Weekly Recap: Fortinet Exploits, RedLine Clipjack, NTLM Crack, Copilot Attack & More

"In cybersecurity, the line between a normal update and a serious incident keeps getting thinner. Systems that once felt reliable are now under pressure from constant change. New AI tools, connected devices, and automated systems quietly create more ways in, often faster than security teams can react. This week's stories show how easily a small mistake or hidden service can turn into a real break-in."

"Behind the headlines, the pattern is clear. Automation is being used against the people who built it. Attackers reuse existing systems instead of building new ones. They move faster than most organizations can patch or respond. From quiet code flaws to malware that changes while it runs, attacks are focusing less on speed and more on staying hidden and in control."

"The vulnerability, tracked as CVE-2025-64155 (CVSS score: 9.4), allows an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests. In a technical analysis, Horizon3.ai described the issue as comprising two issues: an unauthenticated argument injection vulnerability that leads to arbitrary file write, allowing for remote code execution as the admin user, and a file overwrite privilege escalation vulnerability that leads to root access and complete compromise of the appliance."

The line between a routine update and a serious security incident is shrinking as constant change stresses previously reliable systems. New AI tools, connected devices, and automation expand the attack surface and create faster entry points than security teams can often react to. Attackers increasingly reuse existing systems, exploit quiet code flaws, and employ malware that changes behavior at runtime to remain hidden and maintain control. Organizations are being outpaced in patching and response. A critical FortiSIEM vulnerability (CVE-2025-64155) enables unauthenticated remote code execution and privilege escalation via the phMonitor service, permitting full appliance compromise. Protection of developer tools, cloud systems, and internal networks requires heightened vigilance.

Read at The Hacker News