Microsoft Confirms 'RoguePlanet' Defender Zero-Day; FortiBleed Campaign Compromises 70K Firewalls; INC Ransomware Surges

The critical Splunk Enterprise RCE vulnerability, CVE-2026-20253, is now confirmed to be under active exploitation in the wild. CISA has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, marking it as the first Splunk vulnerability to receive this designation. Federal agencies are mandated to patch internet-exposed systems by June 21, 2026. This development significantly increases the urgency for all organizations to apply the available patches immediately, as threat actors are actively weaponizing the vulnerability.

Further analysis of the 'RoguePlanet' zero-day (CVE-2026-50656) confirms the public proof-of-concept exploit remains effective even when Microsoft Defender's real-time protection is disabled or in passive mode, highlighting the vulnerability's insidious nature. While the exploit's success is reportedly inconsistent due to timing, it has been independently validated by security firms. The disclosing researcher, 'Chaotic Eclipse,' has now released seven zero-days since March 2026. Organizations are advised to consider implementing application control solutions like Windows Defender Application Control (WDAC) as an additional remediation step until a patch is released.

New analysis from Symantec and Carbon Black provides further insight into the DragonForce ransomware group's 'Backdoor.Turn' operations. A key finding indicates that the Go-based backdoor is not always solely for initial C2, but is sometimes deployed *after* the ransomware payload. This suggests a strategic shift towards maintaining long-term persistence on compromised networks, potentially for future attacks or to sell access to other threat actors. This expands the understanding of the threat actor's intent and the lifecycle of the backdoor, highlighting a more entrenched and persistent threat model. Additional MITRE ATT&CK techniques (T1134.001, T1059.006, T1486) and refined detection/mitigation strategies, including assuming trusted channels can be abused and restricting outbound QUIC, have also been identified.

Eastman Kodak Company officially confirmed the data breach on June 18, the deadline set by ShinyHunters for data release. The company reiterated that unauthorized access was limited and contained. Kodak has notified law enforcement and is now also working with external cybersecurity experts to investigate the incident, providing more detail on their incident response efforts.