The cracks are showing in places many teams trust most. |
Today’s stories span perimeter controls, server runtimes, AI usage, and supply chains — where small missteps can quietly become big problems.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Fortinet SSO Flaw Under Active Exploitation |
Fortinet confirmed active exploitation of a FortiCloud SSO authentication bypass that grants attackers full administrative access to affected devices. The vulnerability affects FortiOS, FortiManager, FortiAnalyzer, and FortiProxy, enabling cross-tenant logins when FortiCloud SSO is enabled and breaking account isolation. |
Fortinet has already released patches for the vulnerability.
Patch affected Fortinet systems immediately, disable unnecessary FortiCloud SSO, restrict management access, audit admin accounts, and monitor logs closely to detect and contain potential compromise. |
React Server Flaws Trigger DoS Risk |
Security researchers have disclosed multiple vulnerabilities in React Server Components that allow attackers to remotely trigger denial-of-service conditions on affected servers.
Because no authentication is required, specially crafted HTTP requests can trigger crashes, memory exhaustion, or sustained CPU spikes in both internet-facing and internal services. Patches have been released for the flaws.
Patch affected RSC packages immediately and audit exposed Server Function endpoints, adding rate limiting and resource controls to prevent unauthenticated DoS attempts. |
Nike Probes World Leaks Data Extortion Claim |
Nike is investigating World Leaks’ claims of large-scale internal data theft. If confirmed, the alleged 1.4-terabyte data theft shows how extortion groups now prioritize sensitive operational and supply chain data to maximize leverage without the disruption of traditional ransomware attacks. The investigation is ongoing.
Proactively monitor outbound data flows from sensitive systems, enforce least-privilege access with strong MFA, and regularly test incident response plans tailored to data extortion scenarios. |
|
|
Data stolen, but no ransomware — what’s your first move? |
|
|
Yesterday's Pulse Check Results |
When email filters go blind, what’s your first move? |
|
|
Security Tools You Can Use |
|
|
CISA Investigates Alleged ChatGPT Data Upload |
Politico reports that CISA’s acting head allegedly uploaded sensitive government documents to public ChatGPT, triggering internal alerts and a DHS review. If true, this incident shows how employees can expose sensitive data to public AI tools. |
The incident also highlights the growing tension between rapid AI adoption and strict data-handling requirements in national security environments.
Review and enforce clear policies restricting public AI tool use, and deploy monitoring controls to detect and block sensitive data uploads in real time. |
Python Library Bug Enables Startup Code Execution |
Researchers disclosed a Python PLY vulnerability that enables arbitrary code execution during application startup.
The risk is higher because PLY is widely used and the flaw triggers during startup, before most security controls are active, increasing the chance of full system compromise.
Exploitation does not require parsing malicious input and instead abuses unsafe pickle deserialization via an undocumented picklefile parameter in PLY 3.11, with a proof-of-concept already available.
Audit PLY usage for unsafe pickle deserialization, lock down parser cache paths, harden CI/CD pipelines, and isolate startup-time parsing while regularly testing incident response for early-execution exploits. |
|
|
Are You Protecting Your Software Supply Chain? |
Software supply chain attacks are increasing as attackers target trusted code, dependencies, and build systems rather than end users. A single compromised library or pipeline can quietly impact thousands of organizations, making visibility, verification, and control across the development lifecycle more critical than ever. |
Secure your software supply chain: |
- Maintain a complete dependency inventory using SBOMs and automated scanning to continuously identify vulnerable or risky third-party components.
-
Secure the software supply chain through DevSecOps practices by hardening CI/CD pipelines, using trusted sources, and enforcing artifact signing and verification.
-
Reduce downstream risk with ongoing patching, runtime monitoring, and regular reviews to quickly detect and respond to compromised dependencies.
|
Strong supply chain security helps reduce the risk that hidden flaws or tampered code cascade across your environment. |
|
|
| Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
