FortiBleed campaign used custom FortiGate sniffer to steal credentials

Cybersecurity Threats and Updates: Multiple Vulnerabilities Exposed

Recent Breaches and Fixes: FortiGate, Microsoft, AWS, and Salesforce

Multiple cybersecurity threats have been exposed in recent days, affecting various companies and platforms, including Fortinet's FortiGate, Microsoft's AutoGen Studio, AWS, and Salesforce.

Security firm SOCRadar has revealed that the FortiBleed campaign, which targeted Fortinet FortiGate devices, used custom sniffers to harvest authentication secrets from compromised firewalls and steal credentials. The operation targeted over 430,000 FortiGate firewalls worldwide and has been active since at least February 2026.

Meanwhile, Microsoft has confirmed that Windows 11 version 26H2 will be the next feature update and that devices running Windows 11 24H2 and 25H2 will be able to upgrade using a small enablement package. The company has also fixed a vulnerability in its AutoGen Studio interface for prototyping AI agents, which could have let attackers manipulate an agent into executing arbitrary commands on its host system.

AWS has announced Continuum, a new service designed to continuously discover, investigate, and remediate vulnerabilities in enterprise environments. The service aims to help enterprises move findings through the entire remediation lifecycle.

In another development, an attacker broke into competitive-intelligence vendor Klue, stole OAuth tokens its customers use to connect to Salesforce and other platforms, and accessed data across multiple customer environments. Klue has revoked customer OAuth tokens and disabled affected integrations.

What Happened

• FortiBleed campaign used custom FortiGate sniffer to steal credentials from over 430,000 firewalls worldwide.
• Microsoft confirms Windows 11 version 26H2 as the next feature update and fixes AutoGen Studio vulnerability.
• AWS announces Continuum, a new service for vulnerability discovery and remediation.
• Klue breach exposes Salesforce CRM data through stolen OAuth tokens.

Why It Matters

• The FortiBleed campaign highlights the importance of securing firewalls and protecting authentication secrets.
• Microsoft's updates and fixes demonstrate the company's commitment to improving the security of its products.
• AWS Continuum aims to address the growing need for automated vulnerability management.
• The Klue breach emphasizes the importance of securing OAuth tokens and protecting customer data.

What Experts Say

"The FortiBleed campaign is a significant threat to organizations that use FortiGate devices." — SOCRadar researcher "Continuum is a game-changer for vulnerability management." — AWS VP of Security and Observability Chet Kapoor

Key Numbers

• **430,000: Number of FortiGate firewalls targeted by the FortiBleed campaign.

Key Facts

• What: Cybersecurity breaches and updates.
• When: Recent days.
• Impact: Exposed credentials, stolen OAuth tokens, and compromised customer data.

What Comes Next

• Organizations should prioritize securing firewalls and protecting authentication secrets.
• Microsoft will continue to roll out updates and fixes for its products.
• AWS will expand the capabilities of Continuum.
• Klue will work to prevent similar breaches in the future.