FortiBleed Exposes 86,644 Fortinet Logins

CISA is urging Fortinet customers to lock down their FortiGate firewalls and VPNs after a credential-harvesting campaign, dubbed FortiBleed, compiled a working database of more than 86,644 logins across 194 countries, according to SecurityWeek. That's roughly half of all internet-facing Fortinet devices worldwide.

The campaign, believed to involve Russian-speaking attackers, didn't need anything fancy. Per BleepingComputer, generic admin accounts made up 35% of stolen credentials and built-in factory accounts made up another 28%. Translation: more than six in ten compromised logins existed because someone never bothered to change the default password or rotate it after setup. The rest came from accounts created by individual organizations, meaning attackers got in some other way too.

Security researcher Kevin Beaumont confirmed with affected organizations that the stolen logins still work and are fairly recent. With valid credentials to a firewall or VPN, an attacker effectively has the keys to the building's front gate.

What to do: If your organization runs a FortiGate device, assume your credentials are in that database. Rotate every password tied to it today, disable any default or factory accounts you haven't touched, and check your login logs for sign-ins from unfamiliar locations.

Microsoft researchers detailed an exploit chain called AutoJack that turns an AI browsing agent (software that surfs the web and takes actions on your behalf) into a delivery mechanism for an attacker to run their own code on your machine, according to The Hacker News.

Here's the chain: get the agent to open a malicious web page, and that page's code can reach a privileged local service running on the same computer and launch a process. No password prompt, no extra click needed once the page loads. Getting the agent there just takes a planted link or even a hidden instruction buried in a webpage that the agent reads and follows without you seeing it.

The flaw lives specifically in AutoGen Studio, an open-source interface for building AI agents, in its default installed version.

What to do: If you or your team experiment with AI browsing agents, avoid pointing them at unfamiliar or untrusted websites, and check whether your setup has been updated past the flawed version before letting an agent browse unsupervised.

What NGINX is: NGINX is open-source web server software that sits in front of websites and applications to handle incoming traffic, widely used as a reverse proxy and load balancer across the internet.

What it is: A use-after-free flaw (a bug where software keeps using a piece of memory after telling the system it's done with it, which an attacker can exploit to corrupt that memory) in the module NGINX uses to handle HTTP/3, the newer version of the protocol that powers web traffic.

Who's at risk: Any organization running NGINX Open Source configured to use the HTTP/3 QUIC module. No login or prior access is required to attempt exploitation.

CVSS: 9.2 (Critical — patch today.)

Root cause: The HTTP/3 module mismanages memory tied to QPACK encoder streams (a compression mechanism HTTP/3 uses to shrink header data). When a connection is reopened in a specific crafted sequence, the module can end up referencing memory that has already been freed, giving an attacker a foothold to corrupt it.

Attack vector: A remote, unauthenticated attacker opens a specially crafted HTTP/3 session and reopens a QPACK encoder stream in a way that triggers the use-after-free. On systems where Address Space Layout Randomization (ASLR, a defense that randomizes where code sits in memory) is disabled, or where an attacker can bypass it, this can be escalated into full remote code execution.

Detection strategies: Watch for unusual or malformed HTTP/3 connection patterns in NGINX access logs, repeated QUIC stream resets from the same client, and unexpected NGINX worker process crashes or restarts.

Recommended actions:

1. Apply F5's patch for NGINX Open Source immediately.
2. If you cannot patch right away, disable the HTTP/3 QUIC module as an interim mitigation.
3. Confirm ASLR is enabled on affected servers as a partial defense-in-depth measure while patching is underway.

A researcher at the SANS Internet Storm Center spotted a phishing email targeting a major Belgian bank that used a sneaky trick: disguising the malicious link as what looks like an IPv6 address (the newer, longer format for internet addresses) to slip past basic security filters, according to SANS ISC.

The trick works because the link format [::ffff:5511:74be] looks like gibberish to a human but actually encodes a normal web address in hex code. Security tools that scan for suspicious domain names often miss it entirely because there's no domain name to catch, just numbers in brackets.

What to do: You don't need to decode anything yourself. Treat any link in an email that looks like a string of numbers and colons in brackets as an instant red flag, especially in messages claiming to be from your bank. Don't click it. Go to your bank's app or type the website address in yourself instead.

No major compliance updates today.