FortiBleed, Unpatchable iPhones, and a 15,000-Site Cleanup
Monday, June 22, 2026 · 5-minute read
Law enforcement agencies from the Netherlands, Canada, Germany, and the U.S. took down 106 servers and removed malware from 14,971 WordPress websites linked to the SocGholish botnet. SocGholish — active since 2017 and tied to the Russian cybercrime group Evil Corp — disguises itself as a fake Chrome or Firefox browser update, tricking visitors into downloading additional malware. Affected site owners have been notified to update WordPress, change passwords, and delete suspicious admin accounts.
↗ The Hacker NewsMicrosoft has attributed a supply chain attack on the Mastra AI framework to North Korean hackers known as Sapphire Sleet (BlueNoroff). More than 140 npm packages were backdoored, targeting developers who build AI-powered applications. The group is known for financially motivated attacks and has previously targeted cryptocurrency companies and developer tools.
↗ BleepingComputerThe Texas Parks and Wildlife Department disclosed that a cyberattack on its third-party licensing vendor exposed personal information for more than three million people, including driver's license data. The breach did not originate from TPWD's own systems — it came through the vendor that handles fishing and hunting license registrations. Affected individuals should monitor for identity theft and consider a credit freeze.
↗ BleepingComputerA campaign now called FortiBleed — believed to involve Russian-speaking hackers — has compromised 86,644 Fortinet FortiGate firewalls and VPN gateways across 194 countries. The attackers used fully automated credential stuffing and brute force techniques — and succeeded largely because organizations never changed Fortinet's default admin account names or factory passwords. Telecom, government, and education have been hit hardest. CISA issued an urgent advisory on June 19, and the U.K.'s NCSC also raised the alarm. The attackers built a verified database of working logins for some of the world's largest enterprises.
↗ The Hacker NewsA use-after-free bug in NGINX's HTTP/3 module lets a remote attacker with no login credentials execute arbitrary code on the server — but only when ASLR (a memory randomization protection) is disabled or can be bypassed. The flaw is in the QUIC-based HTTP/3 implementation and is triggered by a specially crafted session.
Patch available: Update to NGINX 1.27.5 or later. F5 released the fix alongside a second critical flaw (CVE-2026-42055, also CVSS 9.2) affecting HTTP/2 proxying. Both should be patched immediately.
A heap-based buffer overflow in NGINX's HTTP/2 proxy and gRPC modules lets an unauthenticated remote attacker run code on the server. It requires a specific non-default configuration (proxy_http_version 2 or grpc_pass, with ignore_invalid_headers set to off).
Patch available: same fix as CVE-2026-42530 — update to NGINX 1.27.5+.
An unauthenticated visitor can hit an unprotected API endpoint on any site running this plugin and extract the full system configuration — including API keys, OAuth tokens, and email credentials. The plugin is installed on about 100,000 WordPress sites and active exploits are already occurring.
Patch available: Update to Gravity SMTP 1.12.1 or later. Check your email integration settings afterward to rotate any exposed API keys.
Microsoft researchers have published detailed findings on a new attack technique called AutoJack, which turns an AI browsing agent into an unwitting delivery vehicle for remote code execution. The attack works by steering an AI agent to load a malicious web page — the page's JavaScript then reaches a local privileged service running on the same machine and spawns a process on the host. No login, no interaction needed beyond the agent loading the page. The flaw was found in AutoGen Studio, an open-source interface for building multi-agent AI systems. This research matters for anyone deploying AI agents inside company networks: agents that can browse the web need to run isolated from privileged local services. Microsoft's disclosure gives development teams a concrete threat model to defend against as agentic AI tools become mainstream.
Imagine a master key to your home that was forged into the door's lock at the factory. No locksmith can remove it. No new coat of paint covers it. As long as that door exists, the key works. That's roughly what happened this week when researchers at Paradigm Shift published a working exploit — called usbliter8 — for Apple's A12 and A13 chips.
These chips power the iPhone XS, XR, iPhone 11 series, iPhone SE (2nd generation), several iPad models, Apple Watch Series 4 and 5, and the HomePod mini. The flaw sits in the SecureROM — the very first code that runs when these devices boot. Apple cannot update it with a software patch. Ever. Every affected device will carry this flaw for as long as it stays in service.
The root cause is a hardware bug in the USB controller chip inside the A12 and A13. When specific undersized USB packets arrive in rapid sequence, the controller's write pointer drifts backwards through memory in a predictable, repeatable way. On these specific chips, Apple's memory protection (called DART) runs in bypass mode inside SecureROM, so that drifting pointer can reach and overwrite arbitrary memory. The exploit finishes in under two seconds, before Apple's secure boot chain even loads. Affected devices must be in DFU mode and physically connected via USB. There is no remote version of this attack.
The closest precedent is checkm8, a 2019 zero-day that permanently put older iPhones outside Apple's patch authority. usbliter8 extends that condition to the next chip generation. A working proof of concept is publicly available on GitHub.
For most people, the practical risk is low — an attacker needs your physical device, a specific USB cable, and the know-how to force DFU mode. But for high-security environments (corporate device fleets, law enforcement, journalism), this is now a hardware-retirement problem. If the device runs an A12, A13, S4, or S5 chip in a sensitive role, physical security is all that stands between that device and a full compromise. Prioritize refreshes to A14 or newer hardware. And never plug those phones into unknown USB ports or chargers.
The code is public. That's usually when a research demo stops being academic and starts becoming someone else's tool.