2026-06-18: FortiBleed exposes 73,000 Fortinet VPN credentials to a Russian-speaking threat group targeting

Show Notes - 2026-06-18 Stories Covered: - June 18, 2026 - Today: - Joomla Content Editor Plugin Zero-Day (CVE-2026-48907) (https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-max-severity-joomla-plugin-flaw-by-friday/) - FortiBleed: 73,000 Fortinet VPN Credentials Exposed (https://www.bleepingcomputer.com/news/security/fortibleed-leak-exposes-fortinet-vpn-credentials-for-73-000-devices/) - Fortinet FortiSandbox Vulnerabilities Under Active Exploitation (https://cyberscoop.com/fortinet-fortisandbox-vulnerabilities-exploits/) - Microsoft Defender Zero-Day RoguePlanet (CVE-2026-50656) (https://thehackernews.com/2026/06/microsoft-confirms-rogueplanet-defender_02022423645.html) - INC Ransomware Reaches 800+ Victims Through Basic Tactics (https://www.darkreading.com/cyberattacks-data-breaches/inc-ransomware-thrives-by-mastering-the-basics) - DragonForce Ransomware Deploys Custom Backdoor Using Microsoft Teams Infrastructure (https://www.securityweek.com/microsoft-teams-relay-servers-abused-in-dragonforce-ransomware-attack/) - EdTech Sector Faces Escalating Ransomware and Data Breach Activity (https://databreaches.net/2026/06/17/cybercriminals-are-targeting-edtech-data-breaches-and-ransomware-attacks-on-the-rise/?pk_campaign=feed&pk_kwd=cybercriminals-are-targeting-edtech-data-breaches-and-ransomware-attacks-on-the-rise) - Mastra npm Supply Chain Attack Poisons 140+ Packages (https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/) - Account Takeover Attacks Rising Through Session Hijacking and MFA Bypass (https://www.bleepingcomputer.com/news/security/why-account-takeovers-are-rising-and-how-to-stop-them/) - CASB Blind Spot: QUIC Protocol Bypasses Web Traffic Inspection (https://isc.sans.edu/diary/rss/33084) - Crypto Clipper Malware Uses Tor and Worm-Like Propagation (https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/) - Office Apps Experiencing Launch Issues After June Updates (https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-office-apps-launch-issues-after-june-updates/) - Interpol: Cyber Offenses Account for One-Third of Crime in Asia-Pacific (https://www.theregister.com/cyber-crime/2026/06/18/cyber-offenses-now-account-for-around-a-third-of-all-crime-across-asia-and-south-pacific/5257716) - Junior Hacker Uses Tailscale and OpenSSH for Backup Persistence (https://thehackernews.com/2026/06/junior-hacker-used-tailscale-and.html) - CVE-2026-48854: Elixir gRPC Unbounded Request Body Memory Exhaustion (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48854) - Coordinated SSH Brute Force Attacks Over Three Months (https://isc.sans.edu/diary/rss/33086) CVEs Referenced: CVE-2023-3519, CVE-2023-48788, CVE-2024-57727, CVE-2025-5777, CVE-2026-25089, CVE-2026-33825, CVE-2026-39808, CVE-2026-39813, CVE-2026-41091, CVE-2026-45498, CVE-2026-48854, CVE-2026-48907, CVE-2026-50656 Indicators of Compromise: IPs: 2.9.99.6 Full brief: https://carolinacleartech.com/brief/2026-06-18/