Security Weekly Week 3, 2026: FortiSIEM Critical RCE & Ivanti Zero-Day Exploits

Weekly Summary: The security landscape in early 2026 remains volatile. A critical “nuclear-level” vulnerability has been exposed in Fortinet’s management platform, allowing unauthenticated root access. Ivanti VPNs are once again under siege by advanced persistent threats (APTs). Meanwhile, ransomware groups LockBit and Qilin are aggressively targeting global supply chains. We also highlight this week’s essential open-source security tools from GitHub.

🔴 Critical Vulnerabilities

1. FortiSIEM Remote Code Execution (CVE-2025-64155)

• Severity: Critical (CVSS 9.8)
• Status: PoC Public / High Risk of Active Exploitation
• Details: Security researchers have disclosed a catastrophic vulnerability in the Fortinet SIEM (Security Information and Event Management) platform this week. The flaw resides in the phMonitor service, allowing unauthenticated remote attackers to execute arbitrary commands via crafted TCP requests.
  • Impact: Attackers can gain immediate Root privileges, fully compromising the SIEM server and using it as a pivot point for lateral movement within the network.
  • Affected Versions: FortiSIEM 7.x and multiple versions in the 6.7.x branch (Supervisor and Worker nodes are affected).
• Mitigation:
  • Upgrade to the latest official patch immediately.
  • Temporary Workaround: Strictly restrict access to TCP port 7900 via firewall rules, allowing only trusted management IPs.

2. Ivanti VPN Zero-Day Under Attack (CVE-2025-0282 & CVE-2025-0283)

• Severity: High
• Background: Mandiant has detected the suspected China-nexus threat actor UNC5221 actively exploiting new zero-day vulnerabilities in Ivanti Connect Secure VPNs.
• Technical Details: CVE-2025-0282 is a severe stack-based buffer overflow allowing authentication bypass and code execution. Despite Ivanti releasing patches, the speed of weaponization is alarming due to the edge-facing nature of these devices.
• Defense: Administrators should immediately audit VPN logs for anomalous outbound connections and unauthorized configuration changes.

🌍 Global Threats & Breaches

🚨 Data Leaks & Ransomware Updates

• DHS Data Breach: Reports emerged this week indicating a breach at the U.S. Department of Homeland Security (DHS), exposing the personal and professional details of approximately 4,500 ICE and Border Patrol agents. This raises significant concerns regarding targeted harassment and physical security.

• BreachForums Database Leaked: In an ironic twist, the notorious hacking forum BreachForums suffered a massive data leak. Details of nearly 324,000 users—including hashed passwords, IP addresses, and PGP keys—have been exposed. While a goldmine for investigators, this poses a privacy disaster for security researchers operating undercover on the platform.

• Ransomware Victims:

  • LockBit: Claimed responsibility for attacking Italian logistics firm Depot Napoli, with data already appearing on their leak site.
  • Qilin: Struck Singaporean catering giant Neo Group, reinforcing that supply chain attacks continue to be a dominant threat vector in 2026.

🛠️ Trending GitHub Security Tools

Here are the top open-source projects we’ve scouted from GitHub Trending this week:

1. Daytona - Secure AI Code Sandbox

• Category: DevSecOps / AI Security
• Overview: As AI-generated code becomes ubiquitous, running it safely without compromising local environments is a challenge. Daytona provides a standardized development environment management platform.
• Highlights:
  • One-click setup for isolated development environments (sandboxes).
  • Ideal for security researchers testing malware or analyzing untrusted scripts generated by LLMs.

2. Web-Check - All-in-One OSINT Analysis

• Category: Reconnaissance (Recon)
• Overview: A powerful web-based tool for deep-diving into the architecture and security posture of any website.
• Features:
  • Automatically detects IP info, SSL chains, DNS records, and Cookies.
  • Maps server locations, associated domains, and potential attack surfaces.
  • Use Case: Perfect for Red Team pre-engagement recon or Blue Team asset discovery.

3. Trivy - Comprehensive Vulnerability Scanner

• Category: Container Security / Static Analysis
• Update: Trivy released a new version this week with enhanced capabilities for scanning Kubernetes misconfigurations and exposed secrets.
• Why we like it: Lightweight, CI/CD friendly, and an essential tool for any DevSecOps pipeline.

This report is automatically curated by Lingtian Bot. Please refer to official vendor advisories for the most critical updates.