InfoSecBulletin Cybersecurity for mankind
The Cybersecurity and Infrastructure Security Agency (CISA) has made an urgent warning about a serious security flaw in Fortinet products. On April 13, 2026, the agency put a severe SQL injection threat into its Known Exploited Vulnerabilities (KEV) list. This shows that attackers are using the flaw in real situations.
Fortinet SQL Injection Vulnerability CVE-2026-21643
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
The flaw is listed as CVE-2026-21643. It involves an improper neutralization of special elements used in an SQL command, which is categorized under CWE-89.
This kind of SQL injection flaw occurs when a software application does not properly check user input before it runs database queries.
CISA has created a quick response plan because of current threats. CISA urges Federal agencies need to protect their systems from CVE-2026-21643 by April 16, 2026. Fortinet has given out fixes. Security experts urge companies to follow this quick three-day patching time.
CrowdStrike EDR
A new Bring Your Own Vulnerable Driver (BYOVD) attack can disable leading endpoint security solutions like CrowdStrike Falcon. A researcher studied a new zero-day kernel driver and showed how attackers use real signed drivers to get past endpoint detection and response (EDR) systems.
Hackers use a trusted but faulty driver in BYOVD attacks on a hacked computer to take advantage of its karnel level access.
The investigation found more than 15 different versions of this harmful driver have the quality of destruction and all versions have real Microsoft digital signatures but have not been stopped or canceled by the vendor.
Scans on sites like VirusTotal show no warnings from current antivirus programs. Since the driver is signed and trusted, Windows lets it run in kernel mode without raising security alarms, giving hackers a hidden advantage.
Reverse Engineering the IOCTL
During technical analysis using IDA Pro, the researcher bypassed an obfuscated entry point to examine the driver’s core device-control handler.
After cleaning up the heavily mangled decompiled code, they discovered a dangerous input/output control (IOCTL) interface. Specifically, the IOCTL code 0x22E010 triggers a dedicated process-killing routine.
The driver accepts a process ID as a string, converts it to an integer using standard C functions, and then executes the termination command. The true danger lies in how the driver terminates security processes from the kernel level.
It uses the ZwOpenProcess and ZwTerminateProcess kernel functions to terminate active applications forcibly.
In standard user mode, attempting to close a Protected Process Light (PPL) service, such as CrowdStrike, results in an immediate access denial.
However, kernel-level commands bypass these user-mode protections entirely, allowing the driver to silently kill critical security agents before attackers deploy ransomware or other secondary payloads.
To validate the vulnerability, the core-jmp researcher dynamically tracked the driver in a test environment to locate its symbolic link, identified as \\.\{F8284233–48F4–4680-ADDD-F8284233}.
Using this link alongside the discovered IOCTL code, they developed a custom proof-of-concept exploit named PoisonKiller.
When loaded via standard command-line service tools, the exploit successfully targeted and terminated the active CrowdStrike EDR process.
The complete technical analysis and exploit code have been published on GitHub, highlighting a critical blind spot in how modern operating systems handle signed third-party drivers.
Source: CISA&cybersecuritynews
