Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Arctic Wolf Observes Malicious Configuration Changes On Fortinet FortiGate Devices via SSO Accounts

Starting on January 15, 2026, Arctic Wolf began observing a new cluster of automated malicious activity involving unauthorized firewall configuration changes on FortiGate devices. This activity involved the creation of generic accounts intended for persistence, configuration changes granting VPN access to those accounts, as well as exfiltration of firewall configurations.

Custom Risk Scoring Is the Missing Link Between Disconnected Findings and Real Exposure Management

Most large organizations rely on multiple vulnerability and exposure scanning tools out of necessity. Infrastructure scanners, cloud security platforms, application security testing tools, container scanners, and attack surface management solutions all play a role. Each one is designed to answer a specific question. But when it comes to understanding the risk of the vulnerabilities and exposures they detect, each tool has its own approach to quantifying it.

Live From Davos: The End of Human-Speed Security

This week, I am joining global policymakers and innovators in Davos for the World Economic Forum. The theme for 2026 is "A Spirit of Dialogue", a recognition that our toughest challenges require shared understanding and cooperation. As we gather to discuss the future of the global economy, we have an opportunity to lead an urgent conversation. It centers on the reality of artificial intelligence (AI), not the hype about what it might do, but on what it is already doing in our enterprises.

Can Manufacturing Defects Really Compromise Your Network's Data?

Whenever we consider network security, it tends to cross our mind that we are dealing with hackers, malware or poor passwords. However, there is a less conspicuous danger that never makes the news: the physical elements that constitute your network infrastructure. In particular, the printed circuit boards (PCBs) that drive your routers, switches, and servers may have manufacturing defects that open holes in your security that you never thought of.

The 2026 Cybersecurity Threat Landscape: Persistent Adversaries, Repeatable Playbooks

As a threat intelligence team, our job is to separate noise from persistence in the cybersecurity threat landscape. In this article, we assess the threats most likely to remain and evolve through 2026 based on the threat actors, campaigns, and malware we have tracked and researched during the last year. Our work centers on tracking adversaries with a strong footprint in the underground ecosystem: forums, Telegram channels, data leak sites, and marketplaces where cybercriminals operate.

How we mitigated a vulnerability in Cloudflare's ACME validation logic

On October 13, 2025, security researchers from FearsOff identified and reported a vulnerability in Cloudflare's ACME (Automatic Certificate Management Environment) validation logic that disabled some of the WAF features on specific ACME-related paths. The vulnerability was reported and validated through Cloudflare’s bug bounty program. The vulnerability was rooted in how our edge network processed requests destined for the ACME HTTP-01 challenge path (/.well-known/acme-challenge/*).

Testing MiniMax M2.1 for AI Coding: The Results Might Surprise You

Can "lesser-known" AI models actually keep up with the giants like Google, OpenAI, and Anthropic? In today’s video, we put MiniMax M2.1 to the ultimate test: building a production-ready, secure Node.js note-taking application from a single prompt. We’ll explore how to access MiniMax natively in the Windsurf IDE, walk through the debugging process for common errors (like environment variables and OS-specific dependencies), and perform a deep-dive security audit using Snyk. Stick around until the end to learn how to integrate MiniMax M2.1 into VS Code using OpenRouter.

Why Vulnerability Management Falls Short - And How Exposure Management Fixes It

Vulnerability management identifies weaknesses. Exposure management helps prioritize them based on real-world risk and context. Ed and Garrett unpack why traditional vulnerability programs struggle to drive real risk reduction. The challenge isn’t discovery. It’s prioritization and follow-through. Too often, vulnerabilities are treated as isolated IT tasks—handed off, tracked by SLAs, and stripped of the context that explains why they matter in the first place.