Daily digest

CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices

CISA issued an advisory urging Fortinet customers to immediately remediate FortiGate appliances following a sweeping campaign, dubbed FortiBleed, that has compromised over 86,000 internet-accessible devices. The campaign is attributed to Russian-speaking threat actors. CISA's advisory calls for specific hardening steps beyond patching.

Why it matters: If FortiGate appliances sit at your perimeter or are used by any of your DIB supply chain partners, treat this as an active incident response item — CISA advisories on actively exploited edge devices have direct bearing on CMMC L2 incident reporting obligations under DFARS 252.204-7012.

CISA: Splunk Enterprise Flaw Actively Exploited, Patch by Sunday

CISA added a critical Splunk Enterprise vulnerability to its Known Exploited Vulnerabilities catalog and directed U.S. federal agencies to apply patches by end of the weekend. The flaw is being actively used in attacks. No additional technical details on the CVE were provided in the snippet.

Why it matters: If Splunk Enterprise is part of your SIEM or log aggregation stack — including in AWS GovCloud — the KEV listing and Sunday deadline apply to federal environments and represent a strong benchmark for your own patching SLA under NIST 800-171 SI.2.

The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes

A ransomware-as-a-service operation called The Gentlemen is distributing a mature EDR-killing framework named GentleKiller to affiliates, which targets approximately 400 distinct security processes before deploying ransomware. The toolkit incorporates both proprietary and third-party EDR-termination tools. The operation is actively maintained and handed to affiliates as part of the RaaS package.

Why it matters: EDR-killing frameworks at this scale mean your endpoint protection stack on Intune-managed Windows 11 endpoints needs tamper protection enabled and process kill attempts surfaced as high-priority alerts — verify your Defender for Endpoint tamper protection policies are enforced via Intune compliance profiles.

AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution

Microsoft researchers detailed an exploit chain called AutoJack in which a malicious web page's JavaScript reaches a privileged local service exposed by an AI browsing agent, resulting in arbitrary code execution on the host without any credentials or further user interaction. The attack is triggered simply by directing the agent to load an attacker-controlled page. No patch or mitigation was announced at time of publication.

Why it matters: If your environment runs any self-hosted or locally installed AI agents with browser capabilities — including any agentic tools in your AI stack — this attack surface exists today; restrict local service bindings and network access for AI agent processes until mitigations are published.

Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data

Salesforce disabled the Klue Battlecards app integration on June 11, 2026, after the competitive intelligence platform confirmed attackers stole OAuth tokens that were used to access customers' Salesforce environments. The extortion group Icarus has claimed responsibility. Affected organizations cannot reconnect Klue to Salesforce until further notice.

Why it matters: This is a supply-chain OAuth token abuse scenario — audit all third-party app integrations authorized against your M365 GCC High and any Salesforce instances, and confirm that OAuth token scopes follow least-privilege; CMMC L2 practice AC.3.018 requires controlling access to CUI through connected apps.

Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain

Researchers at Paradigm Shift published a working exploit called usbliter8 that achieves arbitrary code execution inside the SecureROM of Apple A12 and A13 chips. Because the vulnerability resides in ROM burned at manufacture, it cannot be patched via software update. The attack requires physical USB access to the device.

Why it matters: Physical access requirement means the practical risk is insider threat or confiscation scenarios — review your mobile device policy for any iPhone XS/XR-era devices that may be enrolled in Intune and handling CUI, and consider whether those devices meet your acceptable hardware baseline.

Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites

A multi-nation law enforcement operation involving the Netherlands, Canada, Germany, and the U.S. dismantled infrastructure tied to the SocGholish malware distribution network and remediated nearly 15,000 infected WordPress sites. Authorities stated the action cuts off criminal access to compromised systems used as malware staging points.

Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys

Threat actors are actively exploiting CVE-2026-4020 (CVSS 5.3), an unauthenticated information disclosure vulnerability in the Gravity SMTP WordPress plugin installed on approximately 100,000 sites. Exploitation can expose configuration data, API keys, secrets, and OAuth tokens without authentication. A patch has been released.

Why it matters: If any public-facing WordPress instances exist in your environment or those of vendors with access to your systems, exposed OAuth tokens and API keys could pivot into connected services — check for this plugin and patch immediately or disable if not in active use.

Anthropic's Fable and the State of AI

Anthropic released its Fable generative AI model on June 9, 2026. Three days later, the U.S. government classified it as a dangerous munition under export control authority, prohibiting foreign nationals from accessing it. Unable to reliably distinguish domestic from foreign users, Anthropic suspended access entirely.

Why it matters: Export-control classification of AI models is a new compliance surface for CMMC environments — if your organization evaluates or integrates third-party AI models (including in your self-hosted AI stack), munitions classification creates an EAR/ITAR due-diligence requirement before deployment or access by any foreign nationals.

Senate Lawmakers Bring Back Acquisition Reforms Dropped from Final 2026 NDAA

Senate members have reintroduced acquisition reform provisions in the FY2027 NDAA that were cut from the FY2026 final bill during conference negotiations. The specific provisions were not detailed in the snippet but were described as reforms to defense acquisition processes.

Every AI Agent Is an Identity. Most Organizations Don't Treat Them That Way

Token Security published analysis arguing that AI agents — which can access data, trigger workflows, deploy code, and interact with business systems — represent ungoverned identities in most enterprise environments. The piece highlights gaps in access control, token management, and audit logging for agentic systems. Most organizations lack identity governance processes that extend to AI agents.

Why it matters: NIST 800-171 AC.1.001 and AC.1.002 require account management for all system users — regulators and auditors are beginning to interpret AI agents as system accounts, meaning your self-hosted AI stack likely has ungoverned identities that need to be inventoried and brought under your IAM controls before your next assessment.

Geopolitical Jitters Push Europe's Internet Registry Away from Cloud-First Strategy

RIPE NCC, Europe's regional internet registry, is reconsidering its cloud-first infrastructure strategy due to geopolitical concerns around data sovereignty and dependency on U.S.-headquartered cloud providers. The organization is exploring a more hybrid or on-premises approach for critical registry functions.