Simo

chief honeypot @defusedcyber

[Simo @SimoKohonen]

Easter holidays and a Fortinet 0-day - a match made in heaven 🐰

(also my first credited CVE 😇)

[Defused @DefusedCyber]

🚨 New Fortinet vulnerability being exploited as an 0-day

CVE-2026-35616 - FortiClient EMS pre-authentication API access bypass - CVSS 9.1 Critical

After observing in-the-wild exploitation of this vulnerability earlier this week, Defused reported it to Fortinet under responsible disclosure.

Fortinet has released an emergency hotfix - plus a scheduled patch - for FortiClient EMS 7.4.5 and 7.4.6.

The vulnerability allows an unauthenticated attacker to bypass API authentication and authorization entirely, unauthorized code or commands via crafted requests.

This discovery was made through our upcoming Radar feature launching next week 😇

Advisory: https://t.co/Jr2fUbq8JV

Track exploitation of this and other Fortinet vulns in real time and get updates on the new Defused Radar 👉 https://t.co/iRDhHlDkep

Credit also to @heckintosh_ for independently discovering this vulnerability 💪

[Simo @SimoKohonen]

@techspence 🙏🙏🙏🙏

[Simo @SimoKohonen]

@adversarialy @DefusedCyber

[Simo @SimoKohonen]

🍯🍯🍯🍯

[Simo @SimoKohonen]

Past few weeks I have been posting less @DefusedCyber updates, but only because it's reached enough users that have needed to rework some scaling aspects.

That said, new stuff coming soon again 😉

[Simo @SimoKohonen]

@WahlenPMattias @xofreyr as usual, the internet communists have absolutely zero factual backing to their ideologies: https://t.co/jCkMv5wap1

[Simo @SimoKohonen]

@ZackKorman Secure my agent

[Simo @SimoKohonen]

@techspence @DefusedCyber

[Simo @SimoKohonen]

Shame we didn't pick up on this sooner despite the data being in the platform, but showcases exactly why I'm launching @DefusedCyber Builder - you can pick up different things & sometimes get earlier signals from running honeypots on your own infra 🍯

[Defused @DefusedCyber]

🚨 Based on @rapid7 observations of exploitation of PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257), we can also confirm first signs of exploitation around the same time (May 18th on the Defused TF feeds, and a customer hit on May 17th)

The exploit payload differs slightly from Rapid 7's POC with the user-agent PAN GlobalProtect/6.0.0

Attacker IP: 104.207.144[.]154 🇺🇸 AS20473 The Constant Company

Rapid7 write-up: https://t.co/n9QiTULwHA

[Simo @SimoKohonen]

@DefusedCyber

[Simo @SimoKohonen]

@syntaxish @UK_Daniel_Card Thats a fake photo cos im a drone expert and know you cant fly drones at Hoover Dam 😉

[Simo @SimoKohonen]

@UK_Daniel_Card @syntaxish Close enough 😂

[Simo @SimoKohonen]

@AdamParsonz @techspence Defo. The economics are much more friendly there

[Simo @SimoKohonen]

@adversarialy @techspence Yeah i looked at it at some point. Its a good idea in principle but has some pitfalls (at least for Defused specifically) and i have gone a different route IRT ai assisted honeypotting

[Simo @SimoKohonen]

@techspence @ZackKorman ❌ Access denied
✅ Permissionmogged

[Simo @SimoKohonen]

@corpusavatar @ZackKorman remember to use the right jargon (you "shifted left" too far)

[Simo @SimoKohonen]

@ZackKorman they took zero trust so far they hit minus one, and everything was permitted

[Simo @SimoKohonen]

@techspence @_JohnHammond @IceSolst @ZackKorman @AnthonyBendas @_ContinuumCon_ Thats me in winter 😂

[Simo @SimoKohonen]

@_JohnHammond @IceSolst @ZackKorman @techspence @AnthonyBendas @_ContinuumCon_ Ill come if I can free myself in time