InfoSecBulletin Cybersecurity for mankind
A threat actor is allegedly offering a private remote code execution exploit for Fortinet FortiGate SSL VPN appliances, claiming that FortiOS 7.2.x and 7.4.x are affected. The listing has not been independently verified and does not confirm the existence of a new FortiGate zero-day vulnerability.
The ad by Dark Web Intelligence talks about a “1-day” exploit that lets someone run code from far away.
‘SMS of Death’ Zero-Click Flaw Disrupting Android Phones With a Single Text
NIST Unveiled Guidance for Post-Quantum Cryptography Transition
Daily Cyber security update for 29.10. 2026
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
The exploit is reportedly intended for initial access against exposed FortiGate SSL VPN services. The actor also claims to have a proof-of-concept video and says pricing is available through private communication.
However, the listing does not name a CVE, identify exact affected firmware builds, explain whether authentication is required, or provide a technical description of the alleged vulnerability.
These omissions make it impossible to determine whether the claimed exploit targets an undisclosed flaw, an older patched vulnerability, a bypass of an existing fix, or a fraudulent product.
Cisco Warns of Critical ISE 0-Day Vulnerability
Cisco has sent an urgent warning about a serious security hole in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). This problem, known as CVE-2026-76460, is already being used in attacks, according to Cisco’s Product Security Response Team.
The flaw has a highest CVSS score of 10.0. It might let a remote attacker without login access get around security on the affected systems.
Administrators should check systems for signs of exploitation. Cisco suggested looking at the access.log file for unusual usernames or unexpected API activity.
Security teams need to gather support bundles that have debug logs on to see extra API gateway logs. Cisco said that proof on a hacked device might not be complete since attackers with full access can delete or hide important evidence.
Organizations should check firewall and network logs that are not from the affected device. Unusual uploads from an ISE node to outside IP addresses, strange downloads, and unknown outbound connections might mean there is a security breach.
