A (0:00)

Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them@meter.com CST.

B (0:20)

Fortinet flaws still actively exploited Windows 11 updates, breaking some systems, a wiper aimed at Europe's power grid attacker in the middle, phishing hits energy firms, and a flaw that could have put every AWS account on the planet at risk. This is Cybersecurity Today and I'm your host David Shipley. Let's get started. Our first story today is an update on one we've been covering for the last week, and it's not reassuring for Fortinet customers. Fortinet has confirmed that a critical forticloud single sign on authentication bypass tracked as CVE2025 59718 is still not fully patched despite fixes being released in early December. This follows reports from administrators who found fully patched fortigate firewalls compromised in multiple cases. Attackers created new administrative accounts, enabled VPN access, and exported firewall configurations within seconds, pointing to automated exploitation. Security firm Arctic Wolf says The campaign began January 15th and closely resembles activity seen in December when the vulnerability was first disclosed. At that time, the flaw allowed attackers to bypass authentication using crafted SAML messages when Forti Cloud SSO was enabled. Fortinet now acknowledges attackers are using a new attack path, impacting devices that were fully up to date at the time of compromise. The company says it is working on a comprehensive fix and will issue an updated advisory once timelines are confirmed. Fortinet also warned that while exploitation has so far been observed through 40 cloud SSO, the issue applies to all SAML based SSO implementations. As an interim mitigation, customers are advised to restrict administrative access to trusted IP addresses and disable 40 cloud SSO where possible. Organizations finding indicators of compromise are being told to treat effective systems as fully compromised and to rotate credentials as part of their incident response. Shadow server estimates nearly 11,000 Fortinet devices remain exposed online with 40 cloud SSO enabled. CISA previously added this vulnerability to its known exploited vulnerabilities list. Fortinet has not yet provided a timeline for a final fix. Our second story is a cautionary note for Windows administrators following January's patch Tuesday. Microsoft says it is investigating reports that some Windows 11 systems failed to boot after installing January 2026 security updates displaying an unmountable boot volume error during startup. The issue affects Windows 11 version 25H2 and all editions of versions 24H2 after installing KB5074109. Cumulative update released January 13. Affected systems fail to start normally and require manual recovery steps to boot again. Microsoft says reports are limited and appear to affect physical devices only, with no virtual machines reported as impacted. Microsoft has asked affected users and administrators to submit diagnostics through the Feedback Hub while it determines whether the issue is a regression caused by the update. Separately, Microsoft also released an out of band update to fix different January issues related to Outlook, which were causing freezes when PST files were stored in cloud services. Quality issues with Microsoft patches ramped up in 2025 with a number of notable problems, and 2026 appears to be off on a sour note. It's hard to convince systems administrators to patch quickly when mistakes like this keep happening more frequently. Our third story takes us to Europe and a reminder that destructive cyber operations against critical infrastructure remain a real threat. A cyber attack targeting Poland's energy systems in late December has been linked to Sandworm, the Russian state sponsored hacking group with a long history of disruptive attacks, particularly in Ukraine. Researchers say attackers attempted to deploy a new data wiping malware dubbed Dynowiper during an attack that took place between December 29th and 30th. Polish officials say the attack targeted two combined heat and power plants, along with a management system controlling electricity generated from renewable sources, including wind and solar. The attack appears to have failed, with no widespread outages reported. Poland's prime minister said the evidence points to groups directly linked to Russian intelligence services. Sandworm is best known for its 2015 attack on Ukraine's power grid and has been linked to multiple destructive campaigns throughout 2025 targeting Ukrainian government, education and agriculture. Technical details on Dynowiper remain limited and no public samples have surfaced so far. It's still unclear how access was gained or how long attackers remained inside Polish systems. This attack occurs while Canada in particular continues to struggle to update its critical infrastructure security laws. Our fourth story is another warning from Microsoft, this time about a highly coordinated phishing and business email compromise campaign targeting the energy sector. Microsoft says attackers are using Multi Stage Adversary in the Middle, or aitn, approaches that begin with phishing emails sent from previously compromised but trusted accounts. The messages impersonate SharePoint document sharing notifications, exploiting the fact that these services are widely used and trusted, a technique some have referred to as living off trusted sites. Victims are redirected to fake portals that steal credentials and session cookies in real time, allowing attackers to bypass standard MFA protections once inside Attackers create malicious inbox rules to hide evidence of compromise, then use the account to launch large scale internal and external phishing. In one case, more than 600 phishing emails were sent from a single compromised inbox. Microsoft says remediation requires more than password resets. Organizations must revoke active sessions, remove attacker created rules, undo unauthorized MFA changes, and it's highly recommended that organizations support those controls with regular cybersecurity awareness training and phishing simulation exercises. Our final story today involves what may be one of the most consequential cloud security near misses of the decade. Security researchers at Wiz disclosed a vulnerability in AWS code build, dubbed code breach that could have allowed attackers to take over AWS managed GitHub repositories, including the AWS JavaScript SDK, a core component used by the AWS console, and countless cloud applications. The issue stemmed from a subtle misconfiguration in the CICD webhook filters. Missing just two characters in a regular expression, also known as a regex, meant attackers could bypass restrictions, trigger privileged builds, and extract highly privileged GitHub admin tokens directly from AWS's own build environments. With that level of access, attackers could have injected malicious code into trusted AWS SDKs, creating a platform wide supply chain compromise that researchers say could have put every single AWS account on the planet at risk. Wiz demonstrated how predictable GitHub user IDs could be generated to exploit the flaw, enabling full administrative control over the affected repositories. AWS remediated the issue within days of disclosure in August 2025, rotated credentials, audited its build pipelines and added additional safeguards. The company says it found no evidence of exploitation in the wild. Still, the significance here is the scale of the potential impact. This wasn't a customer misconfiguration, it was a weakness in the core machinery that runs AWS itself. Across today's stories, the theme is pretty consistent authentication failures, patch quality problems, trusted systems abused, and in one case, a small, single overlooked detail that could have reshaped how the global cloud works for the worse. Cyber risk today isn't just about individual breaches. It's about systemic fragility and how small failures could cascade at enormous scale, whether that's attacks on critical infrastructure like power plants or bringing down an entire Cloud Environment. That's it for Cybersecurity Today for Monday, January 26th. I'm David Shipley. Stay safe, stay informed, and Jim Love will be back on the news desk on Wednesday. A reminder, if you enjoy the show, please tell others consider leaving us a review and remember to like and subscribe. We'd love to reach even more people and we continue to need your help. Thanks for listening.