Citrix disclosed a critical NetScaler authentication bypass on 19 August, the third serious problem in the same pre-authentication SAML surface since the end of June. Workarounds listed: None.
5 min read
An unauthenticated API bypass in FortiClient EMS gave attackers the management server, which they used to push an infostealer to managed endpoints disguised as a Fortinet patch. The console was reachable before it authenticated anything.
5 min read
A PAN-OS zero-day gave unauthenticated root on internet-exposed firewalls with no patch available. Palo Alto's advice was to restrict the portal to trusted networks. That advice is sound, and it is the part almost nobody can actually do.
4 min read
Broadcom disclosed a critical vCenter flaw on 29 July and stated plainly that no workaround existed. Five days later an attacker had root on internet-facing appliances across 47 countries.
5 min read
A federal agency patched two Cisco ASA vulnerabilities and stayed breached for six months, because the attackers had already installed a backdoor that did not need the vulnerabilities any more. Patching closed the door after the tenant had a key.
4 min read
An attacker with a low-to-medium skill set used AI to breach more than 600 FortiGate firewalls across 55 countries. There was no CVE. They scanned for exposed management interfaces and guessed passwords.
3 min read
Two SharePoint zero-days gave unauthenticated remote code execution to anyone who could reach the server. Over 400 organizations were compromised, including a US nuclear weapons agency. The cloud tenants running the same product were fine.
3 min read
Two Ivanti Connect Secure zero-days let state actors past an authentication bypass into a research network, then session hijacking carried them past MFA. The appliance was reachable by everyone, which is the only reason the exploit chain had a target.
3 min read
Stolen credentials on an internet-facing portal with no MFA cost $872 million and disrupted prescriptions nationwide. The credential theft was not the interesting failure. The portal answering strangers was.
3 min read