Security research, tutorials, and product updates from the Retrievy team

Threat Intel

Jun 17, 2026 6 min read

FortiGate SSL Inspection: What to Decrypt, What to Bypass, and How to Audit It

Full SSL inspection on FortiGate breaks more than it secures if you skip the exemption design. This Q&A covers cert distribution, CA pinning failures, regulated-traffic bypasses, and a baseline policy pattern that survives an audit.

R

Retrievy Team

Read Now

Threat Intel

Jun 15, 2026 2 min read

Kerberoasting in 2026: Why This Attack Still Works on Your AD

Kerberoasting persists because most environments still have SPN-mapped service accounts with RC4 enabled and passwords that have not rotated in years. Here is what continuous ISPM monitoring catches and what good looks like.

R

Retrievy Team

Read Now

Threat Intel

May 28, 2026 3 min read

Storm-2697's Go Ransomware Spreads Itself Across Your Entire Network

The Gentlemen ransomware, deployed by Storm-2697 affiliates, is a Go-based encryptor that combines ephemeral per-file key encryption with aggressive built-in lateral movement to self-propagate across networks without operator intervention.

R

Retrievy Team

Read Now

Threat Intel

May 21, 2026 3 min read

YellowKey CVE-2026-45585 Bypasses BitLocker Before a Patch Lands

Microsoft has issued a mitigation for CVE-2026-45585, a publicly disclosed BitLocker bypass zero-day dubbed YellowKey, while a full patch is still pending. CVSS 6.8 understates the risk for encrypted-disk-dependent security models.

R

Retrievy Team

Read Now

Threat Intel

May 19, 2026 4 min read

Ivanti, Fortinet, SAP, VMware, n8n Drop Patches for Critical RCE and Privilege Flaws

A coordinated wave of security fixes hits five major vendors, led by a CVSS 9.6 flaw in Ivanti Xtraction. Patch queues just got longer.

R

Retrievy Team

Read Now

Threat Intel

May 18, 2026 3 min read

MiniPlasma Zero-Day PoC Drops: Unpatched Windows SYSTEM Escalation

A researcher-released PoC exploit dubbed 'MiniPlasma' achieves SYSTEM-level privilege escalation on fully patched Windows systems, with no vendor fix available yet.

R

Retrievy Team

Read Now

Threat Intel

May 14, 2026 4 min read

Microsoft's 138-Patch Drop Puts DNS and Netlogon RCE Front and Center

Microsoft's latest Patch Tuesday delivers fixes for 138 CVEs — 30 rated Critical — with remote code execution flaws in DNS Server and Netlogon demanding immediate operator attention.

R

Retrievy Team

Read Now

Threat Intel

May 14, 2026 4 min read

Two New Windows Zero-Days Target BitLocker and CTFMON Privilege Escalation

A researcher known as Chaotic Eclipse has dropped two unpatched Windows zero-days — dubbed YellowKey and GreenPlasma — hitting BitLocker's encryption guarantees and CTFMON's privilege boundary.

R

Retrievy Team

Read Now

Threat Intel

May 13, 2026 4 min read

AI-Generated Zero-Day Exploit Bypasses 2FA at Scale in the Wild

Google has identified a threat actor using a zero-day exploit likely built with AI assistance — the first confirmed in-the-wild use of AI for vulnerability discovery and exploit generation, targeting 2FA mechanisms.

R

Retrievy Team

Read Now

Threat Intel

May 13, 2026 3 min read

Critical RCE Vulnerabilities Hit FortiSandbox and FortiAuthenticator: Patch Now

Fortinet has disclosed critical remote code execution flaws in FortiSandbox and FortiAuthenticator. Operators running either product should treat patching as an emergency change.

R

Retrievy Team

Read Now

Threat Intel

May 11, 2026 4 min read

Password Resets Alone Won't Evict Attackers From Active Directory

Cached credentials and live Kerberos tickets mean a compromised AD account stays exploitable long after a password reset. Here's what operators need to do instead.

R

Retrievy Team

Read Now

Threat Intel

May 09, 2026 3 min read

CISA's Four-Day Ivanti EPMM Deadline Should Reset Your Patch Clock Too

CISA ordered federal agencies to patch an actively exploited Ivanti EPMM zero-day within four days. If you run EPMM in any environment, that timeline should be yours as well.

R

Retrievy Team

Read Now