Network RCEs, IaC Weaknesses, and Supply Chain Secret Hunting

FortiSwitch Unauthenticated RCE via FortiLink CVE-2025-22856

A critical RCE flaw (CVE-2025-22856) in FortiSwitch's FortiLink protocol lets attackers execute code without authentication via crafted CDP packets. Patch immediately if you run FortiSwitch in managed mode, this is about as bad as it gets for network infrastructure.

Critical Ivanti VPN Flaws Actively Exploited Against Telecom Targets

Ivanti Connect Secure continues to be a favorite target, with two new critical flaws (CVE-2025-22457 and CVE-2025-0282) now confirmed exploited in the wild against telecom and tech orgs. If you're running ICS, assume compromise and hunt aggressively.