Patch/Configuration Management

Fortinet has issued emergency updates to address the critical FortiCloud SSO authentication bypass vulnerability, tracked as CVE-2026-24858, after momentarily deactivating FortiCloud SSO and blocking FortiCloud accounts observed in zero-day intrusions earlier this month, reports SecurityWeek.

Vulnerability lets threat actors drop malware into the Windows Startup folder.

The vm2 library, designed to run untrusted JavaScript code in a secure context, has a history of sandbox-escape vulnerabilities.

The inclusion of these vulnerabilities in CISA's KEV catalog mandates federal agencies to address them by February 16, 2026, under Binding Operational Directive 22-01.

Discovered by Vladimir Tokarev, the Cellbreak vulnerability (CVSS score: 9.1) is a Pyodide sandbox escape.

Emergency security updates have been released by Microsoft to remediate the actively exploited Office security feature bypass zero-day, tracked as CVE-2026-21509, Security Affairs reports.

Infosecurity Magazine reports that threat actors have been actively exploiting a critical authentication flaw in the open-source low-code application platform Appsmith, tracked as CVE-2026-22794, to facilitate user account takeovers.