Vulnerabilities

Friday’s brief: FortiMail due Saturday, then BoKS, vm2, Satellite

Friday’s brief: FortiMail due Saturday, then BoKS, vm2, Satellite

FortiMail is under active exploitation with a federal clock ending Saturday. Also: Fortra BoKS overflow, a vm2 sandbox escape, and…
Low-priv template editors can root your Satellite host

Low-priv template editors can root your Satellite host

Foreman safemode bypass lets authenticated low-privilege users run commands on the host. Apply RHSA-2026:74503 and shrink template roles....
If you still sandbox with vm2 on Node 24, bump to 3.11.7 today

If you still sandbox with vm2 on Node 24, bump to 3.11.7 today

A critical sandbox escape via a double-prefixed node:test import has a public PoC. Upgrade vm2 and plan stronger isolation....
Fortra just told BoKS owners to patch the autoregistration service

Fortra just told BoKS owners to patch the autoregistration service

A critical remote stack overflow in boks_autoregisterd. Move to 8.1.0.24 or 9.0.0.7 and lock down port 6507....
Your FortiMail management plane has a Saturday deadline

Your FortiMail management plane has a Saturday deadline

Fortinet confirmed active exploitation of an unauthenticated management-interface file-write bug. CISA's federal due date is Saturday, October 4. Workaround, hunt,…
Thursday’s brief: SD-WAN admin bypass due Saturday, then TeamViewer, OpenSSL, MikroTik

Thursday’s brief: SD-WAN admin bypass due Saturday, then TeamViewer, OpenSSL, MikroTik

Cisco Catalyst SD-WAN Manager is under active exploitation with a federal clock ending Saturday. Also: TeamViewer 15.82, an OpenSSL DTLS…
CISA flagged a MikroTik web-management bug that can root the router with one request

CISA flagged a MikroTik web-management bug that can root the router with one request

Pre-auth integer underflow in RouterOS HTTP body handling. Keep management off the internet and move past 7.23 / onto 7.24....
OpenSSL’s DTLS fix matters if you ship calls, WebRTC, or UDP TLS

OpenSSL’s DTLS fix matters if you ship calls, WebRTC, or UDP TLS

A high-severity handshake resend bug can leak heap memory or crash the process. Public fixes are out; OpenSSL 3.0 needs…
TeamViewer just told every desktop owner to update before the weekend

TeamViewer just told every desktop owner to update before the weekend

Five high-severity client and host flaws, including a session access-control bypass that can lead to remote code execution. Move to…
Your SD-WAN Manager has a Saturday deadline — and attackers already have admin

Your SD-WAN Manager has a Saturday deadline — and attackers already have admin

Cisco Catalyst SD-WAN Manager auth bypass is in the wild. CISA's federal due date is Saturday, October 3. Patch, then…
Wednesday’s brief: Azure wiped in minutes, then Elementor, Spectre, and a NetScaler hunt

Wednesday’s brief: Azure wiped in minutes, then Elementor, Spectre, and a NetScaler hunt

Storm-3168 used stolen Azure service principals to delete storage in seven minutes. Also: Elementor CSRF, a new Spectre Linux leak,…
Federal NetScaler clock ends today. Mandiant just published the web shells to hunt

Federal NetScaler clock ends today. Mandiant just published the web shells to hunt

CISA's due date is Wednesday. Mandiant documented WHIPSHOT and SLAPSHOT on appliances hit before the patch. Patch, then hunt....
A new Spectre trick can pull a Linux root password hash in minutes

A new Spectre trick can pull a Linux root password hash in minutes

Branch Target Reuse works on modern CPUs. Kernel fixes are in; patch Linux hosts that share space with untrusted code....