A critical SQL injection vulnerability, identified as CVE-2023-48788, in Fortinet's FortiClient EMS is being actively exploited.
This flaw allows unauthenticated, remote attackers to execute arbitrary code or commands on affected systems, potentially leading to a full system compromise.
Vulnerability Details
Affected Product: FortiClient EMS versions 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10
Identifier: CVE-2023-48788
CVSS Score: 9.8 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching is critical. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
Attack Vector: An unauthenticated remote attacker can send specially crafted HTTP requests to the FortiClient EMS web interface to execute unauthorized code or commands.
Ease of Exploit: The attack complexity is low, and proof-of-concept exploit code is publicly available, lowering the barrier for threat actors.
Action Plan
Immediate Action: Upgrade to FortiClient EMS 7.2.3 or above or 7.0.11 or above.
Workaround: If immediate patching is not possible, using a Web Application Firewall (WAF) can help filter malicious queries. Fortinet also released a virtual patch as a temporary mitigation.
Detection: Monitor for suspicious processes spawning from `sqlserver.exe`. Organizations should review systems for signs of malicious activity, especially those unpatched before March 21, 2024, when widespread exploitation was observed.
Relevant professional terms
SQL Injection (SQLi)
A web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve.
Remote Code Execution (RCE)
A class of software vulnerability that allows a malicious actor to execute code of their choice from a remote location over a network, such as the internet. A successful RCE can lead to a full compromise of the targeted system.
A critical vulnerability, identified as CVE-2025-53521, in F5's BIG-IP Access Policy Manager (APM) is being actively exploited.
This unauthenticated remote code execution flaw was initially rated as a lower-severity denial-of-service issue but has been upgraded, allowing attackers to potentially gain full control of an affected system.
Triage: Urgent. The NCSC and CISA recommend immediate action due to active exploitation.
Attack Vector: An unauthenticated, remote attacker can send specific malicious traffic to a virtual server configured with a BIG-IP APM access policy, leading to code execution. This is a data plane issue with no control plane exposure.
Ease of Exploit: The vulnerability is exploitable without authentication, suggesting a low complexity for attackers.
Action Plan
Immediate Action: Upgrade to a fixed version as outlined in F5's security advisory. If an immediate upgrade is not possible, isolate affected systems.
Workaround: No specific workaround has been provided other than applying the patch. Organizations should investigate for compromise even after patching.
Detection: F5 has published Indicators of Compromise (IOCs) in article K000160486. System administrators should hunt for signs of webshells, which may be memory-resident.
Relevant professional terms
Remote Code Execution (RCE)
An attack in which a threat actor can remotely execute commands of their choosing on a target machine, regardless of geographic location.
Unauthenticated
A type of vulnerability that can be exploited by an attacker without needing to provide valid login credentials (e.g., a username and password).
A critical vulnerability, identified as CVE-2023-6548, in Citrix NetScaler ADC and Gateway products is being actively exploited.
This code injection flaw allows an attacker with access to the management interface to perform remote code execution, prompting an urgent need for patching.
Vulnerability Details
Affected Product: NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-12.35, 13.1 before 13.1-51.15, 13.0 before 13.0-92.21, and others. Version 12.1 is also vulnerable and has reached End Of Life (EOL).
Identifier: CVE-2023-6548
CVSS Score: 8.8 (High)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Urgent. Immediate patching is required as exploits have been observed on unmitigated appliances.
Attack Vector: An attacker with access to the management interface (NSIP, CLIP, or SNIP) can perform remote code execution. Initially thought to require authentication, new intelligence suggests it can be exploited by an unauthenticated attacker.
Ease of Exploit: The vulnerability is being actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
Action Plan
Immediate Action: Upgrade to a patched version, such as 14.1-12.35, 13.1-51.15, or 13.0-92.21 and later releases.
Workaround: Citrix strongly recommends that network traffic to the appliance's management interface be separated from normal network traffic and not exposed to the internet.
Detection: Monitor for unusual processes, unexpected network connections originating from the management interface, and anomalous authentication patterns.
Relevant professional terms
Buffer Overflow
An anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations. This can be exploited by attackers to corrupt software or execute malicious code.
Session ID
A unique identifier that a web server assigns to a user for the duration of their interaction (a session). Because HTTP is a stateless protocol, session IDs are crucial for tracking user states, such as login status or shopping cart contents.
Check Point Research discovered a significant data leakage vulnerability in ChatGPT's code execution environment, allowing a malicious prompt to create a hidden outbound channel to exfiltrate sensitive user data. OpenAI acknowledged the issue and confirmed the vulnerability was fully patched as of February 20, 2026.
Vulnerability Details
Affected Product: ChatGPT Code Execution and Data Analysis Runtime
Risk & Impact
Triage: Critical. The vulnerability could lead to the silent exfiltration of sensitive data from user conversations, including uploaded files and personal information.
Attack Vector: A user could be tricked into using a single malicious prompt that activates a covert data collection channel. This could also be embedded into a custom GPT, which would transmit conversation data to an attacker-controlled server without the user's knowledge.
Ease of Exploit: Simple. The attack can be initiated with a single, carefully crafted prompt disguised as a way to unlock additional features.
Action Plan
Immediate Action: No user action is required. OpenAI confirmed the fix was fully deployed on February 20, 2026.
Workaround: Users should remain cautious and avoid using prompts from untrusted sources or interacting with unofficial custom GPTs.
Relevant professional terms
Code Execution Runtime
A sandboxed environment that allows an application, like ChatGPT, to safely execute code (e.g., Python scripts for data analysis) without affecting the underlying system. In this case, the vulnerability was found in the isolated Linux runtime used by the feature.
Exfiltration Channel
A method or path through which an attacker can secretly transfer stolen data from a compromised system to an external, attacker-controlled location. The vulnerability created a hidden outbound communication path from ChatGPT's runtime to the public internet.
The Iran-linked Handala hacking group breached the personal Gmail account of FBI Director Kash Patel, publicly releasing historical photos and documents. The FBI confirmed the breach, stating no government information was compromised.
Attack Overview
Attack Path: The attackers gained unauthorized access to the director's personal email account. The specific method of compromise has not been disclosed.
Attacker:Handala Hack Team, a group linked to Iran's Ministry of Intelligence and Security (MOIS).
Impact Assessment
Data Stolen: Personal photos, documents, and email correspondence primarily from before 2019 were exfiltrated and published online. One leaked document allegedly contained a resume with personal contact information and security clearance details.
Strategic Takeaway
This incident underscores that the personal accounts of high-profile government officials are primary targets for state-sponsored actors seeking to cause reputational damage and gather intelligence.
Relevant professional terms
Hacktivism
The act of hacking or breaking into a computer system for a politically or socially motivated purpose.
Data Exfiltration
The unauthorized copying, transfer, or retrieval of data from a computer or server.
The Russian state-sponsored group Star Blizzard (aka SEABORGIUM) is adopting the DarkSword exploit kit to target iOS devices.
This campaign focuses on government, academic, and financial entities for the purpose of espionage and data theft.
Key TTPs
Initial Access: Spear-phishing emails with malicious links or PDF lures direct victims to credential harvesting sites. The DarkSword kit uses watering hole attacks on compromised websites.
Execution: The Evilginx framework is used to steal credentials and session cookies, bypassing MFA. DarkSword executes entirely in memory to evade detection.
Defense Evasion: The group uses link shorteners, open redirects, and reverse DNS proxies to obscure their infrastructure.
Campaign Analysis
Star Blizzard's adoption of a sophisticated, fileless iOS exploit kit marks a significant tactical evolution. This shift expands their attack surface from traditional credential phishing to include zero-click compromises of high-value mobile devices.
Targeting & Infrastructure
Target Profile: Government, higher education, financial, legal entities, think tanks, and NGOs in NATO countries.
Relevant Terms
APT (Advanced Persistent Threat): A stealthy and sophisticated cyberattack, often by a nation-state, that gains unauthorized access to a network and remains undetected for an extended period.
Exploit Kit: A toolkit used to identify and attack vulnerabilities in software, commonly web browsers, to distribute malware or gain unauthorized access.
