Schedule a Demo

Cyber Security

Cyber Security
Cyber Security

Critical FortiClient SQL Injection Vulnerability Enables Arbitrary Database Access

critical-forticlient-sql-injection-vulnerability-enables-arbitrary-database-access

FortiClient SQL Injection vulnerability A critical SQL injection vulnerability in Fortinet’s FortiClient Endpoint Management Server (EMS). Tracked as CVE-2026-21643, this severe flaw carries a CVSS score of 9.1. It allows unauthenticated attackers to execute arbitrary SQL commands and access sensitive database information. The issue specifically affects FortiClient EMS version 7.4.4 when multi-tenant mode is active. […]

Iranian Cyber Ops Maintain US Network Footholds, Target Cameras for Regional Surveillance

iranian-cyber-ops-maintain-us-network-footholds,-target-cameras-for-regional-surveillance

Iran’s cyber operations took a sharp turn in early 2026, with state-linked threat actors quietly embedding themselves inside US and Canadian networks while also targeting internet-connected surveillance cameras across the Middle East for battlefield intelligence. The Iranian APT group MuddyWater, tied to Iran’s Ministry of Intelligence and Security (MOIS), maintained unauthorized access to multiple American […]

AWS Bedrock AgentCore Sandbox Bypass Allows Covert C2 Channels and Data Exfiltration

aws-bedrock-agentcore-sandbox-bypass-allows-covert-c2-channels-and-data-exfiltration

A significant security flaw in AWS Bedrock AgentCore Code Interpreter’s “Sandbox” network mode, a feature advertised by AWS as providing complete network isolation that allows outbound DNS queries, enabling threat actors to establish covert command-and-control (C2) channels and exfiltrate sensitive data. AWS Bedrock AgentCore Code Interpreter is a managed service that allows AI agents and […]

Phishers Abuse LiveChat Support Tools to Steal Sensitive Data in New SaaS-Based Attack Tactic

phishers-abuse-livechat-support-tools-to-steal-sensitive-data-in-new-saas-based-attack-tactic

A newly identified phishing campaign is turning legitimate customer service software into a weapon for stealing sensitive user data. Attackers have been found abusing LiveChat, a widely used Software-as-a-Service (SaaS) platform that businesses rely on for real-time customer support, to carry out convincing phishing operations against unsuspecting victims. The campaign marks a clear shift from […]

Fake Shipment Tracking Scams Surge in MEA, Stealing Banking Data Through Real-Time Phishing

fake-shipment-tracking-scams-surge-in-mea,-stealing-banking-data-through-real-time-phishing

Every day, billions of people rely on postal and courier services to deliver everything from personal letters to online orders. This dependence has grown steadily alongside the global rise of e-commerce. The 2024 Universal Postal Union report found that postal services now serve 7.3 billion people, and Statista recorded roughly 161 billion parcels shipped in […]

New ACRStealer Variant Uses Syscall Evasion, TLS C2 and Secondary Payload Delivery

new-acrstealer-variant-uses-syscall-evasion,-tls-c2-and-secondary-payload-delivery

A new variant of ACRStealer has emerged with upgraded capabilities that make it significantly harder to detect and more dangerous to the systems it targets. First reported by Proofpoint in early 2025 as a rebranded version of the Amatera Stealer, this latest iteration introduces low-level syscall evasion, encrypted C2 communication over TLS, and the ability […]

Microsoft to Block Windows 11 and Server 2025 Automated Installation After Critical RCE Vulnerability

microsoft-to-block-windows-11-and-server-2025-automated-installation-after-critical-rce-vulnerability

Windows 11 and Server 2025 Automated Installation Microsoft has announced a two-phase plan to disable the hands-free deployment feature in Windows Deployment Services (WDS) following the discovery of a critical remote code execution (RCE) vulnerability tracked as CVE-2026-0386. The flaw, rooted in improper access control, allows an unauthenticated attacker on an adjacent network to intercept […]

Meta to Permanently Remove End-to-End Encryption Feature in Instagram DMs

meta-to-permanently-remove-end-to-end-encryption-feature-in-instagram-dms

Meta has confirmed it will permanently remove end-to-end encryption (E2EE) support from Instagram direct messages, with the feature officially shutting down after May 8, 2026. The announcement, quietly posted on Instagram’s Help Center support page, marks a significant reversal from Meta’s earlier commitment to privacy-focused messaging across its platforms. Instagram’s E2EE feature was never widely […]

Microsoft Releases Out-of-Band Patch For Critical RRAS RCE Vulnerabilities in Windows 11

microsoft-releases-out-of-band-patch-for-critical-rras-rce-vulnerabilities-in-windows-11

Microsoft released an out-of-band hotpatch update on March 13, 2026, addressing serious security vulnerabilities in Windows 11 versions 24H2 and 25H2. Tracked as KB5084597 and targeting OS Builds 26200.7982 and 26100.7982, this update patches three actively concerning flaws in the Windows Routing and Remote Access Service (RRAS) management tool, and notably, it does so without […]

FortiGate Firewalls Exploited in Wave of Attacks to Breach Networks and Steal Credentials

fortigate-firewalls-exploited-in-wave-of-attacks-to-breach-networks-and-steal-credentials

A series of intrusions in early 2026 in which threat actors compromised FortiGate Next-Generation Firewalls (NGFW) to establish persistent footholds within enterprise environments. Each case was intercepted during the lateral movement phase before the attackers could fully achieve their objectives. The attack wave uncovered by SentinelOne closely tracks three high-severity Fortinet vulnerabilities disclosed between December […]