⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More

Summary: A campaign codenamed FortiBleed has targeted Fortinet FortiGate firewall and SSL VPN gateway devices worldwide since at least February 2026, with SOCRadar identifying over 80,000 devices whose working usernames and passwords were tested by suspected Russian-speaking threat actors using automated tools. Fortinet said the actors likely reused credentials from earlier incidents including CVE-2026-24858, CVE-2025-59718 and CVE-2025-59719, and also ran brute-force attacks against devices with weak passwords and no MFA.
Bottom line: More than 80,000 internet-accessible FortiGate devices had valid credentials tested around the clock, and CISA urged Fortinet customers to act on the ongoing malicious activity - the entry point was reused passwords and missing MFA, not a novel exploit.

Read the original at The Hacker News ↗

Topics: Malware
Mentions: CVE-2025-15445 CVE-2025-59718 CVE-2025-59719 CVE-2025-69129 CVE-2026-12326 CVE-2026-12327 CVE-2026-12328 CVE-2026-12437 CVE-2026-12443 CVE-2026-20181 CVE-2026-20262 CVE-2026-20266 CVE-2026-2418 CVE-2026-24190 CVE-2026-2446 CVE-2026-24858 CVE-2026-27400 CVE-2026-27429 CVE-2026-3326 CVE-2026-38329 CVE-2026-39449 CVE-2026-39849 CVE-2026-39949 CVE-2026-4020 CVE-2026-40217 CVE-2026-41176 CVE-2026-41179 CVE-2026-41293 CVE-2026-42579 CVE-2026-42584 CVE-2026-43512 CVE-2026-43515 CVE-2026-44693 CVE-2026-47101 CVE-2026-47102 CVE-2026-48519 CVE-2026-48558 CVE-2026-48746 CVE-2026-48907 CVE-2026-49468 CVE-2026-49980 CVE-2026-52697 CVE-2026-52700 CVE-2026-52703 CVE-2026-52706 CVE-2026-52707 CVE-2026-54157 CVE-2026-54420 CVE-2026-6379 CVE-2026-6933 CVE-2026-8049 CVE-2026-8050 CVE-2026-8443 CVE-2026-8444 CVE-2026-8713 CVE-2026-9848
Related: Forti Gate Devices Exploited to Breach Networks and Steal Service Account Credentials Cyber Risks ·
LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers Cyber Risks ·
Adios 2025, you won’t be missed Cyber Risks ·