Fortiguard Labs

Latest Security Updates

Latest Report Image

outbreakalert-logo Outbreak Alert

Oct 19, 2026

Atlassian Arbitrary File Access Vulnerability

Latest Report Image

signalreport-logo Threat Signal

Oct 08, 2026

Citrix NetScaler RCE zero-day Vulnerabilities

Latest Report Image

fortiguardblog-logo Threat Research

Oct 05, 2026

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

Outbreak Reports

outbreakalert-logo Outbreak Alert

Atlassian Arbitrary File Access Vulnerability

CVE-2026-21589 is a critical arbitrary file access vulnerability affecting multiple Atlassian Data Center products, including Bitbucket,...

2 days ago

outbreakalert-logo Outbreak Alert

GitLab Path Traversal Vulnerability

FortiGuard Labs has observed attack activity targeting CVE-2026-85706, a critical path traversal vulnerability in GitLab Community Edition and...

4 weeks ago

outbreakalert-logo Outbreak Alert

Orkes Conductor Evaluator Remote Code Execution

Attackers are actively targeting Orkes Conductor servers vulnerable to CVE-2026-58138, a critical unauthenticated remote code execution...

1 month ago

outbreakalert-logo Outbreak Alert

QuickFox Supply Chain Attack

FortiGuard Labs has uncovered a long-running supply chain compromise targeting QuickFox, a Windows VPN/network acceleration application primarily...

2 months ago

outbreakalert-logo Outbreak Alert

WP2Shell RCE

FortiGuard Labs continues to detect exploitation attempts targeting the WP2Shell attack chain (CVE-2026-63030 and CVE-2026-60137), a critical...

2 months ago

outbreakalert-logo Outbreak Alert

Palo Alto Networks PAN-OS GlobalProtect Auth Bypass

Attackers are actively exploiting a PAN-OS GlobalProtect authentication bypass vulnerability to gain unauthorized VPN access to exposed Palo Alto...

3 months ago

outbreakalert-logo Outbreak Alert

Joomla SP Page Builder RCE

FortiGuard Labs continues to observe active exploitation of CVE-2026-48908, a critical unauthenticated remote code execution vulnerability...

3 months ago

outbreakalert-logo Outbreak Alert

Ivanti Sentry OS Command Injection Vulnerability

FortiGuard Labs continues to observe exploitation attempts targeting CVE-2026-10520 following the public release of technical details and...

3 months ago

outbreakalert-logo Outbreak Alert

Langflow Unauth RCE Attack

FortiGuard Labs has observed a significant uptick in attacks targeting Langflow, leveraging a recently discovered authentication bypass...

3 months ago

outbreakalert-logo Outbreak Alert FEATURED

Outbreak Alert- Annual Report 2025

In 2025, the FortiGuard Labs team processed and blocked 3.8 trillion vulnerability exploitation attempts, preventing 2.71 billion malware...

7 months ago

Threat Research

fortiguardblog-logo Threat Research

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

FortiGuard Labs examines how ClingSTUN exploits vulnerable devices and abuses public STUN servers to support a Linux proxy backdoor.      

2 weeks ago

fortiguardblog-logo Threat Research

Uncovering a SectopRAT Variant Embedded in Legitimate Software

Analysis of a SectopRAT variant hidden in tampered legitimate software that steals credentials and enables remote system control      

3 weeks ago

fortiguardblog-logo Threat Research

Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers

FortiGuard Labs examines how a new Casbaneiro campaign targeting Latin America uses geofencing and distributed servers to evade analysis and...

1 month ago

fortiguardblog-logo Threat Research

Someone Else Is Using Your AI

FortiCNAPP analyzes an AWS LLMjacking incident involving a leaked administrator key and unauthorized access to Amazon Bedrock.      

1 month ago

fortiguardblog-logo Threat Research

Multi-Functional Linux Botnet “Evooo1Bot”

FortiGuard Labs analyzes Evooo1Bot, a modular Linux botnet targeting internet-facing devices with DDoS, SSH attacks, CVE exploits, and SOCKS relays      

2 months ago

fortiguardblog-logo Threat Research

QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

The FortiGuard Labs Incident Response team analyzes a QuickFox supply chain attack that used trojanized Windows installers, selective targeting,...

2 months ago

fortiguardblog-logo Threat Research

Inside a TrickBot Variant Using DNS Tunneling for C2

FortiGuard Labs analyzes a TrickBot variant that uses DNS tunneling for C2 communication, modular execution, and employs persistence and...

3 months ago

fortiguardblog-logo Threat Research

The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

FortiGuard Labs analyzes a global phishing campaign using obfuscated JScript, disguised .ttf files, and Lua loaders to deliver RATs and infostealers.      

3 months ago

fortiguardblog-logo Threat Research

Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula

FortiGuard Labs analyzes a geofenced Ousaban campaign targeting Spain and Portugal with phishing PDFs, steganography, and evasive C2.      

3 months ago

fortiguardblog-logo Threat Research

From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach

See how Shai Hulud-linked CI/CD compromise exposed Jenkins credentials, enabled AWS escalation, and led to Redshift breach activity detected by...

3 months ago

Threat Signals

signalreport-logo Threat Signal

Citrix NetScaler RCE zero-day Vulnerabilities

Threat actors are actively exploiting two critical remote code execution vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting Citrix...

1 week ago

signalreport-logo Threat Signal

Siemens S7 Series PLCs and other Internet-exposed PLC Attack

U.S. cybersecurity agencies, including CISA, NSA, FBI, DOE, and EPA, have warned of an active cyber threat targeting Siemens S7 Series PLCs that...

1 month ago

signalreport-logo Threat Signal

NGINX Heap-Based Buffer Overflow

FortiGuard Labs is tracking an exploitation risk associated with CVE-2026-42533, a heap-based buffer overflow vulnerability affecting NGINX Open...

1 month ago

signalreport-logo Threat Signal

Rockwell Automation/Allen-Bradley MicroLogix PLCs Attack

Cyber threat actors are targeting Internet-facing programmable logic controllers (PLCs) used by water and wastewater organizations, with...

2 months ago

signalreport-logo Threat Signal

PTC Windchill & FlexPLM RCE

A critical unauthenticated remote code execution (RCE) vulnerability affecting PTC Windchill PDMlink and PTC FlexPLM is being actively exploited...

2 months ago

FortiGuard Labs

AI-powered threat intelligence research, securing customers across the entire attack surface.

AI Security Center

AI
Security Center

Securing AI systems while applying AI to cyber defense.

Learn more
Quantum Security Center

Quantum
Security Center

Quantum-safe cryptography for the post-quantum era.

Learn more
Zero-Day Security Center

Zero-Day
Security Center

Discovering and responsibly disclosing zero-day flaws.

Learn more
Sovereign Cyber Initiative

Sovereign
Cyber Initiative

Cyber resilience for nations and their critical assets.

Learn more
Critical Infrastructure Security

Critical Infrastructure
Security

Defending power, healthcare, and financial systems.

Learn more

Services

Comprehensive security services designed to protect your infrastructure, applications, and data at every layer.

Certifications

  • av comparatives logo
  • common criteria logo
  • nss labs logo
  • vb logo
  • mitre logo