The Lyceum: Cyber Intelligence Daily — Jun 18, 2026

The perimeter you trust most is the perimeter getting hit hardest. This week, roughly half the world's internet-facing Fortinet firewalls turned out to have admin credentials sitting in a criminal database; Microsoft's own antivirus picked up an unpatched zero-day with a public exploit already circulating; and CISA quietly flagged two more flaws being actively used against real targets. The connective tissue across all of it: defenders are being asked to patch faster than vendors are willing to be transparent — and the trusted channel (your VPN, your AV, your IDE marketplace) is now the attack surface.

• CVE-2026-50656 (RoguePlanet) — Microsoft Defender on fully-patched Windows 10/11: no fix yet, public PoC circulating, CVSS 7.8. A race condition in Defender's real-time scanner spawns a SYSTEM-level shell.
• CVE-2026-20262 — Cisco Catalyst SD-WAN Manager: actively exploited (CISA KEV), no NVD score yet, federal deadline June 29. Path traversal lets an authenticated attacker read files outside their lane.
• CVE-2026-48907 — Widget Factory Joomla Content Editor: actively exploited (CISA KEV), no NVD score yet, ransomware-linked: no. Improper access control enabling file upload and execution; federal deadline was June 19.
• CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools: actively exploited and ransomware-linked (CISA KEV), commoditized maturity, no NVD score yet. Missing authentication for a critical function — a known extortion front door.
• NGINX critical flaws — F5 shipped out-of-band patches: remote, unauthenticated attackers could force a restart and potentially execute code. No CVE IDs confirmed in reporting yet.

If your organization runs a Fortinet firewall — and tens of thousands do — your VPN login may already be in an attacker's hands, verified and ready for sale.

A newly discovered leak dubbed "FortiBleed" exposed Fortinet and FortiGate VPN credentials for 73,932 firewall URLs worldwide. Security researcher Bob Diachenko found an open server containing valid credentials — usernames, email addresses, and plaintext passwords. Kevin Beaumont, one of the most trusted independent voices in network security, then obtained the dataset, worked with Hudson Rock, and confirmed a "massive Fortinet/FortiGate bruteforce/active exploitation campaign uncovered in action." Beaumont's analysis estimates roughly 75,000 devices affected — about 50% of all internet-facing Fortinet firewalls based on Shodan data. According to screenshots Diachenko shared, the database includes entries for Chevron, Samsung, Foxconn, Comcast, AT&T, Mercedes-Benz, Toyota, Sinopec, and State Grid.

The root cause is a password-hashing problem hiding in plain sight. Fortinet introduced stronger PBKDF2 hashing in FortiOS 7.2.11, 7.4.8, and 7.6.1 — but when upgrading from older versions, existing admin passwords stay stored as weaker SHA-256 hashes until the admin successfully logs in after the upgrade. Many organizations never crossed that line. Diachenko attributed the campaign to a Russian-speaking group.

Fortinet told BleepingComputer the credentials came from previous incidents and brute-force attacks, not a new vulnerability. Researchers push back on that framing: the 45-GPU offline cracking cluster, the access inventory formatted for dark-web sale, and classified document exfiltration from a NATO contractor suggest deliberate infrastructure, not opportunism.

What changes if this holds: tens of thousands of corporate and government networks have verified admin access for sale right now — a pre-built initial-access marketplace. What to watch: Hudson Rock published a free domain lookup at hudsonrock.com/fortinet. Rotate every admin and VPN credential, enforce MFA on external gateways, and have each admin log back in post-upgrade to force a re-hash. If Fortinet names a specific CVE, this shifts from rotation to emergency patching — and the count grows past 75,000.

The software meant to protect every Windows machine in your organization is itself the attack surface this week — and there's no patch yet.

Microsoft acknowledged a zero-day in Microsoft Defender, publicly named "RoguePlanet," and confirmed a patch is in development. Tracked as CVE-2026-50656, it was published June 16 by the Microsoft Security Response Center with a CVSS score of 7.8. The bug is a race condition in Defender's real-time scanning engine — exploiting the brief window between when Defender checks a file path and when it acts on it. Triggered successfully, it spawns a command prompt running as NT AUTHORITY\SYSTEM, the highest privilege on the machine.

The uncomfortable part: it affects fully patched Windows 10 and 11, including the June 2026 cumulative update. ThreatLocker independently reproduced the exploit on fully patched Windows 11, and noted the PoC works whether or not Real-Time Protection is enabled — "the only thing you can realistically do is wait for a patch."

RoguePlanet is the latest salvo in an ongoing feud between a researcher known as Nightmare Eclipse and Microsoft over its bug-bounty practices. Over recent months the researcher has leaked exploits for BlueHammer, RedSun, GreenPlasma, MiniPlasma, YellowKey, and UnDefend — and three of those have since been exploited in the wild.

What changes if this drops further: privilege escalation is the second act of nearly every breach — an attacker with a phishing foothold uses RoguePlanet to go from "regular user" to "owns the box." What to watch: Microsoft says it's building a "high-quality patch" but hasn't committed to an out-of-band release, rating the flaw "Exploitation More Likely." Monitor Windows Event Logs for unexpected SYSTEM-level process creation. If Microsoft ships out-of-band before next Tuesday, it means in-the-wild exploitation has been confirmed.

CISA's Known Exploited Vulnerabilities catalog — the government's running list of flaws being used against real targets right now — gained two additions worth acting on.

CVE-2026-20262 affects Cisco Catalyst SD-WAN Manager, which controls how organizations route traffic across their wide-area networks. It's a path traversal flaw — an authenticated attacker escapes their assigned directories to reach files they shouldn't. Federal deadline: June 29. Notably, Check Point Research previously observed the infrastructure behind CVE-2026-50751 (Check Point VPN) also probing Palo Alto, F5, and Fortinet — meaning this Cisco bug looks like part of one multi-vendor VPN campaign, not an isolated event.

CVE-2026-48907 affects the Widget Factory Joomla Content Editor (JCE), the most-installed editor plugin for Joomla, which powers millions of sites. The improper-access-control flaw allows file upload and execution. The federal deadline was June 19. If you run Joomla with JCE, this is your most urgent patch. The knowledge graph links WINNTIGROUP and ROCKE — both persistent threat actors — to related Joomla-targeting infrastructure.

Neither CVE has an NVD score or second-source attribution yet. But KEV listing is the gold standard for "this is being used right now" — that's the only bar for inclusion. What to watch: a GreyNoise scanning spike against JCE instances would mean exploitation has gone opportunistic, and the patch window closes fast.

NGINX is the web server software quietly running behind a huge fraction of the internet — millions of websites, APIs, and load balancers, often without their operators fully realizing it. When F5, which maintains NGINX, ships emergency patches, pay attention.

Per BleepingComputer, F5 released out-of-band updates — meaning it didn't wait for a scheduled cycle — to address multiple NGINX flaws, including two critical-severity ones that could allow remote code execution or a forced service restart. SecurityWeek confirmed the critical flaws "could allow remote, unauthenticated attackers to cause a restart and potentially execute arbitrary code."

Remote, unauthenticated, code execution is the worst-case trifecta: an attacker on the internet, with no credentials, potentially running their own code on your server. What changes: if your organization runs NGINX directly or sits anything behind an NGINX load balancer, you're in scope. What to watch: no CVE IDs or CVSS scores are confirmed in reporting yet — monitor the F5 security advisory portal for the specific CVE assignments and affected version ranges, which determine whether your deployment is actually exposed.

Xakep reports that ShinyHunters — the prolific extortion crew that has spent the spring hitting universities, the Council of Europe, and Charter Communications — now claims to have stolen data from Kodak. Kodak has acknowledged a cybersecurity incident but told SecurityWeek it believes there is no threat to its systems or operations. The pattern matters for Western defenders because ShinyHunters' help-desk-and-stolen-credential playbook keeps working across wildly different sectors — and the consistency of the targeting suggests a repeatable process, not opportunism. Source: Xakep — Russian. No English-language coverage confirmed at time of publication.

Xakep details "SearchLeak," a vulnerability in Microsoft Copilot that researchers say could expose a victim's email contents and one-time confirmation codes — the two-factor codes meant to be the last line of defense — after manipulation of the AI assistant. The significance: as enterprises wire AI assistants into email and identity workflows, the assistant itself becomes a credential-disclosure surface, a class of bug most threat models haven't accounted for yet. Source: Xakep — Russian. No English-language coverage confirmed at time of publication.

Half the planet's Fortinet firewalls handing their passwords to a 45-GPU cracking rig; an antivirus that spawns a SYSTEM shell when you ask it nicely about a file path; and a fake "AI assistant" plugin politely pocketing your OpenAI key while you write code. The security software is the breach, the IDE store is the malware, and the only mitigation anyone could offer for the Defender zero-day was, verbatim, "wait" — which is also roughly AMD's answer when you ask why your RAM stopped encrypting itself.

Patch what you can, rotate what you can't, and trust nothing that calls itself an assistant.

Forward this to the one person you know who still believes their VPN is keeping anyone out.