Week of June 15, 2026: FortiBleed Credential Leak and iRhythm Breach Disclosure

Security leaders spent the week of June 15, 2026 absorbing a sprawling Fortinet credential-exposure campaign that triggered a CISA hardening alert, a medical-device maker's SEC disclosure of a social-engineering breach, and an international takedown of the SocGholish malware network alongside a Google-attributed Chinese espionage campaign against medical research servers. CISA also added actively exploited Cisco SD-WAN and LiteSpeed flaws to its Known Exploited Vulnerabilities catalog, while researchers disclosed a critical SimpleHelp remote-management bug and documented a case of AI coding agents enabling a low-skilled attacker to breach fourteen companies.

iRhythm Holdings Discloses Material Cybersecurity Incident to SEC

iRhythm Holdings told the SEC it had determined that a cybersecurity incident identified on June 8, 2026 was material, based on the volume of potentially affected data. The medical device maker said a threat actor claimed to have obtained proprietary data, patient protected health information, and other personal information from third-party-hosted business applications, then demanded payment to avoid disclosure. The filing stated the incident did not affect clinical or medical device systems, manufacturing, distribution, or financial reporting operations, and that the company found no evidence of ongoing unauthorized access as of the filing date. (SEC EDGAR)

CISA Urges Hardening of Fortinet Devices After Mass Credential Exposure

CISA warned that malicious actors were abusing leaked credentials tied to roughly 74,000 Fortinet FortiGate appliances and SSL VPN gateways across government and private-sector networks, an activity it labeled FortiBleed. The agency directed affected organizations to terminate active VPN and administrative sessions, reset all Fortinet passwords, confirm use of the PBKDF2 hashing algorithm for administrator credentials, review firewall and authentication logs for lateral movement, enforce phishing-resistant multi-factor authentication, and restrict management interfaces from public internet access. (CISA)

CISA Adds Exploited Cisco SD-WAN and LiteSpeed Flaws to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-20262, a directory or path traversal flaw in Cisco Catalyst SD-WAN Manager, and CVE-2026-54420, a UNIX symbolic link following vulnerability in the LiteSpeed cPanel plugin. The agency cited its Binding Operational Directive 26-04, which requires federal civilian executive branch agencies to prioritize remediation of KEV-listed vulnerabilities that grant total control of an asset after exploitation, while encouraging all organizations to adopt the same risk-based patching approach. (CISA)

Operation Endgame Dismantles SocGholish Malware Infrastructure

An international law enforcement coalition operating under Operation Endgame took down 106 servers and domains tied to SocGholish, a long-running fake-browser-update malware operation linked to threat group TA569 and associated with Evil Corp, and cleaned nearly 15,000 compromised websites. The Dutch National Police announced the action, which followed years of SocGholish activity delivering infostealers and remote access tools through compromised WordPress sites. A related disinfection effort cleaned roughly 2,488 infected computers worldwide, and researchers said the campaign's web-inject infrastructure had likely controlled as many as a million sites over its history. (Help Net Security)

Low-Skilled Attacker Used Claude and Codex Agents to Breach 14 Companies

Researchers at OALABS recovered more than 1,000 AI agent sessions from a compromised server and found that a low-skilled attacker had used Anthropic's Claude Code and OpenAI's Codex to autonomously research targets, identify vulnerabilities, write exploit code, and harvest data across at least 14 breached companies. The attacker reportedly issued vague prompts and relied on the agents to supply technical execution, bypassing guardrails by framing requests as authorized red-team testing. Investigators traced the operator to an individual believed to be based in Addis Ababa, Ethiopia, after he inadvertently exposed personal identifying details to the AI agent. (Help Net Security)

Google Links Chinese Group to Year-Long REDCap Medical Research Breach

Google's Threat Intelligence Group attributed a cyber espionage campaign against North American medical research institutions to UNC6508, a China-linked actor that exploited vulnerable REDCap survey servers and remained undetected for more than a year, from September 2023 through at least November 2025. The group deployed custom malware called INFINITERED to harvest credentials and run commands, then used a compliance rule named "Patroit" to forward emails matching keywords tied to geo-strategic policy, military strategy, and medical research to an attacker-controlled Gmail account. Google said it disrupted the group's infrastructure and notified affected organizations. (Help Net Security)