Microsoft Confirms 'RoguePlanet' Defender Zero-Day; FortiBleed Campaign Compromises 70K Firewalls; INC Ransomware Surges
Summary
This cybersecurity brief for June 19, 2026, covers several critical developments. Microsoft is urgently patching 'RoguePlanet' (CVE-2026-50656), a high-severity zero-day in Defender that allows full system control. A massive campaign dubbed 'FortiBleed' has compromised credentials for over 70,000 Fortinet devices globally through password spraying and offline cracking. Meanwhile, the INC ransomware group has surged, claiming over 830 victims since 2023 by exploiting known vulnerabilities and filling the void left by LockBit's disruption. Other major incidents include a supply chain attack on JetBrains Marketplace stealing AI developer keys and a data breach at Kodak orchestrated by the ShinyHunters group.
Today New Articles
‘FortiBleed’ Campaign: Over 70,000 Fortinet Firewalls Compromised in Global Credential Heist
A large-scale, automated credential harvesting campaign dubbed 'FortiBleed' has compromised administrative and VPN credentials for at least 73,932 Fortinet FortiGate firewalls across 194 countries. A Russian-speaking threat group is believed to have conducted...
Supply Chain Attack: Malicious JetBrains Plugins Steal AI Provider API Keys from Developers
A software supply chain attack on the JetBrains Marketplace has been uncovered, involving at least 15 malicious plugins that masqueraded as legitimate AI coding assistants to steal API keys. Active since October 2025, the plugins exfiltrated credentials for se...
Gamers Beware: Hackers Abuse Steam's Wallpaper Engine to Distribute Infostealers and Ransomware
Cybercriminals are exploiting the Steam Workshop by hiding malware within animated desktop backgrounds for the popular 'Wallpaper Engine' application. A report from Kaspersky details how attackers are using the app's ability to run executables to deploy a vari...
New 'GodDamn' Ransomware Targets Windows Systems With Stealthy Approach
Security researchers at CYFIRMA have identified a new ransomware variant named 'GodDamn' that targets Windows operating systems. The malware, discovered on underground forums, encrypts files and appends a '.God8Damn' extension. It then drops a ransom note ('RE...
FCC Reviews Telecom Supply Chain Security Reporting to Counter Espionage Threats
The U.S. Federal Communications Commission (FCC) is reviewing its information collection requirements for supply chain security programs aimed at enhancing oversight of telecommunications infrastructure. A notice published in the Federal Register on June 18 in...
Texas Data Breach Exposes Personal Info of 3 Million Hunting & Fishing License Holders
The Texas Parks and Wildlife Department has announced a data breach that may have exposed the personal information of more than 3 million Texas hunting and fishing license holders. The breach originated from an unnamed third-party vendor that manages the state...
Defense Contractor LOGZONE Pays $507K to Settle Claims of Falsifying Cybersecurity Compliance
LOGZONE, an Alabama-based defense contractor, has agreed to pay $507,144 to settle allegations that it violated the False Claims Act by knowingly misrepresenting its compliance with Pentagon cybersecurity requirements. The Department of Justice alleged that fr...
Article Updates
Splunk Scrambles to Patch Critical 9.8 CVSS Flaw Allowing Unauthenticated RCE
Update:The critical Splunk Enterprise RCE vulnerability, CVE-2026-20253, is now confirmed to be under active exploitation in the wild. CISA has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, marking it as the first Splunk vulnerability to recei...
Microsoft Scrambles to Patch 'RoguePlanet' Zero-Day in Defender After Public Exploit Release
Update:Further analysis of the 'RoguePlanet' zero-day (CVE-2026-50656) confirms the public proof-of-concept exploit remains effective even when Microsoft Defender's real-time protection is disabled or in passive mode, highlighting the vulnerability's insidious nature...
DragonForce Ransomware Hides C2 Traffic in Microsoft Teams to Evade Detection for Months
Update:New analysis from Symantec and Carbon Black provides further insight into the DragonForce ransomware group's 'Backdoor.Turn' operations. A key finding indicates that the Go-based backdoor is not always solely for initial C2, but is sometimes deployed *after* t...
Kodak Confirms Data Breach After ShinyHunters Threatens to Leak 2.2M Records
Update:Eastman Kodak Company officially confirmed the data breach on June 18, the deadline set by ShinyHunters for data release. The company reiterated that unauthorized access was limited and contained. Kodak has notified law enforcement and is now also working with...