InfoSecBulletin Cybersecurity for mankind
CISA has instructed U.S. gov.t agencies to secure their systems within a week due to a vulnerability in Fortinet’s FortiWeb web application firewall that has been exploited in zero-day attacks.
CVE-2025-58034 is an OS command injection flaw that lets authenticated attackers execute code with minimal effort and no user interaction.
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
“An Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands,” Fortinet said on Tuesday.
The cybersecurity agency included the vulnerability in its Known Exploited Vulnerabilities Catalog and has given FCEB agencies until November 25th to secure their systems as required by Binding Operational Directive 22-01.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” CISA warned.
“With recent and ongoing exploitation events [..], a reduced remediation timeframe of one week is recommended,” it added, referring to a second FortiWeb flaw (CVE-2025-64446) exploited in zero-day attacks that Fortinet silently patched in late October.
On Friday, CISA added vulnerability CVE-2025-64446 to its list of actively exploited security flaws, instructing U.S. federal agencies to patch their devices by November 21st.
