Active Exploits on Fortinet and Citrix Devices
by Artie Kaye

Fortinet’s SSL-VPN has a flaw that could allow arbitrary code execution. The company has released a patch to address the problem. The flaw is listed as CVE-2022-42475.
https://www.fortiguard.com/psirt/FG-IR-22-398

Citrix ADC and Gateway network devices have a vulnerability which could allow remote code execution. The NSA has observed Citrix devices as a prolonged target by threat actors and released a statement with advice and suggestions. There is a patch available to address this problem. The flaw is listed as CVE-2022-27518.
https://support.citrix.com/article/CTX474995/citrix-adc-and-citrix-gateway-security-bulletin-for-cve202227518
https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF

https://www.securityweek.com/fortinet-ships-emergency-patch-already-exploited-vpn-flaw

https://www.securityweek.com/nsa-outs-chinese-hackers-exploiting-citrix-zero-day

https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-citrix-adc-and-gateway-zero-day-patch-now/

Windows End of Service Announcement
by Artie Kaye

Microsoft has rolled out their final service update for the 21H1 version of Windows 10. No more patches, or security updates will be made available from the company after this. To continue to get support updating Windows 10 to 21H2 is advised. Additionally in January 2023, Windows 7’s extended support will end, and 8.1’s regular support will terminate as well.

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/reminder-end-of-servicing-for-windows-10-version-21h1/ba-p/3671327

https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-10-21h1-has-reached-end-of-servicing/

https://www.neowin.net/news/windows-10-version-21h1-reaches-its-end-of-support/