Comparing 19 June 2026 with the previous day 12 June 2026.
FortiBleed is an active, Russian-speaking attack campaign targeting 86,644+ FortiGate devices globally, enabled by weak credential-management practices (default accounts, factory passwords), indicating direct perimeter compromise.
FortiBleed involves actively compromised systems with exposed VPN credentials from 73,000 devices globally and requires immediate password reset and access review for all Fortinet VPN users.
The BSI emergency notification at 2:30 AM underscores the severity of the vulnerability and indicates imminent exploitation or threat; this is a rare sign of acute danger in German government alert systems.
FortiBleed campaign demonstrates active exploitation of Fortinet devices by eCrime and Russian ransomware groups for lateral movement into Active Directory environments via MSP and telecom providers.
CISA has identified active credential exposure in production Fortinet devices and is urging hardening measures, indicating ongoing exploitation documented outside standard CVE channels.
BSI issues warning of multiple undisclosed vulnerabilities in Chrome and Edge without CVE details; details remain embargoed until stable patch release.
FortiBleed leak exposes VPN credentials for 73,000 Fortinet devices,a direct threat to organizations deploying FortiGate and FortiClient.
Gentlemen RaaS actively develops multiple EDR killer techniques to disable endpoint detection and response systems and thereby conceal ransomware attacks.
ClickOnce abuse allows threat actors to leverage legitimate Windows installation mechanisms for malware distribution and persistence while avoiding traditional detection signatures.
The Gentlemen group operates a mature, standardized EDR-killer ecosystem (GentleKiller framework) targeting over 400 security processes and leveraging BYOVD techniques with signed drivers,indicating organized, technically sophisticated ransomware infrastructure.
No changes in this category.
No changes in this category.
Extensive patch collection with 60+ Adobe CVEs and Windows EoP bugs; active exploitation in Reader area requires prioritization, but no nation-state implication identified.
The vulnerability enables data theft directly from UniFi devices by network-internal attackers without requiring authentication.
The vulnerability requires existing network access with low privileges and affects locally installed UniFi OS devices, not cloud-based management consoles.
The vulnerability allows unauthorized network-based modification of UniFi OS device configurations without authentication.
The vulnerability enables Command Injection on UniFi OS devices with only low-privilege network access, presenting elevated lateral movement risk within network infrastructure.
Chinese APT group Velvet Ant has compromised Linux authentication components (PAM/OpenSSH) themselves over nearly a decade to achieve deep persistence , a strategy that evades conventional malware detection and requires integrity verification of core OS components.
The vulnerability enables remote code execution with user interaction and affects Acrobat Reader versions deployed across many production environments.
Unauthenticated remote exploitation of a double-free vulnerability in Windows IKEv2 can crash or execute code on VPN gateways.
A use-after-free vulnerability in Chrome's core allows attackers to execute arbitrary code via crafted HTML pages,a frequently exploited attack class targeting browsers.
A sandbox escape in Google Chrome's renderer process enables attack-chain escalation if an attacker already controls renderer-process code execution.
A critical sandbox escape vulnerability enables remote code execution with full OS-level access if an attacker has already compromised the Chrome renderer process.
Five vulnerabilities in UniFi OS and UID Enterprise Agent allow attackers not only code injection but also security bypass and data access; patches are already available.
BSI warning of multiple critical vulnerabilities in Ubiquiti UniFi OS enabling remote code execution and privilege escalation , patches required.
The report is a patch announcement without details on active exploits or attack campaigns; specific CVE numbers and vulnerability details are not fully accessible from the provided text.
The vulnerability enables heap buffer-overflow via crafted LVM disk images when opened locally , patching to version 6.0.1698.0 or later is required.
A signed but legacy driver from PC Tools (unmaintained since 2013) can still be exploited as a BYOVD vector in modern Windows systems for privilege escalation and credential theft.
A Palo Alto Networks GlobalProtect authentication bypass is currently being exploited in active attack waves since mid-May, not theoretical proof-of-concept.
The vulnerability enables sandbox escape through malicious local network traffic, going beyond a simple crash and allowing code execution with elevated privileges.
The vulnerability allows an attacker with access to the renderer process to extract sensitive data from process memory; exploitation requires a pre-compromised rendering environment.
A sandbox escape in Chrome DevTools requires a compromised renderer process but enables elevated attack capabilities against targeted developers or technical users.
The vulnerability requires that the renderer process must already be compromised; exploit potential is therefore limited to scenarios involving prior code execution.
A same-origin policy bypass in Chrome DevTools allows attackers to access data from other origins via crafted HTML pages, which is particularly relevant for phishing and data theft scenarios.
The vulnerability requires an already-compromised renderer process, limiting practical exploitability; this is a routine patch notification with no indication of active exploitation.
This is a standard Chrome security update with no indication of active exploitation or targeted campaigns against manufacturing organizations.
BSI warning for multiple unspecified Chrome vulnerabilities without CVE details; patch availability and exploitation status not mentioned in the source.
The BSI warns of multiple unspecified vulnerabilities in widely deployed browsers without providing specific CVE numbers or exploitation status , patch management action required, but no active campaign known.