2026-06-18: FortiBleed exposes 73,000 Fortinet VPN credentials to a Russian-speaking threat group targeting

Show Notes - 2026-06-18

Stories Covered

• June 18, 2026
• Today:
• Joomla Content Editor Plugin Zero-Day (CVE-2026-48907) [Critical Alerts]
• FortiBleed: 73,000 Fortinet VPN Credentials Exposed [Critical Alerts]
• Fortinet FortiSandbox Vulnerabilities Under Active Exploitation [Critical Alerts]
• Microsoft Defender Zero-Day RoguePlanet (CVE-2026-50656) [Critical Alerts]
• INC Ransomware Reaches 800+ Victims Through Basic Tactics [Ransomware & Extortion]
• DragonForce Ransomware Deploys Custom Backdoor Using Microsoft Teams Infrastructure [Ransomware & Extortion]
• EdTech Sector Faces Escalating Ransomware and Data Breach Activity [Ransomware & Extortion]
• Mastra npm Supply Chain Attack Poisons 140+ Packages [Business & Infrastructure Threats]
• Account Takeover Attacks Rising Through Session Hijacking and MFA Bypass [Business & Infrastructure Threats]
• CASB Blind Spot: QUIC Protocol Bypasses Web Traffic Inspection [Business & Infrastructure Threats]
• Crypto Clipper Malware Uses Tor and Worm-Like Propagation [Windows / AD Security]
• Office Apps Experiencing Launch Issues After June Updates [Windows / AD Security]
• Interpol: Cyber Offenses Account for One-Third of Crime in Asia-Pacific [General Security News]
• Junior Hacker Uses Tailscale and OpenSSH for Backup Persistence [General Security News]
• CVE-2026-48854: Elixir gRPC Unbounded Request Body Memory Exhaustion [Vulnerability Disclosures]
• Coordinated SSH Brute Force Attacks Over Three Months [Vulnerability Disclosures]

CVEs Referenced

CVE-2023-3519, CVE-2023-48788, CVE-2024-57727, CVE-2025-5777, CVE-2026-25089, CVE-2026-33825, CVE-2026-39808, CVE-2026-39813, CVE-2026-41091, CVE-2026-45498, CVE-2026-48854, CVE-2026-48907, CVE-2026-50656

Indicators of Compromise

IP Addresses: 2.9.99.6

Read the full brief