Search
Find merged stories by title or summary.
QuickFox VPN installers were trojanized with malware for a year
QuickFox VPN installed a persistent backdoor on selected Windows computers, focusing on systems belonging to developers, administrators, translators, and cryptocurrency users. The attack was uncovered by Fortinet’s FortiGuard Incident Response Team while investigating modified QuickFox installers and related command-and-control infrastructure. Researchers traced the compromise to two malicious lines added to an HTML file loaded when … The post QuickFox VPN installers were trojanized with malware for a year appear
CVE-2025-68686 - Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
FortiBleed Exploited: Tracking Initial Access Broker Dark_Alpha on Darkforums
July 15, 2026 Background: What Is FortiBleed? In mid-June 2026, security researchers identified a large-scale credential compromise campaign targeting Fortinet FortiGate firewalls, quickly dubbed FortiBleed. Unlike a traditional zero-day, FortiBleed is not tied to a single new vulnerability. Instead, threat actors systematically extracted configuration files from internet-facing FortiGate devices and cracked the stored password hashes — exploiting the fact that many organizations running older FortiOS versions continued to store administrator credentials as legacy SHA-256 hashes rather than the more secure PBKDF2 format Fortinet introduced in FortiOS 7. 2. 11, 7. 4. 8, and 7. 6. 1. Devices upgraded from earlier versions retain SHA-256 hashes until each administrator logs in post-upgrade, leaving a window of exposure that the campaign actively exploited at scale.
Smashing Security podcast #474: Polymarket can predict the future. So how did it miss this hack?
Polymarket has built an entire business on predicting the future. So how did it manage to spectacularly fail to predict its own hack? Plus, the Google engineer with a million-dollar secret, and the curious case of the airport hairdryer. Meanwhile, "FortiBleed" sees 75,000 Fortinet firewalls thrown wide open - and the real damage is going to roll on for years. All this and more in episode 474 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Quentyn T
Issue 288: State of API Security 2026, Agentic AI, Authentication Bypasses, and the Race to Patch APIs
This week, we look at how long-standing API security failures are being amplified by automation, AI, and increasingly aggressive exploitation timelines. From agentic AI vulnerabilities in ServiceNow to authentication bypasses actively exploited in SmarterMail and Fortinet infrastructure, this issue highlights how broken authentication and authorization continue to dominate real-world incidents. We also dive into the 42Crunch State of API Security 2026 report, which analyzes 200 production vulnerabilities to show why these patterns persist — and why, as AI agents become first-class API consumers, insecure APIs are far less likely to remain unnoticed or unexploited.
Issue 241: Two critical flaws in FortiSIEM product, making public APIs private, API security strategy
This week, we have news of two critical vulnerabilities in the Fortinet FortiSIEM product. We also have articles on making public APIs private and building an API security strategy. Dana Epp offers his thoughts on the difference between endpoints and routes, and we have two developer-focused tutorials, one on securing gRPC and the other on Django API security best practices. Vulnerability: Two critical flaws in Fortinet FortiSIEM product This week’s main news is the further coverage of the two critical issues reported in the Fortinet FortiSIEM product courtesy of The Register. The two vulnerabilities (tracked as CVE-2024-23108 and CVE-2024-23109 ) were rated as critical with a CVSS score of 10, indicating that the exploits can be carried out remotely by unauthenticated attackers and are low in complexity.