Full Width [alt+shift+f] Shortcuts [alt+shift+k]
Sign Up [alt+shift+s] Log In [alt+shift+l]
16
Welcome to Monday, and what an excitingly fresh start to the week we're all having. Grab your coffee, grab your vodka - we're diving into a currently exploited-in-the-wild critical Authentication Bypass affecting foRtinet's (we are returning the misspelling gesture 🥰) flagship SSLVPN appliance, the
3 weeks ago

Improve your reading experience

Logged in users get linked directly to articles resulting in a better reading experience. Please login for free, it takes less than 1 minute.

More from watchTowr Labs

8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur

Surprise surprise, we've done it again. We've demonstrated an ability to compromise significantly sensitive networks, including governments, militaries, space agencies, cyber security companies, supply chains, software development systems and environments, and more. “Ugh, won’t they just stick to creating poor-quality memes?” we

2 weeks ago 14 votes
Exploitation Walkthrough and Techniques - Ivanti Connect Secure RCE (CVE-2025-0282)

As we saw in our previous blogpost, we fully analyzed Ivanti’s most recent unauthenticated Remote Code Execution vulnerability in their Connect Secure (VPN) appliance. Specifically, we analyzed CVE-2025-0282. Today, we’re going to walk through exploitation. Once again, however, stopping short of providing the world with a

a month ago 30 votes
Do Secure-By-Design Pledges Come With Stickers? - Ivanti Connect Secure RCE (CVE-2025-0282)

Did you have a good break? Have you had a chance to breathe? Wake up. It’s 2025, and the chaos continues. Haha, see what we did? We wrote the exact same thing in 2024 because 2024 was exactly the same. As an industry, we are on GroundHog day

a month ago 32 votes
Backdooring Your Backdoors - Another $20 Domain, More Governments

After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process for verifying domain ownership to give ourselves the ability to issue valid and trusted TLS/

a month ago 43 votes

More in technology

Reading list 02/22/25

Waymo’s factory, a map of US land values, ships in the Arctic Circle, battery industry trends, and more.

20 hours ago 7 votes
Algorithms are breaking how we think

Today, Alec Watson posted a video titled “Algorithms are breaking how we think” on his YouTube channel, Technology Connections. The whole thing is excellent and very well argued. The main thrust is: people seem increasingly less mindful about the stuff they engage with. Watson argues that this is bad, and I agree. A little while ago I watched a video by Hank Green called “$4.5M to Spray Alcoholic Rats with Bobcat Urine”. Green has been banging this drum for a while. He hits some of the same notes as Watson, but from a different angle. This last month has been a lot, and I’ve withdrawn from news and social media quite a bit because of it. Part of this is because I’ve been very busy with work, but it’s also because I’ve felt overwhelmed. There are now a lot of bad-faith actors in positions of power. Part of their game plan is to spray a mass of obviously false, intellectually shallow, enraging nonsense into the world as quickly as possible. At a certain point the bullshit seeps in if you’re soaking in it. The ability to control over what you see next is powerful. I think it would be great if more people started being a bit more choosy about who they give that control to.

8 hours ago 4 votes
But good sir, what is electricity?

A quick look at the physics of conductors, insulators, and electric charges.

3 hours ago 2 votes
How Core Git Developers Configure Git

What `git config` settings should be defaults by now? Here are some settings that even the core developers change.

yesterday 5 votes
Odds and Ends #59: The end of "woke capitalism"

Plus the government did the stupid thing after all.

yesterday 2 votes