Reports indicate attackers created a database of more than 86,000 confirmed working credentials during the FortiBleed credential-harvesting activity. Fortinet’s response highlights the operational reality of these campaigns: even when exploitation focus shifts, stolen credentials and session reuse can keep pressure on exposed environments. For defenders, the key takeaway is to treat credential validation and rapid access revocation as part of the incident response, not just vulnerability remediation.
Source: Security Week
usbliter8: Unpatchable BootROM Exploit Extends SecureROM Risk to Apple A12/A13
Researchers have published usbliter8, an exploit affecting Apple A12 and A13 devices that achieves arbitrary code execution inside SecureROM. Because BootROM-class weaknesses can be difficult or impossible to remediate via software updates, this raises the stakes for device exposure and threat modeling—especially against targeted adversaries. Organizations with mobile management programs should review compensating controls (hardening, monitoring, and containment), and users of affected devices should be advised on risk exposure.
Source: Security Affairs
Boot Defense Bypass: New PoC Shows the Scope of the Apple Boot Risk
Security reporting notes that the vulnerability exploited by usbliter8 cannot be patched, and that a proof-of-concept is already in circulation. That combination—non-remediable impact plus public tooling—typically accelerates adoption by lower-skill actors and increases the likelihood of opportunistic attempts alongside targeted campaigns. The immediate defensive priority is to reduce attacker value (data access, credential exposure) and detect abnormal device behavior or downgrade/recovery paths.
Source: Security Week
Texas Parks & Wildlife Breach: Third-Party Vendor Compromised Systems, Affecting 3M+ Individuals
A breach of a third-party license vendor used by Texas Parks & Wildlife resulted in theft of personal information affecting about 3 million individuals. This is a classic supply-chain-linked incident: the agency’s direct environment may not be the origin point, but the downstream exposure can be massive and long-lived. The key lesson for cybersecurity leaders is to enforce vendor risk management that includes breach readiness—contractual reporting, segmentation expectations, and access controls across the vendor ecosystem.
Source: Security Week
More Klue Customers Affected: Expanding Impact After the Klue Hack
Additional cybersecurity firms have disclosed impacts related to the Klue incident, including HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium. For defenders, this reinforces how credential and data exposure incidents quickly propagate into broader trust and confidentiality concerns—especially when security tooling integrates with customers’ workflows and datasets. Incident response next steps should include confirmation of what was accessed, whether secrets were involved, and whether any downstream systems require forced credential rotation or re-scanning.
Source: Security Week
Encrypted DNS Still Leaks “Where”: Study Quantifies Metadata Exposure and IoT Impact
Even with DNS over TLS/HTTPS/QUIC, the encrypted payload hides query contents but plaintext packet headers can still reveal that a flow is DNS and helps an eavesdropper “where to look.” New research measures the privacy gap in the context of the Internet of Things and proposes ways to reduce some of that exposed information. The actionable takeaway: privacy improvements need attention to metadata, not just encryption of DNS payloads.
Source: Help Net Security
You May Also Be Interested In...
Canada’s Spy Agency Uses First-of-Its-Kind Warrant to Clean Botnet-Infected Devices
A Week in Security (June 15–June 21)
AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network