WAF Protect | F5 ASM & FortiWeb Training

CyberInsights Today · Vulnerability analysis · By Harpreet Singh Public CVE disclosure November 6, 2026. Evidence checked November 9, 2026. Summary. If you run SonicWall SSL VPN with SAML, check the firewall firmware and which login methods the gateway accepts. On an affected gateway, valid credentials for an alternate authentication method can let a user bypass the SAML checks and potentially the multifactor authentication (MFA) that SAML enforces. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6. CVE record · CISA KEV entry How the login control fails SSL VPN is a remote access service. SAML lets an identity provider tell the VPN that a user has signed in and satisfied the configured policy. In a deployment that requires MFA through that provider, a login accepted through an alternate method can avoid the policy if SonicOS fails to enforce the intended authentication path. SonicWall’s CVE description specifies valid credentials for the alternate me...

CyberInsights Today · Educational bulletin · By Harpreet Singh Sources checked November 8, 2026. OWASP documents BOLA in its 2023 API Security Top 10. This bulletin covers a vulnerability class. A disclosure date, affected or fixed versions, CVE, CVSS score and exploitation status apply to a specific incident or product advisory. Summary. A user can be allowed to open an invoice screen and still be forbidden from opening a particular invoice. If your API checks the login but skips that second decision, another customer's records could be exposed or changed. What goes wrong Authentication establishes who is calling. Authorization decides what that caller can do. An object is a record or resource such as an invoice, file, or support ticket. Broken object-level authorization (BOLA) happens when the API accepts a reference to an object and fails to check the caller's permission for the requested action on that exact object. Insecure direct object reference (IDOR) is a common w...

CyberInsights Today · Vulnerability analysis By Harpreet Singh Virdi, CISSP, CCSP Vendor disclosure and security release October 28, 2026. Evidence last checked November 7, 2026. Check how your WordPress site applies a core update before you start one. CVE-2026-119977 can expose a temporary installer while affected WordPress code unpacks a full update package. If you can quickly restrict public access to the staging directory, put that protection in place before upgrading. Then verify the fixed version on every instance that serves traffic. What the upgrade exposes Think of a WordPress upgrade as a delivery. The updater unpacks the replacement files in a staging area before moving them into place. Affected versions can unpack a full core package into a predictable directory within the web server’s reach. The package includes installer files that can respond directly to HTTP requests. A remote visitor who reaches the installer while the staging area exists may gain code execution und...

CyberInsights Today · Vulnerability analysis By Harpreet Singh Virdi, CISSP, CCSP Published and evidence checked: November 6, 2026. Vendor disclosure: November 3, 2026. A switch can keep forwarding traffic while its management interface remains vulnerable. Start with the exact model and complete firmware identifier. A version that simply says “2.90” is not enough to close this issue. What happened Zyxel identifies CVE-2026-107441 as an out-of-bounds write in the GS1900 web interface’s CGI program. CGI is the component that processes web requests. An unauthenticated attacker with LAN access can send a crafted HTTP request that may lead to operating-system command execution. Zyxel advisory, November 3 . In plain English, software writes beyond the memory area intended for that operation. The advisory does not publish the exact request field or memory layout. This article therefore explains the trust boundary and prerequisites without inventing an exploit sequence. Conceptual threat path ...

CyberInsights Today · Educational bulletin By Harpreet Singh Virdi, CISSP, CCSP · November 5, 2026 References checked on November 5, 2026. Your application can fetch an image, preview a link or send a webhook. Each feature lets data from a user influence a request made by your server. The security question is which destinations that server is permitted to reach.

CyberInsights Today · Additional threat analysis By Harpreet Singh Virdi, CISSP, CCSP Published and evidence checked on November 5, 2026. Start with a simple question. Where does your organisation turn Brotli-compressed data back into readable content? That may happen in a public API, a background worker, an outbound HTTP client or a proxy. Each decoding point needs an owner and a patch decision. CVE-2026-111497 is a memory-corruption vulnerability in Google's Brotli decoder. Google published a fixed release on October 21, 2026. Its release notes describe an out-of-bounds write with potential remote code execution. Google Brotli release notes .

CyberInsights Today · Educational bulletin · November 4, 2026 The patch dashboard says “installed.” Your application still has an old worker serving requests. Both can be true. Before you close a vulnerability ticket, check the software that actually handles traffic and account for every instance that can return to service.

By Harpreet Singh Virdi, CISSP, CCSP · Cybersecurity Updates Published and evidence checked: November 3, 2026. If you run PHP, start with an inventory and a patch decision today. If a security appliance uses PHP internally, check its vendor advisory too. Updating your website code alone does not update the runtime inside a firewall. PHP2Shell is the name used for CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution without authentication. PHP released security updates on October 21. The PHP team identifies web-serving installations as at risk and highlights Apache mod_php as the highest-risk configuration. PHP security announcements .

WAF PROTECT TRAINING Choose your WAF training block Learn web application security in English through structured lessons, practical labs and knowledge checks. Choose a product below; each block has its own course guide and 17 separate lessons. F5 ASM 17 lessons · Beginner to advanced BIG-IP traffic flow, security policies, staging, learning, signatures, parameter constraints, false-positive tuning, API protection, logs, HA and recovery. Open F5 ASM training → FortiWeb 17 lessons · Beginner to advanced Deployment modes, virtual servers, server policies, protection profiles, signatures, constraints, machine learning, logs, API security, bot defense and recovery. Open FortiWeb training → Start with understanding, then configure Each course uses a fictional bookshop so you can follow a request from the browser to the application. Lessons define unfamiliar terms, explain the relevant control, give a bounded lab, and ask you to interpret the result. Begin with Lesson 01 in your chosen block....

FORTIWEB TRAINING BLOCK Learn FortiWeb from the ground up 17 instructor-led lessons in English, from WAF fundamentals to advanced operations. With Harpreet Singh Virdi, CISSP, CCSP Start here: no prior FortiWeb experience required We follow a fictional bookshop through a reverse-proxy lab. Each lesson is a separate post with explanations, a practical exercise, expected results, and an instructor knowledge check. Learn FortiWeb's own server-policy, protection-profile, and rule relationships. This course covers FortiWeb appliance/VM administration. Firmware, licenses, platforms, and operating modes affect features. References use 8.0.x examples; follow documentation for your actual build. This is not a recommendation to deploy a specific release. How to study Read in numerical order and keep a lab notebook. Use a licensed, isolated, authorized lab with synthetic data. Record the configuration and actual result for each test. Compare observations with expected outcomes and investigate...

FORTIWEB CLASSROOM • LESSON 17 Level: Advanced practical assessment · Study and lab: 120 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block Your final classroom assignment Protect the fictional bookshop using an isolated FortiWeb reverse-proxy lab. Demonstrate that you understand both the traffic path and the security decisions. The assessment measures evidence and reasoning; reading the series alone does not establish operational mastery. Prepare your evidence pack Include the topology, firmware/build, licensed capabilities, server policies, protection-profile references, application input contract, sanitized events, regression table, exceptions, and recovery procedure. Use synthetic accounts and test data. Task 1: prove traffic selection Show the virtual server, service, origin pool, and selected server policy. Explain client-side and origin-side TLS. Demonstrate that test traffic goes through FortiWeb rather than directly to the...

FORTIWEB CLASSROOM • LESSON 16 Level: Advanced · Study and lab: 75 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block Automation should make changes reviewable Repeated manual edits become hard to compare as applications grow. A controlled automation workflow records the intended change, its dependencies, the deployed version, and the tests proving its behavior. It does not decide whether a security exception is justified. Choose supported interfaces Use the FortiWeb CLI, backup/import workflows, or RESTful API documented for your exact version and platform. Endpoint names, authentication, writable properties, and deployment behavior can differ. This lesson deliberately provides a workflow rather than an unverified API script. Use a supported limited-permission deployment identity and proper TLS certificate validation. Keep tokens, credentials, private keys, sensitive exports, and real customer payloads out of public repositories. ...

FORTIWEB CLASSROOM • LESSON 15 Level: Advanced · Study and lab: 90 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block Make the change recoverable A successful lab request is not a complete production-readiness test. The bookshop needs browsing, login, checkout, administrative, mobile, and API workflows to work. Protection must also survive failure and recovery. Write the rollout plan Record the firmware, licensed capabilities, server-policy scope, active profile, rule actions, shared objects, exceptions, learning status, and regression results. Define service indicators such as transaction success and latency alongside security detections. Identify the operator, application owner, monitoring destination, and rollback trigger. Observe representative business activity before enforcing a newly introduced check. A quiet period does not prove coverage of batch jobs or uncommon workflows. Use limited exposure where the architecture suppo...

FORTIWEB CLASSROOM • LESSON 14 Level: Advanced · Study and lab: 90 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block Different abuse patterns need different controls A well-formed request can still contribute to abuse. Repeated login guesses, unwanted automation, forged browser actions, and resource exhaustion are separate problems. Start by defining the threat and the legitimate clients before choosing a response. Login and session context Document how the application reports successful and unsuccessful authentication. Some applications return the same status code for both. Tracking can help correlate activity, but an IP address or client-supplied field is not automatically a reliable user identity. CSRF concerns unwanted authenticated browser actions. Coordinate the application's token, cookie, and origin defenses with supported FortiWeb CSRF protection. Browser-oriented features may depend on page processing or cookies and ...

FORTIWEB CLASSROOM • LESSON 13 Level: Intermediate to advanced · Study and lab: 75 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block Protect the message and its contract An API request may be valid HTTP but carry invalid application data. Our bookshop accepts an order containing a numeric book identifier and quantity. JSON parsing, schema validation, authentication, and order ownership answer different questions. POST /api/orders Content-Type: application/json {"bookId":42,"quantity":1} A parser can recognize this as valid JSON without proving the quantity is permitted or the caller owns the account. Define the contract with developers before selecting protections. Choose the appropriate feature FortiWeb offers JSON, XML, and OpenAPI-related protections in supported releases. Associate the relevant policy with the active protection profile. Check content-type handling, URL scope, parser selection, action, and ...

FORTIWEB CLASSROOM • LESSON 12 Level: Intermediate · Study and lab: 75 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block Restore legitimate behavior without losing the requirement A book title containing punctuation triggers a security check. The correct response is to investigate the exact detection and valid application behavior. Do not start by disabling a category or trusting a whole network. A five-step method Reproduce the smallest synthetic case. Locate the actual rule or signature. Validate the intended input with the application owner. Scope the change to the necessary location. Retest valid and invalid requests. An access violation, protocol constraint, signature match, and ML anomaly may require different remedies. An exception for one engine does not necessarily change another engine's decision. Worked example The search endpoint legitimately accepts apostrophes, but an inventory identifier does not need the s...

FORTIWEB CLASSROOM • LESSON 11 Level: Intermediate · Study and lab: 60 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block Investigate one request at a time A user reports that checkout failed. Before editing security settings, determine whether FortiWeb, the application, or another component rejected the request. A status code and a screenshot are useful starting points, but they do not identify the cause. Know the log families Attack logs describe security detections. Traffic logs help explain requests and responses when enabled. Event logs describe system or administrative activity. Storage, severity filters, destinations, and feature settings determine what is available. An empty view does not prove a request was allowed. Read an attack event in order Confirm time, timezone, device, hostname, URL, method, and server policy. Read the action actually taken. Identify the attack type, rule, signature ID, or constraint involved. Insp...

FORTIWEB CLASSROOM • LESSON 10 Level: Intermediate to advanced · Study and lab: 75 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block A model learns from what it sees Our bookshop has search, login, cart, and order workflows. If the learning traffic contains only homepage requests, it does not represent the application. If it includes uncontrolled hostile traffic, undesirable patterns may influence the model. Machine learning needs traffic quality and review. Understand the purpose FortiWeb's ML-based anomaly detection learns characteristics of application input and looks for deviations. It is different from a static signature match and different from manually defining an input contract. Other learning and profiling workflows may exist in your release; inspect which mechanism is actually enabled. A trained model is not proof that every business function was covered or every learned value is safe. Learning milestones and sample ...

FORTIWEB CLASSROOM • LESSON 09 Level: Intermediate · Study and lab: 60 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block Control structure and resource use Not every harmful request contains a familiar attack string. A malformed header, oversized body, unexpected cookie change, or unsafe upload can violate the application's requirements. Choose the control that addresses the actual problem. HTTP protocol constraints Protocol constraints check supported aspects of message structure and size. Limits must fit the application and the appliance's inspection design. A small public search and a permitted document upload may need very different body-size handling. Do not assume a body was fully inspected merely because a connection succeeded. Understand configured request limits, scan-buffer behavior, parsing, and feature support for large inputs. Test both sides of every boundary you configure. Cookie integrity Some cookies carry...

FORTIWEB CLASSROOM • LESSON 08 Level: Intermediate · Study and lab: 75 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block Describe expected application behavior A signature recognizes suspicious patterns. An application-specific access or validation rule describes what should be allowed. For our bookshop, an order endpoint and a search field have different input requirements. A single permissive pattern does not express both contracts well. Write a contract before a rule Endpoint Intended behavior Test examples /search Search text with agreed length and character handling Normal text, punctuation, overlength input /api/orders Supported method and structured order fields Valid body, wrong method, wrong data type /admin Restricted administrative access Approved and unapproved access paths Different modules express different conditions. A URL access rule may match a hostname, path, source, method, or parameter condition as configured....

FORTIWEB CLASSROOM • LESSON 07 Level: Intermediate · Study and lab: 60 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block Recognize what the protection is looking for SQL injection and cross-site scripting are different application weaknesses. SQL injection lets unsafe input alter a database query. XSS causes untrusted content to be interpreted as executable browser content in an unsafe context. WAF checks provide a protective layer, while developers address the underlying coding flaws. Parameterized database queries are a primary SQL-injection defense. Safe rendering and context-appropriate output handling are central XSS defenses. Do not describe a WAF as a permanent replacement for these controls. What a signature match means A signature identifies a pattern associated with a threat. A signature policy selects and configures checks. An alert indicates a match under the applicable settings, not proof that the target application i...

FORTIWEB CLASSROOM • LESSON 06 Level: Intermediate · Study and lab: 60 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP FortiWeb course guide · FortiWeb training block Make the security decision explainable “The policy is enabled” is not a complete explanation of protection. You need to know which server policy matched, which web protection profile it uses, which checks are referenced, and what actions those checks perform. A rule must be connected to traffic FortiWeb separates reusable security configuration from the server policy receiving traffic. A protection profile can reference signature, protocol, access, and other protection policies. An unused object has no effect on a request merely because it exists in the configuration. Reuse has consequences. Editing a shared object can affect several applications. Before changing a rule, inspect its references. Clone a predefined or shared object when a separate lab/application policy is appropriate. Actions are not topology For...