Today’s Field Note

The FBI is confirming what the telemetry already showed: FortiBleed operators are inside exposed FortiGate SSL VPNs, creating accounts and deleting legitimate ones to lock admins out of their own gear. If you run Fortinet edge and you are waiting for a maintenance window, you have already lost that argument. Meanwhile SonicWall patched a pre-auth SSRF in SMA1000 rated CVSS 10.0 (no confirmed exploitation yet, but that is a before, not a never), and LMCache (the cache layer in front of vLLM and friends) has an unauthenticated RCE over its ZeroMQ multiprocess mode with no fixed version shipped. The last one matters because nobody treats their LLM accelerator as attack surface, which is exactly why it is attack surface.

Today’s Action

  • Audit FortiGate admin and local user accounts now for unknown additions or deletions, and pull SSL VPN auth logs for the last 30 days. Assume compromise on anything internet-facing and unpatched.
  • Rotate FortiGate admin credentials and VPN secrets, enforce MFA on admin access, and restrict management interfaces to known IPs.
  • Apply the SonicWall SMA1000 hotfixes covering the CVSS 10.0 SSRF and the three accompanying flaws before weekend drift sets in.
  • For LMCache: pull multiprocess mode off any network-reachable interface, bind ZeroMQ to localhost only, and firewall the cache server until a fix lands.
  • Confirm your edge devices actually log somewhere you can read them, not just locally where an attacker can wipe them.

Patch the box before someone else changes the locks.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.