🚨 Splunk RCE exploited, 🛡️ SocGholish takedown, 🔑 Klue OAuth breach, 🐛 Squidbleed, 💰 Accenture $4.18B OT play, 🎯 Popa botnet

CISA's addition of the Splunk Enterprise pre-auth RCE to its Known Exploited Vulnerabilities catalog is the day's defining story: the first Splunk CVE ever listed, it carries a three-day federal remediation deadline under BOD 26-04, and Splunk has confirmed limited exploitation. The Splunk Enterprise RCE (CVE-2026-20253, CVSS 9.8) lets unauthenticated attackers create or truncate arbitrary files through an unauthenticated PostgreSQL sidecar endpoint, and a full exploit chain appeared two days after the June 10 advisory. The platform at the center of most SOCs is now a confirmed target.

CISA formally warned Fortinet users after the FortiBleed leak of nearly 74,000 firewall and VPN credentials, calling for session termination, password resets, phishing-resistant MFA, and removal of management interfaces from the public internet. CISA's FortiBleed warning. Separately, Operation Endgame cleaned SocGholish infections from 14,971 WordPress sites and seized 106 servers.

The Icarus group's Klue OAuth breach shows how third-party integrations become token-theft surfaces: stolen OAuth tokens let attackers pull Salesforce data from multiple customers, Huntress included, before Salesforce disabled the integration platform-wide. The Popa botnet was traced to NetNut, the residential proxy arm of publicly traded Alarum Technologies. TeamPCP's spree now covers more than 1,000 packages across npm and PyPI, ESET documented eight GentleKiller EDR-killer variants targeting 48 security products, and Squidbleed (CVE-2026-47729) leaks memory from every Squid version through a 29-year-old parser bug.

Watchlist: patch Splunk and Fortinet edge devices now, rotate credentials, review Salesforce OAuth integrations, disable Squid FTP, and hunt BYOVD indicators from the GentleKiller toolkit.