WEEKLY INTELLIGENCE BRIEFING

Critical FortiClient EMS Authentication Bypass Exploited in Wild. CVE-2026-35616 (CVSS 9.1) allows attackers to forge HTTP headers and gain full administrator access to FortiClient EMS without authentication. Active exploitation is deploying EKZ credential stealer malware disguised as legitimate Fortinet updates.

Palo Alto Networks PAN-OS Authentication Bypass Added to KEV. CISA added CVE-2026-0257 to the Known Exploited Vulnerabilities catalog after confirming active exploitation of the authentication bypass flaw.

Unpatched Gogs Zero-Day Enables RCE via Branch Names. A CVSS 9.4 vulnerability allows authenticated users to execute arbitrary code by injecting malicious branch names into pull requests, exploiting git rebase operations. The flaw remains unpatched despite March disclosure.

Pre-Auth RCE in Marimo Notebook Framework. CVE-2026-39987 (CVSS 9.3) enables unauthenticated attackers to achieve root code execution via a single WebSocket handshake in Marimo Python notebook environments.

Key Takeaway

Prioritize patching authentication bypass vulnerabilities in FortiClient EMS and PAN-OS immediately, as both are under active exploitation.

Charter Communications Confirms 42M Record Breach by ShinyHunters. The extortion group used voice phishing to compromise an employee's Microsoft Entra account in April, accessing Salesforce and stealing data on 4.9 million unique customers.

Brazilian Food Giant iFood Targeted in 43.8M Record Extortion. Threat actors claim to possess customer records including CPF national IDs, payment data, and personal information in ongoing extortion campaign.

Carnival Corporation Admits 6M Customer Records Stolen. Social engineering attack on April 14 led to ShinyHunters stealing customer names, addresses, dates of birth, and government ID numbers from the cruise operator.

Silent Ransom Group Escalates to Physical Data Theft. The FBI warned that threat actors are now sending operatives in person to company offices to steal data directly, marking a dangerous escalation in ransomware tactics.

Key Takeaway

Implement stronger social engineering defenses and employee training, as voice phishing continues driving major breaches.

Malicious VS Code Extension Compromises GitHub Employee. The poisoned Nx Console extension (v18.95.0) was distributed via automatic VS Code updates, compromising a GitHub employee's device and exposing internal repositories.

33 Malicious npm Packages Target Developer Environments. Microsoft discovered packages exploiting dependency confusion to profile environments and steal cloud credentials via organizational namespace impersonation.

Megalodon Campaign Injects Malicious GitHub Actions. Attackers are compromising CI/CD pipelines by injecting malicious workflow files to harvest secrets and cloud credentials from GitHub repositories.

Fake Sicoob SDK Exfiltrates Banking Certificates. Malicious NuGet package targeted Brazilian banking infrastructure, stealing PFX certificates and authentication material through spoofed publisher identity.

Key Takeaway

Implement package pinning, dependency scanning, and credential rotation policies to defend against the surge in supply chain attacks.

Russian Intelligence Escalates Western Technology Theft. Intelligence agencies are using fake companies and cyber operations to target advanced manufacturing, space technology, and quantum research as sanctions strain Moscow's economy.

GreyVibe Uses AI to Supercharge Ukrainian Cyberattacks. The Russia-linked group leverages ChatGPT and Gemini across all attack phases, from phishing lure creation to custom malware development (PhantomRelay, LegionRelay, Fallspy).

Pentagon Confirms Adversaries Tracking Troops via Commercial Data. Foreign intelligence services are purchasing US military personnel location data and health records for as little as 12 cents per record to target troops in the Middle East.

Key Takeaway

Restrict commercial data broker relationships and implement stronger OPSEC training as adversaries exploit civilian data ecosystems.

• https://darkwebinformer.com/one-forged-header-unauthenticated-authentication-bypass-in-fortinet-forticlient-ems-cve-2026-35616/
• https://www.bleepingcomputer.com/news/security/charter-communications-data-breach-affects-49-million-accounts/
• https://www.cisa.gov/news-events/alerts/2026/05/28/supply-chain-compromises-impact-nx-console-and-github-repositories
• https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/
• https://www.securityweek.com/russia-linked-greyvibe-attackers-use-ai-to-supercharge-cyberattacks/
• https://www.securityweek.com/california-sues-23andme-alleging-it-failed-to-protect-user-data-in-2023-breach/
• https://www.wired.com/story/the-pentagon-knew-enemies-could-track-troops-phones-for-years-now-they-are/
• https://cyberscoop.com/nist-nvd-audit-mismanagement-duplication/