Light

Episode #1085 Quiz

A SOTA State-Sponsored Campaign
Date: 2026-06-30 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Episode 1085 details a massive, state-sponsored FortiBleed campaign exploiting operational security flaws in Fortinet devices by leveraging credential reuse, automated scanning, and passive credential harvesting via intercepted VPN traffic across 86,000+ devices globally.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What is the primary method through which the 'FortiBleed' campaign gained access to a vast number of Fortinet FortiGate devices?

Question 1

What is the primary method through which the 'FortiBleed' campaign gained access to a vast number of Fortinet FortiGate devices?

Password spraying using a curated list of previously leaked or cracked passwords Exploitation of a zero-day vulnerability in Fortinet FortiGate firmware Credential harvesting through insider threats within Fortinet itself Phishing campaigns targeting Fortinet device administrators

Question 2: Regarding CISA's Binding Operational Directive (BOD) for federal agencies to update Cisco devices, what was the timeline given for patching the critical SSRF vulnerability (CVE-2026-20230)?

Question 2

Regarding CISA's Binding Operational Directive (BOD) for federal agencies to update Cisco devices, what was the timeline given for patching the critical SSRF vulnerability (CVE-2026-20230)?

Three days from the directive issuance, including the weekend Immediate patching within 24 hours due to active exploitation No specific timeline; agencies were advised to patch at their discretion One week from the directive issuance

Question 3: What role does OpenAI's 'Patch the Planet' initiative, powered by Daybreak, play in improving open-source security?

Question 3

What role does OpenAI's 'Patch the Planet' initiative, powered by Daybreak, play in improving open-source security?

Pairs AI-assisted security research with expert human review to identify, validate, and help patch vulnerabilities in critical open-source software Focuses exclusively on identifying vulnerabilities in Microsoft Windows 10 ESU Automates vulnerability discovery and patch deployment without human involvement Functions as an AI-based competitive analysis tool for proprietary software companies

Question 4: What was a significant privacy and security issue with Meta's 'Model Capability Initiative' as discussed in the episode?

Question 4

What was a significant privacy and security issue with Meta's 'Model Capability Initiative' as discussed in the episode?

Meta used only anonymized aggregate data to train AI models, preventing any privacy concerns The program was voluntary and only activated during non-working hours to protect privacy Employees' keystrokes, mouse activities, and screen content were collected and exposed internally due to misconfigured access controls Meta exclusively monitored contractors rather than employees, which created regulatory loopholes

Question 5: According to the episode, how does the 'looping' or 'iterating' approach improve AI-driven tasks such as vulnerability discovery or code generation?

Question 5

According to the episode, how does the 'looping' or 'iterating' approach improve AI-driven tasks such as vulnerability discovery or code generation?

By repeatedly feeding the AI's outputs back into itself to refine and improve the results over iterations By hard-coding deterministic rules to ensure repeatability of AI outputs By discarding initial AI results and restarting the process anew each time to avoid bias By running multiple different AI models in parallel and selecting the best output once

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.