Major Incidents or Breaches

  • A data leak dubbed “FortiBleed” has exposed VPN credentials for 73,932 Fortinet and FortiGate firewall URLs at organizations worldwide. Attackers have compiled working credentials for tens of thousands of compromised devices across nearly 200 countries, actively targeting various sectors [11][18].
  • Kodak has confirmed a data breach following claims by the ShinyHunters hacking group. The company states there is no threat to its systems or operations as a result of the incident [24].
  • Researchers discovered an exposed collection of 24 billion stolen records online, including usernames, passwords, and other sensitive account data [34].
  • Roblox developers have been targeted by attackers using fake job offers and malware to steal accounts, Robux, and entire Roblox games [32].

Newly Discovered Vulnerabilities

  • Microsoft has confirmed a zero-day vulnerability in Defender, codenamed RoguePlanet, which allows privilege escalation via a race condition. A patch is in development and public proof-of-concept code is available. The vulnerability is tracked as CVE-2026-50656 [4][30].
  • The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited [15].
  • Rockwell Automation has released patches for vulnerabilities affecting Logix, CompactLogix, Flex, RSLinx, and FactoryTalk industrial control system products [28].
  • Oracle has issued its June 2026 Critical Security Patch Update, addressing 245 vulnerabilities across multiple products, including Communications, EBS, and Enterprise Manager [31].

Notable Threat Actor Activity

  • A coordinated malware campaign has published at least 15 malicious plugins on the JetBrains Marketplace, exfiltrating AI API keys and other sensitive data. Additionally, malicious Chrome extensions are capturing chatbot conversations [7].
  • An unknown threat actor is leveraging paid or promoted posts on legitimate news websites, fake reviews, AI narrators, and comments on VirusTotal to promote a crypto clipper malware campaign [3].
  • A French-speaking attacker compromised a small French automotive business, planted a keylogger, and maintained persistence using Tailscale and OpenSSH after their command-and-control infrastructure went offline [5].
  • The DragonForce ransomware group deployed a Go-based backdoor that uses Microsoft Teams relay servers for command-and-control in a recent attack [29].
  • The INC ransomware group continues to target sectors where operational disruption puts immediate pressure on victims to pay, such as healthcare [17].

Trends, Tools, or Tactics of Interest

  • 85.8 percent of phishing attacks in the past 12 months were AI-driven, with threat actors increasingly using AI agents to automate social engineering [1].
  • Enterprise adoption of AI agents is creating security blind spots, with 83 percent of organizations lacking visibility into their AI agents’ activities and 86 percent lacking visibility into AI data flows [2].
  • There is a rise in account takeovers as attackers bypass traditional defenses using phishing, session hijacking, and MFA fatigue attacks [12].
  • Attackers are increasingly exploiting exposed admin panels, credential reuse, and non-zero-day vulnerabilities to gain initial access, as seen in recent attack surface exposure reports [8].
  • Coordinated SSH brute-force attacks remain prevalent, with attackers adapting their tactics over recent months [21].
  • Security researchers highlight that browser-based attacks may evade detection by traditional security tools, creating a “browser blind spot” [22].
  • Adversarial exposure validation is emerging as a method to help security teams prioritize which vulnerabilities to address, moving beyond simple visibility to actual validation of risk [6].
  • New Android malware, Rokarolla, can take full control of infected devices and targets over 200 banking and cryptocurrency apps to steal credentials [33].
  • Attackers are using fake job offers as a vector to deliver malware and compromise developer accounts in gaming platforms [32].

Regulatory or Policy Developments Affecting the Security Industry

  • From August 3, 2026, Google will use IP addresses from UK, EEA, and Switzerland users for ad measurement and personalization, as the UK Information Commissioner’s Office (ICO) considers new consent rules [10].
  • The EU has initiated the “Shield-6G” project to develop security measures for 6G networks, incorporating AI threat detection, digital twins, and honeypots [16].
  • The UK Home Office will implement facial age estimation technology for asylum-seeker age checks despite internal tests showing high risks of errors [19].

Sources#

  1. FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
  2. Sweeping Credential-Harvesting Heist Compromises 30K+ Fortinet Devices - darkreading.com
  3. Kodak Admits Data Breach After ShinyHunters Hack Claims - securityweek.com
  4. 24 billion stolen records exposed online. Here’s what to do - malwarebytes.com
  5. Roblox developers are losing entire games to malware attacks - malwarebytes.com
  6. Microsoft Confirms RoguePlanet Defender Zero-Day, Says Patch is in Development - thehackernews.com
  7. Microsoft Working on Patch for ‘RoguePlanet’ Zero-Day - securityweek.com
  8. CISA orders feds to patch max severity Joomla plugin flaw by Friday - bleepingcomputer.com
  9. Rockwell Automation Patches Vulnerabilities in ICS Controllers and Software - securityweek.com
  10. Oracle’s Second Monthly Security Updates Deliver 245 Patches - securityweek.com
  11. Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats - thehackernews.com
  12. Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments - thehackernews.com
  13. Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline - thehackernews.com
  14. Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack - securityweek.com
  15. INC Ransomware Thrives by Mastering the Basics - darkreading.com
  16. From 1% to 26%: How AIDA Orchestration Fixes the Remedial Training Gap - blog.knowbe4.com
  17. Best AI Agent Security Tools for SMB and Enterprise in 2026 - blog.knowbe4.com
  18. Why Account Takeovers Are Rising and How to Stop Them - bleepingcomputer.com
  19. The Top 10 Attack Surface Exposures in 2026 - thehackernews.com
  20. The Behavior of Coordinated SSH Brute Force Attacks over the last three months [Guest Diary], (Wed, Jun 17th) - isc.sans.edu
  21. The browser blind spot: Why your security tool may not be blocking what you think it is [Guest Diary], (Wed, Jun 17th) - isc.sans.edu
  22. Adversarial Exposure Validation Turns Security Visibility into Confident Prioritization - thehackernews.com
  23. Rokarolla Android malware can take over your phone and steal banking logins - malwarebytes.com
  24. Google to use UK and EU user IP addresses for ad personalization - bleepingcomputer.com
  25. EU Gets a Head Start in Developing 6G Network Security - darkreading.com
  26. The UK Will Scan Asylum-Seekers’ Faces for Age Checks—Despite Knowing the Tech Is Flawed - wired.com