Comparing 19 June 2026 with the previous day 18 June 2026.
FortiBleed is an active, Russian-speaking attack campaign targeting 86,644+ FortiGate devices globally, enabled by weak credential-management practices (default accounts, factory passwords), indicating direct perimeter compromise.
FortiBleed involves actively compromised systems with exposed VPN credentials from 73,000 devices globally and requires immediate password reset and access review for all Fortinet VPN users.
The BSI emergency notification at 2:30 AM underscores the severity of the vulnerability and indicates imminent exploitation or threat; this is a rare sign of acute danger in German government alert systems.
FortiBleed campaign demonstrates active exploitation of Fortinet devices by eCrime and Russian ransomware groups for lateral movement into Active Directory environments via MSP and telecom providers.
CISA has identified active credential exposure in production Fortinet devices and is urging hardening measures, indicating ongoing exploitation documented outside standard CVE channels.
BSI issues warning of multiple undisclosed vulnerabilities in Chrome and Edge without CVE details; details remain embargoed until stable patch release.
FortiBleed leak exposes VPN credentials for 73,000 Fortinet devices,a direct threat to organizations deploying FortiGate and FortiClient.
Gentlemen RaaS actively develops multiple EDR killer techniques to disable endpoint detection and response systems and thereby conceal ransomware attacks.
ClickOnce abuse allows threat actors to leverage legitimate Windows installation mechanisms for malware distribution and persistence while avoiding traditional detection signatures.
The Gentlemen group operates a mature, standardized EDR-killer ecosystem (GentleKiller framework) targeting over 400 security processes and leveraging BYOVD techniques with signed drivers,indicating organized, technically sophisticated ransomware infrastructure.
No changes in this category.
No changes in this category.
National intelligence agencies warn of active global campaign targeting Fortinet infrastructure; indicates state-sponsored threat actors exploiting critical perimeter security as attack vector.
A publicly available exploit for a critical privilege escalation in Microsoft Defender enables full system takeover with SYSTEM privileges; the same researcher has submitted at least four additional Windows zero-days that have since been patched by Microsoft.
Large-scale supply-chain attack on 140+ npm packages through maintainer account takeover and distribution of malicious dayjs typosquat demonstrates vulnerability of open-source ecosystems to targeted compromise.
BSI advisory on multiple critical vulnerabilities in Firefox/ESR and Thunderbird with arbitrary code execution and sandbox escape potential; patches required.
A coordinated attack wave against tens of thousands of firewalls indicates an active, large-scale campaign possibly conducted by nation-state actors or organized cybercriminals seeking access to critical network infrastructure.
An active clipboard-stealing malware strain since February 2026 leverages Windows Script Host, hidden Tor-based C2 servers, and automatic propagation mechanisms for persistence without relying on traditional installers or exposed IP-based infrastructure.
The alert provides no CVE identifiers and no details on active exploitation or attack scenarios, making it primarily a patch announcement without strategic added value.
Attackers leverage legitimate Microsoft Teams TURN relays to conceal C2 traffic by deploying a Go-based RAT using Ghost Calls technique, remaining entirely invisible within normal Teams traffic.
UEFI firmware-level vulnerabilities require DBX updates from vendors and BIOS patches , cannot be fully remediated through operating system updates alone.
Microsoft acknowledges unintended side effects of June security updates that prevent third-party applications from launching Office apps,a regression issue affecting productivity.