Article Details

⚡ Weekly Recap: Firewall Flaws, AI-Built Malware, Browser Traps, Critical CVEs & More. Security failures rarely arrive loudly. They slip in through trusted tools, half-fixed problems, and habits people stop questioning. This week's recap shows that pattern clearly. Attackers are moving faster than defenses, mixing old tricks with new paths. "Patched" no longer means safe, and every day, software keeps becoming the entry point. What follows is a set of small but telling signals. Short updates that, together, show how quickly risk is shifting and why details can't be ignored. ⚡ Threat of the Week Improperly Patched Flaw Exploited Again in Fortinet Firewalls — Fortinet confirmed that it's working to completely plug a FortiCloud SSO authentication bypass vulnerability following reports of fresh exploitation activity on fully-patched firewalls. "We have identified a number of cases where the exploit was to a device that had been fully upgraded to the latest release at the time of the attack, which suggested a new attack path," the company said. The activity has been found to exploit an incomplete patch for CVE-2025-59718 and CVE-2025-59719, which could allow unauthenticated bypass of SSO login authentication via crafted SAML messages if the FortiCloud SSO feature is enabled on affected devices. In the absence of a fix, users are advised to restrict administrative access of edge network devices and turn off FortiCloud SSO logins by disabling the "admin-forticloud-sso-login" setting. When Your CEO Calls, Will You Know It's Real? Keeper Security is officially FedRAMP High Authorized, meeting the highest standards for federal cybersecurity. Powered by zero-trust architecture and zero-knowledge encryption, KeeperPAM is built to protect mission-critical data and infrastructure. Book a demo to see KeeperPAM in action. 🔔 Top News ‎️‍🔥 Trending CVEs Hackers act fast. They can use new bugs within hours. One missed update can cause a big breach. Here are this week's most serious security flaws. Check them, fix what matters first, and stay protected. This week's list includes — CVE-2026-24061 (GNU InetUtils telnetd), CVE-2026-23760 (SmarterMail), CVE-2026-20045 (Cisco Unified Communications and Webex Calling Dedicated Instance), CVE-2026-22218, CVE-2026-22219 (Chainlit), CVE-2026-1245 (binary-parser), CVE-2025-68143, CVE-2025-68144, CVE-2025-68145 (Anthropic mcp-server-git), CVE-2026-22844 (Zoom), CVE-2025-13927, CVE-2025-13928, CVE-2026-0723 (GitLab CE/EE), CVE-2026-0629 (TP-Link), CVE-2025-49758 (Microsoft SQL Server), CVE-2025-47179 (Microsoft Configuration Manager), CVE-2025-60021 (Apache bRPC), CVE-2025-61937, CVE-2025-64691, CVE-2025-61943, CVE-2025-65118 (AVEVA Process Optimization), CVE-2025-14369 (dr_flac), CVE-2026-0828 (Safetica ProcessMonitorDriver.sys), CVE-2026-0685 (Genshi template engine), CVE-2025-68675 (Apache Airflow), CVE-2025-14533 (Advanced Custom Fields: Extended plugin), CVE-2025-13151 (GNU libtasn1), CVE-2026-0622 (Open5GS WebUI component), CVE-2025-65586 (libheif), CVE-2025-33206 (NVIDIA NSIGHT Graphics for Linux), CVE-2026-1220 (Google Chrome), CVE-2025-66516, CVE-2026-21962, CVE-2025-66516, CVE-2025-54988, CVE-2025-4949, CVE-2025-54874, CVE-2025-49796, CVE-2025-23048 (Oracle), CVE-2026-23744 (@mcpjam/inspector), CVE-2025-13878 (ISC BIND 9), CVE-2025-12383 (Atlassian Bamboo Data Center and Server), CVE-2025-66516 (Atlassian Confluence Data Center and Server), CVE-2026-22755 (Vivotek legacy camera models), CVE-2026-22794 (AppSmith), CVE-2025-67968 (RealHomes CRM plugin), CVE-2026-23594 (HPE Alletra 6000, Alletra 5000 and Nimble Storage), CVE-2026-0920 (LA-Studio Element Kit for Elementor plugin), and CVE-2026-22200 (osTicket). 📰 Around the Cyber World 🎥 Cybersecurity Webinars 🔧 Cybersecurity Tools Disclaimer: These tools are for learning and research only and have not been fully security-tested. Review the code carefully, use it only in safe environments, and follow all applicable rules and laws. Conclusion This edition makes one thing clear: risk now sits in everyday tools and normal choices. Small gaps are all it takes. None of these stories stands alone. They point to a wider pattern where speed matters and delays cost real damage. Treat this list as a snapshot. The details will change. The pressure will not.