Company
Fortra is a cybersecurity vendor offering tools for managed file transfer, identity security, and threat intelligence, including GoAnywhere MFT and BoKS.
Fortra researcher Cadence Riddle tracked a 12-fold rise in malicious emails mentioning RFQ from October 2025 to September 2026. Nearly 73% of the lures pointed to a credential-stealing login page, Help Net Security reported.
Reality
Fortra disclosed eight vulnerabilities in its BoKS privileged-access manager, three of them critical and one rated CVSS 9.9. Because the predictable passwords can be verified offline, applying the fix does not retire service-account credentials an attacker may already hold.
Reality
Fortra patched CVE-2026-79901, a CVSS 9.9 BoKS keytab flaw that lets any authenticated Active Directory user rebuild Unix service-account passwords offline. Patching replaces the generator, but passwords it already minted stay predictable until rotated.
Reality
Fortra researchers say the extortion crew likely read Dynamics 365 data straight out of portals where a table was exposed to the Anonymous Users web role.
Reality
A Federal Register RFI calls periodic scanning, static prioritization and manual remediation increasingly inadequate. Comments on redesigning the feed close October 13.
Perspective Coverage
3 publishersReality
The updated CISA-FBI advisory puts Medusa at more than 500 victims as of April 2026, up from 300, with exploits weaponized within 24 hours and sometimes a week before disclosure.
Perspective Coverage
7 publishersReality
A record count that Microsoft's own AI bug-hunting produced arrives with two flaws already under attack, and the affected-product lists an operator would use to scope them are the part of the record two vendors read differently.
Reality
Microsoft's September release addressed 972 CVEs, the largest count it has ever shipped. Within hours a researcher published a working proof-of-concept against CVE-2026-69414, the second fix for a Defender flaw first patched in July.
Reality
A hunting signature Microsoft built to catch prompt injection in email started firing on ordinary phishing instead, where invisible tag characters were splitting lure words like "funding" so filters never parsed them.
Perspective Coverage
4 publishersReality