Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CVE-2026-26035 is an improper authentication vulnerability (CWE-287) in Fortinet FortiWeb, disclosed by Fortinet on August 12, 2026 in advisory FG-IR-26-158 under the title “Broken access control in the RADIUS type admin group.” The flaw sits in FortiWeb’s remote RADIUS administrator authentication path, where the appliance fails to correctly validate an administrative login before granting access.

CVE-2026-71362 is an incorrect authorization vulnerability (CWE-863) in Adobe Commerce and Magento Open Source, caused by the platform failing to correctly bind a customer identity to an account session. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical). Exploitation requires no authentication. Adobe’s advisory states that the flaw is exploitable without credentials, does not require administrator privileges, and does not require user interaction.

As quantum computing develops, cybersecurity professionals are getting ready for a breakthrough in the protection of digital information. The conventional public-key cryptographic algorithms that ensure the security of digital signatures may, in the long run, be compromised by the revolutionary power of quantum computers. To minimize that risk, Google Cloud has announced general availability of the quantum-safe digital signature feature in its Google Cloud Key Management Service (Cloud KMS).

An initial access broker for ransomware gangs is targeting organizations with voice phishing (vishing) attacks through Microsoft Teams, according to researchers at Zscaler’s ThreatLabz. “From January through June 2026, ThreatLabz examined a cluster of related campaigns that used Microsoft Teams vishing and Quick Assist for initial access, followed by PowerShell-based staging,” the researchers write.

As a CISO advisor, I am observing a familiar pattern gaining a new, critical dimension. What we historically identified as "Shadow IT", the use of unapproved SaaS and tools, is rapidly evolving into "Shadow AI." Employees are increasingly leveraging AI bots for drafting, analysis, code generation and strategic decision-making.

Zero-Shot Learning is a podcast about how AI gets built, secured, and deployed. Hosted by Nancy Wang, 1Password CTO, and Dev Tagare, Senior Director of Engineering at Google, it’s a builder’s view of the architecture and the complex decisions it takes to ship with AI. This episode features guest co-host Richard Liu, Head of API Products at Anthropic, who sits in for Dev.

Let’s catch up on the more interesting vulnerability disclosures and cyber security news gathered from articles across the web this week. This is what we have been reading about on our coffee break! A very curious breach – the question what did they do?

Netwrix's 2026 research found a 4x gap in breach rates between organizations where AI has significantly grown their identity count and those where it hasn't. Static credentials are AI’s easiest way in: passwords, keys, and tokens that never expire and never get checked. AI didn't invent the over-privileged credential, it just found the fastest way to use one.

AI agent security is an identity problem, but it often starts as a secrets and credential problem. Do your AI agents operate using static API keys, tokens, and other reusable credentials? They might bypass traditional identity controls, creating a governance blind spot.

For years, many business email compromise (BEC) investigations have followed a familiar playbook: an attacker phishes credentials, logs into the victim's mailbox, establishes persistence with inbox rules, monitors communications, and waits for an opportunity to steal money or sensitive information. Today, we're seeing something different at LevelBlue. Across multiple recent investigations, we've observed attackers treating a compromised mailbox as just the first step.