Cybersecurity briefing — June 24, 2026.

Researchers describe FortiBleed as a large-scale credential-harvesting and access-brokering operation targeting FortiGate firewalls, with valid remote-access logins observed across hundreds of thousands of devices. The key insight for defenders: even without exploiting a fresh zero-day, attackers can achieve rapid compromise by collecting working credentials and searching for exposed management surfaces. Organizations running FortiGate should prioritize exposure reduction (management interface restrictions), emergency credential hygiene, and rapid patch/mitigation validation.

Source: Security Affairs

CISA has added additional vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including Ubiquiti UniFi OS and Lantronix EDS5000 plugin issues. KEV listings typically signal that exploitation is either confirmed or actively observed in the wild, making remediation timelines urgent for affected environments. This update reinforces the need to continuously map your asset inventory to KEV and prioritize patching where exposure is greatest.

Source: Security Affairs

Security reporting indicates threat actors have begun exploiting CVE-2026-20230, a critical Cisco Unified CM vulnerability, after a proof-of-concept made exploitation paths clearer. The core risk in these cases is speed: once PoCs circulate, attackers often shift quickly from scanning to hands-on compromise. If you operate Cisco Unified CM or Session Management Edition, verify patch status immediately and validate that compensating controls block the vulnerable request patterns.

Source: The Hacker News

Multiple reports tie critical issues in Dify—an open-source AI platform—to cross-tenant data exposure that could allow attackers to read private chats and preview other tenants’ documents, potentially reaching internal APIs. The most concerning scenario for defenders is multi-tenant isolation failure: a breach can be lateral across customers even when each individual tenant “does everything right.” Teams should treat AI platforms like production services: patch quickly, enforce strict tenancy controls, and review logs for anomalous access to tracing and retrieval features.

Source: SecurityWeek

Kaspersky researchers analyzed a new campaign, StrikeShark, targeting victims with Cobalt Strike Beacon delivered through a custom SharkLoader stage. This highlights an enduring pattern in intrusion chains: attackers frequently modularize delivery (loader/initial stage) while keeping the “business end” (post-exploitation tooling like Cobalt Strike) consistent. Defender takeaway: focus on detecting both the loader behavior and the downstream Beacon/command-and-control characteristics, not just one stage.

Source: Kaspersky SecureList

An ISC SANS Internet Storm Center diary emphasizes a practical attacker technique: process masquerading (MITRE ATT&CK T1036), where malware runs while presenting a benign-looking process name. This matters because many incident response workflows rely on quick visual triage of process lists—exactly where attackers can blend in and defeat simplistic detections. The recommendation is to corroborate process identity with deeper telemetry (path validation, integrity checks, parent-child process context, and suspicious behavior) rather than name-only indicators.

Source: SANS ISC

Multiple outlets report continued movement toward harder timelines for adopting post-quantum cryptography (PQC), including federal actions requiring migrations for high-value assets. The implication for cybersecurity teams is operational: crypto agility, key management readiness, and inventory-driven remediation must be treated as a security engineering program—not a one-time cryptographic upgrade. Early work now reduces the risk that “deadline day” arrives with dependencies you can’t patch quickly.

Source: SecurityWeek

Squidbleed: 29-Year-Old Squid Proxy memory leak (CVE-2026-47729) exposes credentials/tokens
Scattered Spider hackers plead guilty in TfL disruption case
FortiBleed targets FortiGate firewalls in a 110M-credential harvesting operation