🦂 Scattered Spider Extradition, 🔴 FortiBleed-Lynx Link, 🏛️ DHS HSIN Breach, 🍫 ChocoPoC Malware, 🍎 Apple Email Leak

FortiBleed is the day's defining story. SOCRadar's follow-up ties the credential-theft campaign directly to the INC and Lynx ransomware operations, with evidence of the same individuals logged into both extortion panels. The scale is the headline: roughly 430,000 FortiGate firewalls were targeted, custom sniffers were deployed on about 19,000 devices to harvest VPN credentials in transit, and around 11,000 devices were still compromised after notifications went out. FortiBleed campaign

CISA added the SharePoint Server deserialization bug CVE-2026-45659 to the KEV catalog, an authenticated remote code execution reachable from site-member level, so unpatched SharePoint farms are an active risk. The Oracle EBS story continues: roughly 950 exposed instances, more than half in the United States, with exploitation so far reading as reconnaissance and weaponization testing. SharePoint RCE in KEV

Two items carry follow-on consequence. DHS confirmed the Homeland Security Information Network was breached between late May and early June, during the World Cup security period, with no attribution and an open question of what was exfiltrated. And the ChocoPoC campaign shows the supply chain has turned on its own: trojanized proof-of-concept repositories on GitHub deliver a Python RAT through malicious PyPI dependencies, with downloads surging after each high-profile disclosure.

Watchlist: FortiGate credential rotation and hunts for backdoor accounts, SharePoint and Oracle patch verification, and scrutiny of any PoC cloned from GitHub.