#firewalls

Attackers are exploiting SSO access on FortiGate devices to export configurations, add admin accounts, and open persistent VPN access within seconds.

Source: Arctic Wolf

Over the course of this year I have explained to colleagues and clients who’s roles are not in Cybersecurity what certain phrases or abbreviations mean. After I while I started to drop them into a word document so I could reuse them. Then I decided to make this post so I can easily share the explanations. There are bound to be things missing, please drop a comment if I have missed something and…

A high-severity flaw lets unauthenticated attackers remotely knock Palo Alto firewalls offline by abusing GlobalProtect gateway and portal handling.

Source: The Hacker News | Palo Alto Networks PSIRT

SonicWall confirmed that a brute-force attack accessed backup firewall files in MySonicWall accounts, potentially exposing encrypted credentials and configuration data to attackers.

Source: BleepingComputer | SonicWall

When a data breach occurs, incident response teams typically focus on known entry points, such as compromised credentials, unpatched software, or phishing links. However, a silent risk often hides in plain sight: unauthorized artificial intelligence tools. If your organization lacks visibility into which generative AI platforms employees are using with company data, your incident response…

A sophisticated, long-running cyber espionage operation has been identified targeting government, diplomatic, and public sector entities across Southeast Asia. The campaign relies on a previously undocumented backdoor known as GoSerpent malware to maintain persistent access to sensitive systems, allowing threat actors to monitor internal networks, harvest credentials, and exfiltrate confidential…

A severe security vulnerability, colloquially identified as wp2shell, has emerged as a significant threat to the WordPress ecosystem. Reported by The Hacker News, this flaw combines two distinct vulnerabilities in the WordPress core that, when chained together, allow unauthenticated remote attackers to execute arbitrary code on a server. Because the vulnerability resides within the core software,…