FortiMail CVE-2026-104286: Affected Builds, IBE Workaround
Fortinet says an unauthenticated file-write flaw in FortiMail is being exploited, and as of October 4, 2026 its advisory still lists the fixed builds …
All articles
Every FirewallSync article, newest first.
What Is a Zero-Day Vulnerability, and How Should You Actually Respond to One?
The term gets used loosely for anything urgent, but a zero-day specifically means a vulnerability being actively exploited before a fix exists — which …
Cloud Misconfiguration Checklists Don't Work — Here's What Does
Checklist-based cloud security reviews catch what's on the list and miss everything that changed since it was written. Drift detection closes the gap …
SSRF Explained: How Server-Side Request Forgery Works and How to Prevent It
Any feature that fetches a URL on a user's behalf lets that user borrow your server's network position. Here is how SSRF works, why URL filters keep …
Citrix NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772): Patch, Then Hunt
Two NetScaler ADC and Gateway flaws were exploited before Citrix disclosed them on September 27, 2026. Upgrading closes the hole. It does not tell you …
Symmetric vs Asymmetric Encryption: When to Use Each
Almost every real system uses both symmetric and asymmetric encryption together, each for the specific job it's actually good at. Understanding why …
Security Champions Programs That Don't Fizzle Out
Most security champions programs launch with energy and quietly die within two quarters. The failure pattern is predictable, and so is the fix.
What Is the CIA Triad, and Why It Still Shapes Security Decisions
Confidentiality, integrity, and availability are taught as a checklist. In practice they're better understood as three competing priorities that most …
The Vulnerability Backlog That Never Shrinks
Vulnerability backlogs grow faster than teams can patch because most programs measure the wrong thing: total count instead of exploitability and …
Logging for Incidents, Not for Dashboards
Most logging strategies optimize for building dashboards, then fail the one test that matters: can you reconstruct what happened during an actual …
Dependency Audits Without Slowing Down Releases
Most supply-chain security advice assumes you can afford to review every dependency by hand. Here's a tiered approach that scales with a normal …
Container Image Scanning: What CI Pipelines Still Miss
Image scanning in CI catches known CVEs in base layers, but most pipelines still ship vulnerable configs and secrets that scanners aren't tuned to …