Security Roundup & FortiGate Deep Dive - Issue #2

This Week at CosmicBytez Labs

Welcome back! Issue #2 is packed with practical guides and security intelligence to keep you ahead of the curve.

Security Alert: Critical Vulnerabilities

D-Link Router RCE (CVE-2026-0625)

A critical remote code execution vulnerability affects D-Link DIR-series routers. Attackers can execute arbitrary commands without authentication via a crafted HTTP request to the management interface.

CVSS Score: 9.8 (Critical)

Affected Models:

DIR-605L (all firmware versions)
DIR-615 (firmware < 20.07)
DIR-825 (firmware < 3.0.1)

Mitigation: D-Link has released firmware updates. If updates aren't available for your model, disable remote management immediately.

Full advisory →

Cisco Webex Vulnerability

Cisco disclosed a high-severity vulnerability in Webex Meetings that allows authenticated users to escalate privileges and access other tenants' meeting data.

Action Required: Update Webex clients to the latest version.

New Project Guides

FortiGate SD-WAN Deployment

Enterprise SD-WAN with FortiGate featuring:

Dual ISP failover and load balancing
Performance SLAs with health checks
Application-aware traffic steering
ADVPN overlay for dynamic mesh VPN
Zero Trust integration with ZTNA

This is a comprehensive guide covering everything from initial configuration to FortiManager integration for multi-site deployments.

View project →

Azure Sentinel SIEM Implementation

Deploy Microsoft Sentinel as your cloud-native SIEM with:

Data connectors for Microsoft 365, Azure, and third-party sources
Analytics rules aligned with MITRE ATT&CK
Custom workbooks for security dashboards
SOAR playbooks for automated response

View project →

New HOWTOs This Week

We've published 12 new tutorials covering everything from Intune Autopilot to incident response:

Microsoft Admin

Security Operations

Kubernetes & DevOps

Cloud Infrastructure

Fortinet

RMM & Automation

NinjaOne PowerShell Automation

KQL Query of the Week

Detect impossible travel scenarios in Azure AD:

let timeThreshold = 1h;
let distanceThreshold = 500; // km
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| extend City = tostring(LocationDetails.city)
| extend Country = tostring(LocationDetails.countryOrRegion)
| extend Lat = toreal(LocationDetails.geoCoordinates.latitude)
| extend Lon = toreal(LocationDetails.geoCoordinates.longitude)
| sort by UserPrincipalName, TimeGenerated
| extend PrevLat = prev(Lat, 1), PrevLon = prev(Lon, 1), PrevTime = prev(TimeGenerated, 1)
| extend PrevUser = prev(UserPrincipalName, 1)
| where UserPrincipalName == PrevUser
| extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime)
| extend Distance = geo_distance_2points(Lon, Lat, PrevLon, PrevLat) / 1000
| where TimeDiff < 60 and Distance > distanceThreshold
| project TimeGenerated, UserPrincipalName, City, Country, Distance, TimeDiff

Tool Spotlight: Trivy

Trivy is a comprehensive security scanner for containers, filesystems, and IaC:

# Scan container image
trivy image nginx:latest
 
# Scan Terraform files
trivy config --severity HIGH,CRITICAL ./terraform/
 
# Generate SBOM
trivy image --format spdx nginx:latest > sbom.json

Integrate with GitHub Actions:

- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'

Community Highlight

Special thanks to everyone who subscribed this week! Your feedback and engagement help shape the content we create.

Have a topic you'd like covered? Reply to this email or reach out on the website.

What's Coming Next Week

SentinelOne deployment guide
NinjaOne RMM platform setup
Cove Data Protection implementation
More security advisories

Stay secure!

Dylan H. CosmicBytez Labs