FortiBleed exposed how a Russian-speaking threat group quietly compromised around 75,000 Fortinet firewalls worldwide by abusing old credential leaks, infostealer logs, automated login testing, offline cracking, and compromised FortiGate devices. The campaign turned exposed firewalls into credential-harvesting nodes, creating a self-feeding access pipeline for future attacks and possible ransomware operations.
Internet accessible management interface of firewall. There sure is a bleed to this. Eyes of every security engineer bleeding at the absolute stupidity of such a decision.
What are You Working on Wednesday
4h 10m ago by infosec.pub/u/shellsharks in cybersecurity@infosec.pubHidden KYC: How Banks Silently Track Your WiFi Network
2h 43m ago by lemmy.world/u/monniele in cybersecurity@infosec.pub from telegra.phBSSID Collection: How Banks Map Your Home WiFi
2h 43m ago by lemmy.world/u/monniele in cybersecurity@infosec.pub from telegra.phFrom IP Geolocation to WiFi Positioning: The KYC Evolution
2h 43m ago by lemmy.world/u/monniele in cybersecurity@infosec.pub from telegra.phProof of Presence: Why Your WiFi Router Is Now a KYC Witness
2h 44m ago by lemmy.world/u/monniele in cybersecurity@infosec.pub from telegra.phGeo-KYC: Qué Hace Tu Banco En Secreto Con Tu WiFi
2h 44m ago by lemmy.world/u/monniele in cybersecurity@infosec.pub from telegra.phShadow KYC Vendors: The $4B Industry You Never See
2h 45m ago by lemmy.world/u/monniele in cybersecurity@infosec.pub from telegra.phWhile Everyone Was Watching IP & KYC: The Invisible Revolution of Digital Trust
2h 45m ago by lemmy.world/u/monniele in cybersecurity@infosec.pub from telegra.ph
Stop using JWTs as a session mechanism
21h 7m ago by mander.xyz/u/cm0002 in cybersecurity@infosec.pub from gist.github.com
A backdoor in a LinkedIn job offer
1d 8h ago by mander.xyz/u/cm0002 in cybersecurity@infosec.pub from roman.pt
New wave of malware in the aur
3d 6h ago by europe.pub/u/cm0002 in cybersecurity@infosec.pub from lists.archlinux.org
Technical breakdown: stored XSS, session abuse, CSP failures behind the Massive Instructure Canvas Data Breach
2d 3h ago by lemmy.world/u/WPSteam in cybersecurity@infosec.pub from thecybersecguru.com
CVE-2026-53435: Jenkins Deserialization Chain, PoC & Patch
2d 9h ago by lemmy.world/u/UnLocoPoco in cybersecurity@infosec.pub from thecybersecguru.comMentorship Monday - Discussions for career and learning!
2d 8h ago by infosec.pub/u/shellsharks in cybersecurity@infosec.pub
Atomic Arch: 900+ AUR Packages Backdoored with eBPF RootkitCopy
4d 9h ago by lemmy.world/u/WPSteam in cybersecurity@infosec.pub from thecybersecguru.com
CVE-2026-20253: Splunk Pre-Auth RCE via PostgreSQL Sidecar
3d 15h ago by lemmy.world/u/WPSteam in cybersecurity@infosec.pub from thecybersecguru.com
AMD changes rules, denies researcher $10,000 bounty after taking 124 days to patch security flaw
4d 15h ago by lemmy.ca/u/floofloof in cybersecurity@infosec.pub from www.techspot.com
Arch Linux's AUR Sees More Than 400 Packages Compromised With Malware
4d 6h ago by europe.pub/u/cm0002 in cybersecurity@infosec.pub from www.phoronix.com
Russian satellites linked to mysterious GPS disruptions across several countries
6d 4h ago by literature.cafe/u/cm0002 in cybersecurity@infosec.pub from techxplore.comMarcus Ranum: The Six Dumbest Ideas in Computer Security [2005] (old, but still applies)
4d 6h ago by europe.pub/u/cm0002 in cybersecurity@infosec.pub from www.ranum.com
ShinyHunters linked to exploitation of critical flaw in Oracle PeopleSoft
4d 3h ago by lemmy.world/u/monica_b1998 in cybersecurity@infosec.pub from www.cybersecuritydive.com
21 Zero-Days in FFmpeg
4d 6h ago by europe.pub/u/cm0002 in cybersecurity@infosec.pub from depthfirst.com
University of Nottingham Data Breach: 454,600 Students affected by the ShinyHunters Breach
6d 6h ago by lemmy.world/u/WPSteam in cybersecurity@infosec.pub from thecybersecguru.comOff-Topic Friday
5d 7h ago by infosec.pub/u/shellsharks in cybersecurity@infosec.pub
Russian satellites linked to mysterious GPS disruptions across several countries
6d 5h ago by lemmy.world/u/Innerworld in cybersecurity@infosec.pub from techxplore.com
Researchers have just unveiled a technique called FROST that lets a website work out which other websites and apps you have open, without you clicking a single thing
6d 19h ago by lemmy.world/u/Innerworld in cybersecurity@infosec.pub from protonprivacy.substack.com
GreatXML: GreatXML bitlocker bypass vulnerability
6d 14h ago by infosec.pub/u/digicat in cybersecurity@infosec.pub from github.comVulnerability-Lookup 5.1.0
6d 8h ago by literature.cafe/u/cm0002 in cybersecurity@infosec.pub from www.vulnerability-lookup.orgWhat are You Working on Wednesday
7d 6h ago by infosec.pub/u/shellsharks in cybersecurity@infosec.pub🔥 New in Vulnerability-Lookup: KEV Catalog Coverage!
5d 14h ago by literature.cafe/u/cm0002 in cybersecurity@infosec.pub
ServiceNow API Breach: What Customers Need to Know - KB3067321
8d 2h ago by lemmy.world/u/WPSteam in cybersecurity@infosec.pub from thecybersecguru.com
Miasma Worm Goes Open Source: What's Actually Inside It. Complete Analysis
8d 4h ago by lemmy.world/u/WPSteam in cybersecurity@infosec.pub from thecybersecguru.com
Microsoft's open source tools were hacked to steal passwords of AI developers
8d 6h ago by literature.cafe/u/cm0002 in cybersecurity@infosec.pub from techcrunch.com
CVE-2026-23111: One Bad Character Gives Attackers Linux Root
8d 17h ago by lemmy.world/u/WPSteam in cybersecurity@infosec.pub from thecybersecguru.comMentorship Monday - Discussions for career and learning!
9d 8h ago by infosec.pub/u/shellsharks in cybersecurity@infosec.pub
Yoti Reported GrapheneOS User to Authorities - Sony PlayStation Age Verification. In-depth Technical Breakdown
10d 4h ago by lemmy.zip/u/LandoLuma in cybersecurity@infosec.pub from thecybersecguru.com
Meta confirms thousands of Instagram accounts were hacked by abusing its AI chatbot
11d 1h ago by suppo.fi/u/cm0002 in cybersecurity@infosec.pub from this.weekinsecurity.com
Magecart skimmer turns Stripe into a malware command server
11d 6h ago by suppo.fi/u/cm0002 in cybersecurity@infosec.pub from sansec.io
How a USB-connected speaker can infect a PC without ever being touched
11d 22h ago by discuss.tchncs.de/u/schnurrito in cybersecurity@infosec.pub from arstechnica.comNew IronWorm malware hits 36 packages in npm supply-chain attack
12d 7h ago by suppo.fi/u/cm0002 in cybersecurity@infosec.pub from www.bleepingcomputer.comAmmaraskar: 1-Click GitHub Token Stealing via a VSCode Bug
12d 7h ago by suppo.fi/u/cm0002 in cybersecurity@infosec.pub from blog.ammaraskar.comAmmaraskar: 1-Click GitHub Token Stealing via a VSCode Bug
12d 13h ago by feditown.com/u/exu in cybersecurity@infosec.pub from blog.ammaraskar.com
New HTTP/2 Bomb DoS Attack Hits Nginx, Apache, IIS, Envoy, and Pingora
12d 19h ago by lemy.lol/u/cm0002 in cybersecurity@infosec.pub from linuxiac.com"Patches are available to sophisticated attackers as soon as Google discloses them to OEMs. A partial embargo for months makes no sense."
14d 8h ago by libretechni.ca/u/cm0002 in cybersecurity@infosec.pub from grapheneos.socialWhat are You Working on Wednesday
14d 9h ago by infosec.pub/u/shellsharks in cybersecurity@infosec.pub1-Click GitHub Token Stealing via a VSCode Bug
14d 16h ago by libretechni.ca/u/cm0002 in cybersecurity@infosec.pub from blog.ammaraskar.com
Red Hat npm Packages Compromised in Supply Chain Attack
15d 4h ago by lemy.lol/u/cm0002 in cybersecurity@infosec.pub from linuxiac.comNetherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks – Krebs on Security
15d 5h ago by programming.dev/u/Kissaki in cybersecurity@infosec.pub from krebsonsecurity.comAlleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada – Krebs on Security
15d 5h ago by programming.dev/u/Kissaki in cybersecurity@infosec.pub from krebsonsecurity.com