Sunday 18 Oct · Tessellate Pay
Good morning, Kelvin
You’re a B · 812, ahead of your vendors on average. One thing can’t wait, and this morning’s fix is being checked now.
Dark web · posted on Thursday · FortiGate SSL VPN, Nigerian payments company, $1,800
Someone is selling access to your VPN
A seller is offering a way into a FortiGate VPN that matches yours. Your vpn host runs FortiOS 7.0.12, which attackers are using right now, and Tunde’s VPN login turned up in a stealer log. Patch the VPN and reset Tunde’s logins today; that closes the door they’re selling.
You
How Tessellate Pay is holding up
External grade from our scans of your domains · the last 90 days
812 / 1000
Good · up 41 since Jul
Your vendors
C · 798
On average, below you
If today's fix holds
B · 838
The rescan is checking now
To reach A
88 points
Fix the proven ones first
Your vendors
Who you depend on
Five vendors · on average C · 798
ContaboAsk for a fix · nowWeakDown 94 this weekD
SeamlessHRAsk about a contradicted answer · nowFairSteadyC
MixpanelProduct analyticsGoodSteadyB
Smile IDReview · due on 8 NovGoodUp 28B
TermiiRule on their dispute · due tomorrowStrongSteadyA
Worth knowing
- Cloudflare sits under four of them, and under you. One bad day there reaches Smile ID, Termii, Mixpanel, Contabo and you at once.
- SeamlessHR holds staff pay and bank details and is held at C by one serious flaw on their side. Fixing it is worth a whole letter.
Needs you now
What to do first, across everything
Your scans, code, the dark web, pentests and vendors in one list · most urgent first
- CriticalAWS access key committedCode · payments-apiChidi2 days late
- CriticalAny merchant can read another merchant's payoutsPentest · pentestChidi9 days late
- CriticalFortiOS 7.0.12, affected by CVE-2024-21762Scan · vpnYouIn 1 day
- CriticalAccess to your VPN is for saleDark web · access for saleNo one yetIn 4 days
- HighAsk Contabo to fix what dropped them to DVendors · hosts your websiteSeyiNow
- CriticalCard numbers written to the application logsCode · payments-apiIfeoma8 days late
Lately
What changed
The last ten days, across your domains, code, the dark web and vendors
- A rescan of tessellatepay.com started, to confirm the fix from outsideScan · Today, 10:19
- PR #488 merged: the SSRF fix is live on payments-apiCode · Today, 08:52
- Access to a VPN matching yours went up for sale, for $1,800Dark web · On Thursday, 21:14
- Contabo dropped to D: an expired certificate and two open cPanel loginsVendors · On Tuesday, 00:00
- The weekly scan proved an SSRF on api.tessellatepay.comScan · On Monday, 02:47
- Smile ID fixed SPF and DMARC on smileidentity.comVendors · On 9 Oct, 14:05
Coming up
What happens next
Scans, fix-by dates and what vendors owe you
- NowRescan of tessellatepay.com, confirming PR #488 from outside
- Tomorrow, 01:00Nightly rescans of all five vendors
- Tomorrow, 02:00Weekly scan of tessellatepay.com
- TomorrowFix-by for the FortiOS flaw on your VPN
- SaturdaySeamlessHR's questionnaire is due, 9 of 14 answered
- 5 NovDeep scan of tessellatepay.com. It falls after tessellatepay.com's authorisation ends, so it won't run unless it's renewed.