Better Security, Together

Fortinet has released security updates addressing a critical vulnerability (CVE-2025-32756) that has been actively exploited as a zero-day in attacks targeting FortiVoice enterprise phone systems. The flaw, which carries a CVSS score of 9.6, is a stack-based buffer overflow (CWE-121) that could allow remote unauthenticated attackers to execute arbitrary code or commands via specially crafted HTTP requests.
According to Fortinet’s advisory, the vulnerability impacts multiple products including FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera. While the company confirmed active exploitation on FortiVoice systems, it did not disclose the scale or attribution of the attacks.
Attackers reportedly conducted network scans, enabled FCGI debugging to capture credentials, and erased system crash logs to cover their tracks. The vulnerability affects multiple Fortinet products, and users are urged to take necessary action.

Researchers have warned that hackers using Scattered Spider tactics, who recently attacked UK retail chains including Marks & Spencer, Co-op, and potentially Harrods, have now expanded their operations to target US retailers. The threat actors, also tracked as UNC3944, 0ktapus, Scatter Swine, Starfraud, and Muddled Libra, are employing ransomware and extortion operations against the retail sector, continuing their pattern of focusing on one industry at a time. These attackers are known for sophisticated social engineering techniques including phishing, SIM swapping, and MFA bombing, and have previously compromised high-profile organizations such as MGM Resorts, Twilio, Coinbase, and Reddit. The DragonForce ransomware operation, which emerged in December 2023 and has claimed responsibility for the UK retail attacks, appears to be the latest ransomware variant utilized by this fluid collective of threat actors who have previously affiliated with RansomHub, Qilin, and BlackCat ransomware operations.