Week of June 22, 2026: FortiBleed Exposed; 8x8, River Financial Disclose Breaches

Security leaders faced a crowded stretch between June 22 and June 28, 2026, as the Five Eyes agencies issued a joint call to treat AI-driven cyber risk as a board-level issue, researchers detailed the full FortiBleed attack chain against FortiGate firewalls, and CISA added actively exploited Cisco and PTC flaws to its Known Exploited Vulnerabilities catalog. Public companies also filed back-to-back incident disclosures, with 8x8 reporting a Salesforce data theft through its Klue integration and River Financial Corporation confirming a ransomware deployment across its server environment.

Five Eyes Agencies Call AI-Driven Cyber Risk a Board-Level Issue

Leaders of the Five Eyes cyber security agencies, including CISA, released a joint statement on June 22, 2026, warning that artificial intelligence is accelerating the speed, scale, and sophistication of cyber threats faced by organizations worldwide. The statement urged boards and executives to treat cyber resilience as a core business risk rather than a technical afterthought, to assume breaches will occur, and to prioritize foundational security practices, patching, and identity controls ahead of expected advances in frontier AI models over the coming months. (CISA)

8x8 Discloses Salesforce Data Theft via Klue Integration

8x8, Inc. disclosed in a Form 8-K that an unauthorized third party exploited a Klue Labs integration connected to the company's Salesforce environment, gaining access between June 11 and June 12, 2026, and discovered on June 13, 2026. The attacker exfiltrated competitively sensitive information on current, former, and prospective customers, including fragmented contract and opportunity details, sales team notes, and contact information. 8x8 disabled the integration, is notifying regulators, and does not expect a material impact on its operations or financial results. (SEC EDGAR)

River Financial Corporation Confirms Ransomware on Bank Servers

River Financial Corporation disclosed in a Form 8-K that an unauthorized threat actor gained access to its network, including River Bank & Trust, around June 16, 2026. The company identified the activity on June 19, 2026, and determined that ransomware had been deployed across portions of its server environment. River disabled affected administrative accounts, took impacted systems offline, and brought in a third-party forensic firm. As of its June 25, 2026 filing, River had not yet determined whether the incident was reasonably likely to materially affect its business or finances. (SEC EDGAR)

CISA Adds Actively Exploited Cisco and PTC Flaws to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on June 25, 2026, after confirming evidence of active exploitation. The additions covered CVE-2026-12569, an improper input validation flaw in PTC Windchill and FlexPLM, and CVE-2026-20230, a server-side request forgery vulnerability in Cisco Unified Communications Manager. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of such flaws on internet-facing assets that could grant attackers full control after exploitation, and confirm whether systems were compromised before patches were applied. (CISA)

FortiBleed Leak Exposes Full FortiGate Attack Chain

Researchers at ZenoX and CloudSEK reconstructed the full attack chain behind the FortiBleed campaign after attacker tools, scripts, and credentials were left exposed on a server, revealing an automated pipeline that scanned for exposed FortiGate management interfaces, cracked credentials using rented GPU capacity, and in some cases achieved full domain-level control of victim networks. The June 23, 2026 report advised affected organizations to disconnect exposed devices, rotate all admin and VPN credentials, enable phishing-resistant multi-factor authentication, and audit Active Directory for signs of lateral movement. (Help Net Security)

CISA and FBI Update Alert on Russian Phishing of Messaging Apps

CISA and the FBI issued an updated Public Service Announcement on June 26, 2026, warning that Russian Intelligence Services continue to target accounts on commercial messaging applications through ongoing phishing campaigns. The update builds on a March 2026 advisory and adds recent tactics, sample phishing messages, and mitigation recommendations for federal, state, local, and industry organizations. The advisory reflects continued interest by Russian state-linked actors in compromising messaging app accounts used by government and critical infrastructure personnel. (CISA)

Operation Endgame Dismantles StealC and Amadey Infrastructure

Law enforcement and private-sector partners announced a follow-up Operation Endgame action on June 24, 2026, targeting the StealC and Amadey malware families that are often used together to steal passwords and sensitive data. The action took down 326 servers and 142 domains, and investigators froze more than 41 million euros in related crypto assets. Researchers at Proofpoint and IBM X-Force separately detailed a vulnerability in StealC's command-and-control panel that helped expose the malware's distribution network and its ties to ransomware payloads such as LockBit Black. (Help Net Security)

CISA Publishes SASE Guidance to Replace Legacy TIC Connections

CISA published new guidance on June 24, 2026, describing how federal agencies can adopt Secure Access Service Edge solutions under the Trusted Internet Connections 3.0 initiative as part of its Journey to Zero Trust series. The guide helps agencies move away from TIC 2.0's centralized, perimeter-based routing and replace legacy managed trusted internet protocol service connections with SASE architectures that improve network performance, reduce latency, and increase visibility. CISA said state, local governments, and critical infrastructure organizations may also find the guidance useful as they advance zero trust adoption. (CISA)