Today’s threats are probing every weak link. |
Today brings a “low-severity” appliance bug with pivot potential, a one-click Copilot trick that vanishes into session noise, a DHS data dump, a game control hijack mid-match, and a digital ID plan that hit the brakes.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Fortinet Fixes FortiSandbox Internal Proxy Bug |
Fortinet recently patched a FortiSandbox SSRF vulnerability that could let authenticated attackers proxy internal requests via crafted HTTP traffic. Although rated low severity, the flaw (CVE-2025-67685) matters because FortiSandbox often sits deep in segmented networks, making it a potential pivot if admin access is compromised. |
For security teams, it’s a reminder that even low-severity flaws can carry real risk when they affect trusted infrastructure inside the network. Patch FortiSandbox to a supported release, lock down GUI/admin access, and enforce strict egress and monitoring controls. |
Thousands of ICE Agents Exposed in Reported DHS Leak |
A reported DHS leak exposed personal and work details for about 4,500 ICE and Border Patrol employees online, escalating safety concerns after a Minneapolis shooting. The leak reportedly includes names, work emails, phone numbers, roles, and résumé-style details.
DHS warned the leak could potentially increase the risk of harassment and targeted attacks against agents and their families. Run targeted monitoring for impersonation attempts and enforce MFA on all DHS-linked accounts, especially email and help desk workflows. |
Copilot Link Trick Enables Silent Data Exfiltration |
Varonis researchers disclosed Reprompt, a one-click technique that could quietly exfiltrate sensitive data from Microsoft Copilot via a legitimate link.
Reprompt runs inside an active session, leaving little sign of prompts or permission changes, and Varonis said it could bypass enterprise controls to exfiltrate data without detection from a single click. Microsoft has already patched the issue and there are no indications of exploitation in the wild.
Treat Copilot deep links as untrusted, enforce MFA and strict session/device controls, limit data access with DLP and least privilege, and monitor for unusual AI-driven activity. |
|
|
If a big employee data dump hits tomorrow, what’s your first move? |
|
|
Yesterday's Pulse Check Results |
What’s your biggest privilege escalation gap right now? |
|
|
Security Tools You Can Use |
|
|
Apex Legends Hack Hijacks Player Controls Mid-Match |
Apex Legends players recently reported mid-match incidents where their characters moved, fired, and used abilities without input — suggesting real-time remote control hijacking. Respawn confirmed the security incident that allowed an attacker to remotely control player inputs. |
The company later said the issue was addressed and thanked players for flagging the abnormal behavior, noting there was no evidence of remote code execution.
Update and restart Apex, verify game files, enable MFA, and avoid ranked play if abnormal input behavior returns. |
Security Fears Sink UK’s Mandatory Digital ID Plan |
The UK government has backed away from plans to make digital ID mandatory for right-to-work checks after public opposition and security concerns piled up.
The BBC reports that digital right-to-work checks will still expand by 2029 using tools like biometric passports, but enrollment in the new digital ID program will be optional. Critics warned that national ID platforms create high-value targets, citing Gov.uk One Login security concerns and potential privileged access risks.
If your org relies on UK right-to-work verification, review your digital check workflow now and build a fallback process for offline or non-enrolled users. |
|
|
How Secure Are Your Gaming Accounts? |
Gaming accounts are prime targets, and threats like credential stuffing, account takeovers, malicious mods, and session hijacking can quickly ruin a match. A few small security habits can prevent stolen skins, drained wallets, or worse. |
How to lock down your gaming accounts: |
-
Use strong account protection by setting unique passwords with a manager, enabling MFA, and securing email-based recovery options.
- Keep your gaming setup clean by updating clients, verifying game files, and limiting unnecessary overlays or background apps.
-
Avoid risky downloads like cheats, unofficial mods, and “free skins” tools that often deliver malware or steal credentials.
|
Strong gaming security comes down to eliminating the easy wins attackers rely on — reused passwords, weak account recovery, and risky downloads. |
|
|
| Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
