⚡ Weekly Recap: Fortinet Exploit, Chrome 0-Day, BadIIS Malware, Record DDoS, SaaS Breach & More

Summary: Fortinet warned that a new FortiWeb flaw, CVE-2025-58034 (CVSS 6.7), has been exploited in the wild and was addressed in version 8.0.2, days after the company confirmed it silently patched a critical FortiWeb vulnerability, CVE-2025-64446 (CVSS 9.1), in the same release. Orange Cyberdefense said it observed several exploitation campaigns chaining the two flaws to achieve authentication bypass and command injection, and Fortinet's handling of the disclosures drew heavy criticism.
Why it matters: A medium-severity 6.7 flaw is being chained with a 9.1 to bypass authentication and run commands on FortiWeb systems, and the patch for both arrived silently before either was disclosed - so any FortiWeb instance not yet on 8.0.2 has had no warning window at all.

Read the original at The Hacker News ↗