standard

PBKDF2

Password-based key derivation function used with SHA-256 and 100,000 iterations to derive key and IV for the bundle.

Known aliases

Password-Based Key Derivation Function 2
PBKDF2-SHA256

Relationships

No evidence-backed relationships are recorded.

Current stories

security6 publishersConfirmed

FortiBleed keeps scanning exposed Fortinet firewalls as toll grows to 400,000-450,000 devices

The FBI and Secret Service warned Tuesday that FortiBleed is still scanning Fortinet firewalls and SSL VPN gateways with 86,644 stolen credentials. Patching and a password reset will not clear it.

Publishers:cyberscoop.comhelpnetsecurity.comscworld.comsecurityaffairs.comthehackernews.comtherecord.media

Perspective Coverage

6 publishers

Builder: Builder 22%
Operator: Operator 62%
Investor: Investor 16%

Reality

Evidence72
Adoption62
Hype gap+28
Incentives40
Confidence72

build1 publisherOne report

Outsourced Fortinet firewalls turn ACSC's rotate-everything advice into an ownership question

Australia's ACSC told Fortinet users on 18 June to rotate all admin and VPN credentials immediately, the first of six steps in its alert. On hosted or co-managed gateways, each step first needs someone to settle who holds the accounts and who has to act.

Publishers:dev.to

Reality

Evidence45
Adoption: Insufficient
Hype gap+5
Incentives: Insufficient
Confidence40

build1 publisherOne report

ACSC's Fortinet credential advisory leaves teams sizing exposure from internet scan counts

ACSC flagged credential attacks on Fortinet gateways with no CVE or version list, so scans counting 983,996 FortiGate assets are the sizing fallback. A certificate-key filter narrows the count to 254,801 but cannot show which admin logins face the internet.

Publishers:dev.to

Reality

Evidence45
Adoption65
Hype gap+5
Incentives: Insufficient
Confidence45

build1 publisherOne report

Grok built its own prompt injection: the filter never saw the payload

Adversa says it hid data-exfiltration instructions in AES-256-GCM ciphertext and let Grok decrypt them in its own Python sandbox. The plaintext version of the same attack was refused.

Publishers:thenewstack.io

Reality

Evidence42
Adoption20
Hype gap+22
Incentives68
Confidence44

build1 publisherOne report

A year of green backups hid 7 of 10 missing Android signing keys

A developer's nightly job reported success for over a year without once proving the archive could be opened. The first restore drill found most of the signing keys were never collected.

Publishers:dev.to

Reality

Evidence52
Adoption12
Hype gap+8
Incentives28
Confidence58