60
45
May 2026 CVE Landscape
60
60
Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider
Exposed attacker staging server reveals intrusion of Thai broadband provider 3BB via actively exploited FortiGate SSL-VPN flaw CVE-2024-21762.
Hunt.io found an open directory on server 92.63.180[.]133 holding 298 files detailing an intrusion into Triple T Broadband's 3BB brand, starting from a FortiGate 60F SSL-VPN at mail.3bb.co[.]th:10443. The actor weaponized CVE-2024-21762 (CVSS 9.8, KEV-listed since February 2024) using heap spraying and a ROP chain to gain a reverse shell. Post-exploitation included MeshCentral root-level persistence via www.ayuthayatech[.]com, Dirty COW/PwnKit privilege escalation, credential harvesting, SSH spraying against 55+ internal addresses, and log-deleting cleanup scripts; a stolen OpenVPN certificate and key from Triple T's PKI may still be valid.
75
60
Network Security Trends: August
60
60
Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited
60
60
63 New Flaws (Including 0
60
57
Week in review: Windows kernel flaw patched, suspected Fortinet FortiWeb zero-day exploited
60
60
⚡ Weekly Recap: Fortinet Exploited, China's AI Hacks, PhaaS Empire Falls & More
60
45
60
60
60
60
60
GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE
A CVSS 9.8 SQL injection zero-day in GeoServer's PostGIS datastore enables RCE and drew active exploitation; fixes shipped in versions 3.0.1, 2.28.5, 2.27.6.
A SQL injection flaw in GeoServer's jsonArrayContains function within the GeoTools PostGIS datastore (GHSA-mqjf-5f49-2fjh, CVSS 9.8) was disclosed August 12, 2026, and saw hundreds of exploitation attempts within hours per watchTowr. An attacker-controlled value is interpolated into a PostgreSQL jsonb_path_exists() expression without escaping; with superuser or pg_execute_server_program privileges it escalates to OS command execution via WFS 1.0. GeoServer released versions 3.0.1, 2.28.5, and 2.27.6, and the flaw is a regression of CVE-2023-25158. GeoServer has a history of mass exploitation, including CVE-2024-36401 used for botnets and proxies.
80
Critical Flaws in Cacti Framework Could Let Attackers Execute Malicious Code
60
XE Hacker Group Exploits VeraCore Zero
60
Over 60 Software Vendors Issue Security Fixes Across OS, Cloud, and Network Platforms
60
Network Attack Trends: Internet of Threats (November 2020
60
60
45
September 2025 CVE Landscape
60
60
U.S. CISA adds Adobe, Fortinet, Microsoft Windows, Microsoft Exchange Server flaws to its Known Exploited Vulnerabilities catalog
60
U.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
60
Network Security Trends: November 2021 to January 2022
60
Network Attack Trends: February
60