🛡️ CISO Intel — Thursday, 25-06-2026

Blog generation failed — API error. Presenting Discord briefing as fallback.

🔴 Critical Threats & Active Exploitation

Cisco Unified Communications Manager — CVE-2026-20230 (High Severity) — Attackers are actively exploiting a high-severity Server-Side Request Forgery (SSRF) vulnerability. This allows remote, unauthenticated compromise, leading to potential lateral movement, interception of sensitive calls, and service disruption. Get the patch deployed yesterday. 📌 Source: TECHMANIACS.com — direct link unavailable

🛡️ CVEs Worth Your Attention

[Clear — enjoy it]

⚡ New TTPs & Attack Research

macOS ClickFix Campaign — A new campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. This bypasses user interaction, threatening IP and credentials on macOS endpoints. Attackers are getting clever with execution chains. (MITRE ATT&CK: T1566.001, T1204.002, T1059.004) 📌 Source: TECHMANIACS.com — direct link unavailable

🏗️ DevSecOps & Cloud Security

[Clear — enjoy it]

🔧 Patches & Vendor Releases

OpenAI GPT-5.5-Cyber — OpenAI has launched GPT-5.5-Cyber, a specialized Large Language Model for code security. It’s built for scanning, patching, and fixing vulnerabilities, boasting an 85.6% accuracy rate on the CyberGym benchmark. This is a solid step towards automated defensive capabilities. Rate: 🟢 solid fix 📌 Source: Shanaka — direct link unavailable

🧪 Threat Intel & Malware

FortiBleed Credential Harvesting — A financially motivated, Russian-speaking Initial Access Broker (IAB) is behind “FortiBleed,” a large-scale credential-harvesting operation. It has targeted over 430,000 FortiGate firewalls globally since February 2026, collecting credentials, brute-forcing systems, and deploying bespoke malware for widespread unauthorized access and data theft. If you have FortiGates, assume compromise. Nidec Taiwan Ransomware — Nidec Corp.’s Taiwan-based unit, Nidec Chaun Choung Technology, suffered a ransomware attack. The affected server and network were disconnected. Investigation is ongoing regarding potential data leaks. Another day, another manufacturing target. Microsoft Warns of CryptoBandits — Microsoft is warning about “CryptoBandits” malware actively draining cryptocurrency wallets. Protect those seed phrases and private keys. This isn’t theoretical. 📌 Sources: TECHMANIACS.com · 富途资讯 · Crypto News — direct links unavailable

🌐 Industry, Brand & Internet Security

Xsolis Healthcare Data Breach — Healthtech firm Xsolis reported a data breach impacting 1.4 million individuals. Initial access was through a phishing attack. Mass compromise of PII means long-term headaches for those affected. Tata Electronics Cyberattack & Data Leak — Tata Electronics confirmed a cyberattack that impacted parts of its IT infrastructure, leading to hackers leaking client documents linked to major companies like Apple and Tesla on the dark web. This highlights persistent risks in manufacturing and ICS/OT supply chains. Cardano SecondFi Wallet Exploit — The Cardano ecosystem saw a major security breach with over 16 million ADA tokens (approximately $20 million) stolen from user wallets. The exploit was traced to compromised seed phrases due to a vulnerability in SecondFi’s proprietary wallet generation software, not the Cardano base layer itself. 📌 Sources: TECHMANIACS.com · MEXC News · Crowdfund Insider — direct links unavailable

🤖 AI & LLM Security

Fake AI Agent Skill Bypasses Scanners — A security firm demonstrated that a fake AI agent skill could bypass popular skill marketplace security scanners and reach approximately 26,000 agents, including corporate accounts. It only collected email addresses, but the implications for data exfiltration are obvious. Don’t trust those marketplace “safe” badges. Anthropic Mythos Model for Offensive Security — Anthropic’s Mythos model, during Project Glasswing testing, identified vulnerabilities in U.S. classified systems within hours. It also uncovered a 27-year-old remote-crash zero-day in OpenBSD and a 16-year-old FFmpeg flaw. AI is accelerating offensive capabilities, shrinking our response windows. 📌 Sources: TECHMANIACS.com · Sandaruwan Shanaka — direct links unavailable

📋 Compliance & Regulatory

[Clear — enjoy it]

💡 Marcus’s Take

Another Thursday, another flurry. What stands out is the relentless focus on credentials and initial access, whether it’s the FortiBleed campaign or phishing leading to a 1.4 million record healthcare breach. Attackers are rational; they go for the easiest path to ROI. The AI security news is a double-edged sword: powerful new defensive tools emerge, but the ease with which malicious AI agents bypass security vetting is a stark reminder that new tech means new attack surfaces. Prioritize foundational security hygiene, especially credential management and phishing defenses. And for God’s sake, treat any third-party AI integration with extreme skepticism. Assume compromise until proven otherwise.