This Week is Tech Insanity Week and it is Not Over

As if it weren’t bad enough already (see yesterday’s client alert at https://tcps-blog.com/client-alerts/bugs-php-node-js-litellm-emudhra-oh-my/), today’s news brought several more reasons to worry.

Fortinet

Fortinet released patches yesterday and today for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. They are withholding the why until November 10th to give people a little time to patch, but we know that AI has already reverse engineered the bugs, so you don’t have that much time. That is pretty much everything. Fortinet did say patch NOW, but not why. Credit: Cybernews

Railway

Development platform Railway has confirmed that a cyberattack allowed hackers to access some customer secrets, prompting the company to urge all users to rotate their API and cloud keys amid fears of a broader breach of customer data. The company, which allows customers to build apps and services on its cloud development platform, said in a blog post on Wednesday that the unidentified hackers “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.”

Connectwise

ConnectWise has shut off access to several of its cloud services after it discovered hackers had compromised it and gained access to Microsoft 365 customer data. Credit: Infosecurity Magazine

Microsoft says that Chinese hackers broke into ConnectWise’s cloud backup service and stole credentials that would give it access to any data the affected customers have in the cloud. Again, according to Microsoft, hackers used AI, that magic word, to hack into around 2,250 companies at a rate of almost 3,000 attempted sign-ins per minute. At that speed defenders who are not using AI and automation to block the attack lost the battle and the war. Credit: Tech Crunch

The attack has been going on since September and the Chinese group breached companies across government, aerospace, defense, finance, manufacturing, technology and energy. The company did reconnaissance, acquired more credentials and tried to expand their access. Credit: The Record

Anthropic Finds Almost 500 Bugs in 25 Open Source Projects

Anthropic recently used Claude to analyze 25 major open source projects written in C, C++, Java, PHP, and Python, in search of security issues. It found almost 500 of them, including security controls turned off by conflicts in settings, sensitive code accessible before authentication, and even a vulnerability that sat in the code for 21 years. Credit: Tech Radar

by