k3ym𖺀
@k3ym0@infosec.exchange
[~]$ whoami principal killswitch engineer. proud 1x engineer. cybernaut. blueteamer. privacy advocate. disciple of doctorow. reader of white papers. eff member. round-earther. cyber dark arts certified. professor emeritus of shitpostery and fellow at the institute of memetic research and development. i larp as a normie. (he/him) opinions expressed != employers
infosec.exchange
reminder that "fortibleed" is not a vuln. no CVE. no patch. nothing fucking "bled."
it's a russian-speaking crew firing 1.16 billion creds from old breaches and infostealer logs at every fortigate dumb enough to have its mgmt interface sitting on the public internet. ~50% of internet-facing boxes. half of you.
and before anyone cries "but my password was 28 characters with symbols": it didn't get cracked. it was already chilling in an infostealer dump in plaintext. great entropy, shame about the malware on your sales guy's laptop.
the -bleed suffix is marketing. the real CVE is CVE-2026-YOUREANIDIOT: "admin panel pointed at 0.0.0.0/0, password recycled from a 2022 breach, MFA considered but never enabled."
rotate the creds, yank the mgmt interface off the internet, force MFA, and maybe stop letting threat intel firms name your incidents like they're naming a fucking Marvel villain.
#infosec #fortinet #fortigate
25
0
17
You've seen all posts