CISA’s Latest Hit List: Fortinet & GitHub Flaws Join the Vulnerability Party!
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Fortinet FortiOS/FortiProxy and GitHub Action flaws to its Known Exploited Vulnerabilities catalog. It’s a big day for vulnerabilities as they finally get their moment in the spotlight, but not the kind they’d hoped for!
Hot Take:
Looks like CISA’s got a new hobby: collecting vulnerabilities like they’re rare Pokémon cards! This time, it’s a wild Fortinet FortiOS/FortiProxy and GitHub Action flaw, both ready to wreak havoc faster than you can say “cybersecurity breach.” Remember, folks, update your systems before these cyber gremlins turn your network into Swiss cheese!
Key Points:
- Fortinet’s FortiOS/FortiProxy vulnerability (CVE-2025-24472) allows attackers to gain super-admin privileges.
- The GitHub Action flaw (CVE-2025-30066) leaks secrets from repositories, with a CVSS score of 8.6.
- Both vulnerabilities are now part of CISA’s Known Exploited Vulnerabilities (KEV) catalog.
- Mora_001, a possible LockBit affiliate, exploits Fortinet vulnerabilities for ransomware deployment.
- CISA mandates federal agencies to fix these vulnerabilities by April 8, 2025.
Already a member? Log in here