This week's threat report highlights authentication bypass issues in Fortinet and n8n, targeted espionage campaigns, attacks on software development tools, and Substack platform breach.
Fortinet released emergency security updates to address a critical authentication bypass vulnerability affecting FortiAnalyzer, FortiManager, FortiOS, and FortiProxy products. The vulnerability allows attackers to bypass authentication using an alternative path when the FortiCloud single sign-on login feature is enabled.
The US Cybersecurity and Infrastructure Security Agency added this vulnerability to its Known Exploited Vulnerabilities catalogue, confirming active exploitation in the wild. The flaw carries a CVSS score of 9.1, making it one of the most severe vulnerabilities disclosed this year. Attackers exploiting this weakness can gain unauthorised access to affected devices without valid credentials.
NHS organisations and UK businesses using Fortinet products for network security face significant risks from this vulnerability. FortiManager and FortiAnalyzer are commonly used for centralised management and logging across healthcare networks. FortiOS powers Fortinet firewalls that protect sensitive patient data and clinical systems. A successful exploit could allow attackers to bypass authentication controls entirely, gain administrative access to security infrastructure, monitor network traffic, modify security policies, and establish persistent access within the organisation.
For many certifications to show compliance, organisations must demonstrate effective vulnerability management and network security controls. The active exploitation of this flaw means it should be treated as a critical priority for patching and remediation.
Recommendations:
n8n disclosed multiple critical vulnerabilities that bypass security fixes implemented in December 2025. The flaws allow authenticated users with permission to create or modify workflows to execute arbitrary system commands on servers running n8n. The vulnerabilities carry a CVSS score of 9.4 and affect the expression evaluation component that processes workflow logic. Attackers can craft malicious workflow expressions to trigger unintended command execution.
Security researchers demonstrated that exploitation requires relatively little technical skill, with proof-of-concept attacks using short JavaScript snippets. The vendor warned that successful attacks could expose stored credentials, including API keys and tokens for cloud services, AI platforms, and internal systems.
The increasing use of workflow automation platforms like n8n to connect different systems, automate administrative tasks, and integrate AI services into clinical and business processes. These platforms typically store high-value credentials that grant access to multiple systems simultaneously. A compromised automation server could expose patient data systems, clinical applications, and cloud service credentials. For organisations using n8n Cloud, the hosted multi-tenant service, a successful exploit could potentially allow attackers to access other customers' data.
Automation platforms run continuously in the background, making breaches difficult to detect as workflows continue functioning normally while attackers extract sensitive information.
Recommendations:
The Russian state-sponsored threat group APT28 (also known as Fancy Bear) began exploiting a Microsoft Office vulnerability within 24 hours of its public disclosure in late January 2026. The attacks target European military and government entities, with a particular focus on maritime and transport organisations across Poland, Slovenia, Turkey, Greece, the United Arab Emirates, and Ukraine.
The vulnerability allows attackers to execute malicious code simply by opening a specially crafted Office document, without requiring macros or any user interaction beyond opening the file. APT28 uses phishing emails with geopolitically charged content about weapons smuggling, military training programmes, and emergency bulletins to trick targets into opening weaponised documents.
While these attacks primarily target European government and military organisations, UK businesses should remain vigilant. APT28 has a history of targeting NATO member states and their allies. The speed at which this group weaponised the Office vulnerability demonstrates the importance of rapid patching.
Supply chain organisations working with European partners may be particularly at risk. The attack chain uses legitimate cloud services for command and control, making detection more difficult. For organisations handling sensitive information or working with government contracts, the threat from state-sponsored groups requires enhanced security monitoring and staff awareness.
Recommendations:
Substack disclosed a security breach that remained undetected for months after an unauthorised third party accessed user data in October 2025. The incident was only discovered on 3 February 2026, giving attackers approximately four months of undetected access. The exposed information includes email addresses, phone numbers, and internal account metadata. Substack reports that passwords, credit card numbers, and financial data were not accessed.
A threat actor subsequently posted a dataset on a cybercrime forum claiming to contain nearly 700,000 user records, including names, email addresses, phone numbers, user IDs, and profile images. Substack has patched the vulnerability that allowed access and launched an internal investigation.
Organisations may be affected if staff use Substack for professional newsletters or communications. The extended period between breach and detection highlights the importance of continuous security monitoring and prompt incident detection. Email addresses and phone numbers from healthcare professionals could be used for targeted phishing campaigns, business email compromise attacks, or social engineering attempts. Healthcare organisations should be aware that compromised contact details may appear authentic if they match legitimate Substack subscriptions. The breach demonstrates third-party platform risks where staff use external services for professional communications.
Recommendations:
Want help staying ahead of threats like these? Contact Us about our Threat Intelligence services to keep your organisation informed about emerging risks and maintain compliance with DSPT and other regulatory requirements.