[Stanley]

Automated FortiGate Attacks Exploit FortiCloud SSO to Alter Firewall Configurations

Cybersecurity company Arctic Wolf has warned of a "new cluster of automated malicious activity" that involves unauthorized firewall configuration changes on Fortinet FortiGate devices.
The activity, it said, commenced on January 15, 2026, adding it shares similarities with a December 2025 campaign in which malicious SSO logins on FortiGate appliances were recorded against the admin account from

https://thehackernews.com/2026/01/automa...ploit.html

[Moooookie]

That could be rather concerning, especially automated changes to firewalls. Shows how risky weak sso setups can be when left unchecked.