Security & Risk
140 analyses
A researcher identified a database with functional credentials for nearly 87,000 FortiGate devices across 21,600 domains, including Samsung, Mercedes-Benz, Chevron, and Accenture. The campaign remains active, according to SOCRadar.
Researcher Bob Diachenko found a database with 73,932 exposed Fortinet devices impacting Oracle, Siemens, Accenture, and PwC. Fortinet denies zero-day, CISA issues alert.
In 84 minutes, attackers reposted the @mastra scope on npm with the malicious dependency easy-day-js. @mastra/core accumulates around 4 million downloads per month. Tradecraft points to the North Korean group BlueNoroff.
Group claims to have exfiltrated 429,000 files from the Strasbourg-based organization by exploiting CVE-2026-35273 (CVSS 9.8). The Council states it is investigating; Oracle releases patch in June bulletin.
Group UNC6508 exploited REDCap servers and deployed INFINITERED malware in military, medical, and AI research networks between September 2023 and November 2025, according to the Google Threat Intelligence Group.
The group claims to have exfiltrated HR data, payroll records, and 409,000 pay slips since 2011. The Council of Europe had not publicly commented by the time of this report.
The largest update in the history of the program brings six zero-days, one of which, CVE-2026-41091, has confirmed active exploitation in Microsoft Defender. CISA has already mandated federal agencies to apply the package.
CVE-2026-50751 has a CVSS of 9.3 and allows authentication bypass in IKEv1 deployments; Qilin affiliates have been exploiting the vulnerability since May 7, according to Check Point.
The June 9 Patch Tuesday brings 200 vulnerabilities, 33 critical, three zero-days publicly disclosed, and CVE-2026-45657 with a CVSS of 9.8 in the Windows TCP/IP kernel.
Microsoft delivers a definitive fix for CVE-2026-42897, an XSS vulnerability in Outlook Web Access exploited since mid-May, on the same day SAP closes a critical SAML vulnerability.
CVE-2026-20245 allows command execution as root on the Catalyst SD-WAN Manager. Mandiant detected exploitation before the disclosure. Cisco has not released a fix yet.
CVE-2026-20245, CVSS 7.8, affects all deployment models of the Catalyst SD-WAN Manager with no patch available. Google Mandiant researchers reported the vulnerability, actively exploited since before the advisory on June 5.