaws across several Fortinet products.
52
Persistent Denial of Service in Admin Profile
A privileged attacker can persistently deny FortiSandbox GUI and CLI access, CVSS 4.8.
24
Related CVEs
by mentions- CVE-2026-1042865%9.8Unauthenticated path traversal file write in Fortinet FortiMail
- CVE-2025-252494%9.8Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
- CVE-2025-616241%6.5Authenticated path traversal in Fortinet FortiOS and related products
- CVE-2024-4757595%9.8Unauthenticated RCE in Fortinet FortiManager and FortiManager Cloud
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-7650439%9.8Unauthenticated admin API auth bypass in Cisco Catalyst SD-WAN Manager
- CVE-2026-3561694%9.8Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-106173<1%9.8Path traversal to remote code execution in FortiSIEM 7.5.0
Appears with
- FortiOSproduct · 33
- FortiGateproduct · 32
- CISAorganization · 30
- Palo Alto Networksvendor · 24
- Fortinetorganization · 24
- FortiMailproduct · 23
- Microsoftvendor · 22
- FBIorganization · 17
- FortiManagerproduct · 17
- Citrixvendor · 16
- Ciscovendor · 14
- Check Pointvendor · 14
- Googlevendor · 14
- CrowdStrikevendor · 12
- FortiSandboxproduct · 11
- SOCRadarorganization · 11
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.