Cybersecurity today would like to thank Meter for their support in bringing you
This podcast Meter delivers a complete networking stack, wired, wireless and
cellular in one integrated solution that's built for performance and scale.
You can find them at meter.com/cst.
Fortinet flaws still actively exploited.
Windows 11 updates.
Breaking some systems.
A wiper aimed at Europe's power grid Attacker in the middle.
Phishing hits energy firms a. And a flaw that could have put every
AWS account on the planet at risk.
This is cybersecurity today, and I'm your host, David Shipley.
Let's get started.
Our first story today is an update on one we've been covering
for the last week, and it's not reassuring for Fortinet customers.
Fortinet has confirmed that a critical 40 cloud single sign on authentication
bypass tracked as CVE 20 25 59 7 1 8 is still not fully patched, despite
fixes being released in early December.
This follows reports from administrators who found fully patched FortiGate
firewalls compromised In multiple cases, attackers created new administrative
accounts enabled VPN access and exported firewall configurations within seconds
pointing to automated exploitation.
Security firm, Arctic Wolf says The campaign began January 15th and closely
resembles activity seen in December when the vulnerability was first disclosed.
At that time, the flaw allowed attackers to bypass authentication
using crafted SAML messages when 40 Cloud SSO was enabled.
Fortinet now acknowledges attackers are using a new attack path impacting
devices that were fully up to date at the time of compromise.
The company says it is working on a comprehensive fix and
will issue an updated advisory once timelines are confirmed.
Fortinet also warned that while exploitation has so far been observed
through 40 Cloud SSO, the issue applies to all SAML based SSO implementations.
As an interim mitigation, customers are advised to restrict
administrative access to trusted IP addresses and disable 40 Cloud SSO.
Where possible organizations finding indicators of compromise are being told
to treat effective systems as fully compromised and to rotate credentials
as part of their incident response.
Shadow server estimates nearly 11,000 Fortinet devices remain exposed
online with 40 Cloud SSO enabled.
CISA previously added this vulnerability to its known
exploited vulnerabilities list.
Fortinet has not yet provided a timeline for a final fix.
Our second story is a cautionary note for Windows administrators
following January's Patch Tuesday.
Microsoft says it is investigating reports that some Windows 11 systems
failed to boot after installing January, 2026, security updates displaying an
UNMOUNT boot volume error during startup.
The issue affects Windows 11, version 25 H two, and all
additions of versions 24 H two.
After installing KB 5 0 7 41 0 9, cumulative update released January
13 Affected systems fail to start normally and require manual recovery
steps to boot again, Microsoft says Reports are limited and appear to
affect physical devices only with no virtual machines reported as impacted.
Microsoft has asked affected users and administrators to submit diagnostics
through the feedback hub while it determines whether the issue is a
regression caused by the update.
Separately.
Microsoft also released an out-of-band update to fix different January
issues related to outlook, which were causing freezes when dot PST
files were stored in cloud services.
Quality issues with Microsoft patches ramped up in 2025 with a number of
notable problems and 2026 appears to be off on a sour note, It's hard
to convince systems administrators to patch quickly when mistakes like
this keep happening more frequently.
Our third story takes us to Europe, and a reminder that destructive
cyber operations against critical infrastructure remain a real threat.
A cyber attack targeting Poland's energy Systems in late December
has been linked to sand worm, the Russian State sponsored hacking group
with a long history of disruptive attacks, particularly in Ukraine,
researchers say attackers attempted to deploy a new data wiping malware.
Dubbed Dyno wiper during an attack that took place between December 29th and 30th.
Polish officials say the attack targeted two combined heat and power plants, along
with a management system controlling electricity generated from renewable
sources, including wind and solar.
The attack appears to have failed with no widespread outages reported.
Poland's Prime Minister said the evidence points to groups directly
linked to Russian intelligence services.
Sand Worm is best known for its 2015 attack on Ukraine's power grid
and has been linked to multiple destructive campaigns throughout
2025 targeting Ukrainian government education and agriculture.
Technical details in Dyna wiper remain limited and no public
samples have surfaced so far.
It's still unclear how access was gained or how long attackers
remained inside Polish systems.
This attack occurs while Canada, in particular continues to struggle to update
its critical infrastructure security laws.
Our fourth story is another warning from Microsoft this time about a
highly coordinated phishing and business email compromise campaign
targeting the energy sector.
Microsoft says attackers are using multi-stage adversary in the middle,
or A ITM approaches that begin with phishing emails sent from previously
compromised, but trusted accounts.
The messages impersonate SharePoint document sharing notifications,
exploiting the fact that these services are widely used and trusted.
A technique some have referred to as living off trusted sites.
Victims are redirected to fake portals that steal credentials and session
cookies in real time, allowing attackers to bypass standard MFA protections.
Once inside attackers create malicious inbox rules to hide
evidence of compromise, then use the account to launch large scale
internal and external phishing.
In one case, more than 600 phishing emails were sent from a single compromised inbox.
Microsoft says remediation requires more than password resets.
Organizations must revoke active sessions, remove attacker created rules,
undo unauthorized MFA changes, and it's highly recommended that organizations
support those controls with regular cybersecurity awareness training,
and phishing simulation exercises.
Our final story today involves what may be one of the most consequential cloud
security near misses of the decade.
Security researchers at Wiz disclosed a vulnerability in AWS code build, dubbed
code breach that could have allowed attackers to take over AWS managed GitHub
repositories, including the AWS JavaScript SDKA core component used by the AWS
console and countless cloud applications.
The issue stemmed from a subtle misconfiguration in the CICD webhook
filters, missing just two characters in a regular expression, also known
as a RegX meant attackers could bypass restrictions, trigger privilege
builds, and extract highly privileged GitHub admin tokens directly from
AWS's own build environments.
With that level of access, attackers could have injected malicious code into
trusted AWS SDKs, creating a platform wide supply chain compromise that
researchers say could have put every single AWS account on the planet at risk.
Wiz demonstrated how predictable GitHub user IDs could be generated to exploit
the flaw, enabling full administrative control over the affected repositories.
AWS remediated the issue within days of disclosure.
In August, 2025, rotated credentials, audited, spilled pipelines, and
added additional safeguards.
The company says it found no evidence of exploitation in the wild.
Still, the significance here is the scale of the potential impact.
This wasn't a customer misconfiguration, it was a weakness in the core
machinery that runs AWS itself
across today's stories, the theme is pretty consistent.
Authentication failures, patch quality problems, trusted systems abused, and in
one case, a small single overlooked detail that could have reshaped how the global
cloud works for the worse cyber risk.
Today isn't just about individual breaches, it's about systemic
fragility and how small failures could cascade at enormous scale.
Whether that's attacks on critical infrastructure like power plants or
bringing down an entire cloud environment.
That's it for cybersecurity today, for Monday, January 26th.
I'm David Shipley.
Stay safe, stay informed, and Jim Love will be back on
the news desk on Wednesday.
A reminder, if you enjoy the show, please tell others.
Consider leaving us a review and remember to like and subscribe.
We'd love to reach even more people, and we continue to need your help.
Thanks for listening.
And that is our show, and we'd like to thank Meter for their support
in bringing you this podcast Meter delivers full stack networking
infrastructure, wired, wireless, and cellular to leading enterprises.
Working with their partners meter designs, deploys and manages
everything required to get performant.
Reliable and secure connectivity in your space.
They design the hardware, the firmware, build the software,
manage deployments, and run support.
It's a single integrated solution that scales from branch offices
to warehouses to large campuses, all the way to data centers.
Book a demo at me.com/cst.
That's METE r.com/cst.