FortiBleed: Russian-speaking group has amassed working login credentials for tens of thousands of…

FortiBleed: Russian-speaking group has amassed working login credentials for tens of thousands of Fortinet firewalls

In today’s Security Sunday, we’ll look at data leaks from the Fortinet firewall alias Fortibleed, an unfixable bug in the iPhone 11, two serious bugs in NGINX, and an actively exploited vulnerability in the Joomla Content Editor.

SOCRadar and independent researcher Volodymyr “Bob” Diachenko have uncovered a large-scale and still-active campaign that SOCRadar has named FortiBleed. The attackers have been systematically and automatically compromising internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways over a long period, building a verified database of working credentials across 194 countries.

The figures on the scale differ between sources. SOCRadar has gradually raised the number of compromised devices from an initial 30,791 to 86,644 (as of 19 June 2026). Diachenko, the firm Hudson Rock, and researcher Kevin Beaumont report approximately 73,932 unique devices across 21,632 domains, which according to Beaumont corresponds to roughly half of all internet-accessible Fortinet firewalls based on Shodan data.

Diachenko himself describes that the group tested around 1.16 billion username-and-password combinations against roughly 320,000 FortiGate targets, and in parallel ran brute-force attacks against more than 160,000 MSSQL servers as well.

The attack does not rest on a single vulnerability. The group tries a list of previously leaked passwords from earlier incidents (so-called credential stuffing) against the devices and supplements it with brute-force attacks. From the compromised devices it exfiltrates configuration files, from which it then cracks the stored password hashes offline.

Practically every sector is represented among the victims: banks, telecommunications operators, hospitals, universities, government institutions, the energy sector, and multinational corporations. The leak also reveals the names of large companies such as Samsung, Oracle, Siemens, Lenovo, and Spotify. In the Czech Republic we can see data linked to, for example, PPF, Autocont, municipalities, and schools. In several cases, successful pivoting within the victim’s network was also confirmed.

According to SOCRadar, the tools, infrastructure, and victim selection match a Russian-speaking cybercriminal group with several operators.

At the time of this Security Sunday’s publication, the campaign is still running and the attackers keep adding new targets.

iPhone 11 with an unfixable flaw: new usbliter8 exploit bypasses SecureROM in two seconds

A hardware vulnerability is once again in the spotlight of security researchers. On 18 June, the Paradigm Shift team published an exploit called usbliter8, which targets the SecureROM (BootROM) of Apple A12 and A13 chips and allows arbitrary code execution even before the signed operating-system boot chain is loaded.

It is the first publicly known BootROM exploit of this kind since checkm8 in 2019, which at the time affected devices with A5 through A11 chips.

The key problem is that SecureROM is the first code that runs after the device powers on and is irreversibly burned into the silicon during manufacturing. Because of this, it cannot be fixed by any software update, so affected devices will carry this flaw for their entire lifespan.

In practice this means a wide range of devices: iPhone XS, XS Max, XR and the entire iPhone 11 line, Apple Watch Series 4 and 5, the first-generation Apple Watch SE, HomePod mini, and some iPad models.

Notably, the iPhone 11 (A13 chip) is also the oldest iPhone that still supports iOS 26. Many affected devices are therefore still in active use and running the current system.

F5 patches two serious flaws in NGINX. HTTP/3 and HTTP/2 modules allow remote code execution

On 17 June, F5 released out-of-band security updates that address two vulnerabilities in the NGINX web server. Both flaws can help an unauthenticated remote attacker crash the server (DoS) or, under specific conditions, achieve remote code execution (RCE).

The first and more serious flaw, CVE-2026–42530, is a use-after-free (CWE-416) in the ngx_http_v3_module, i.e. the implementation of the HTTP/3 protocol over QUIC. If the server has HTTP/3 enabled, a remote unauthenticated attacker can use a specially crafted HTTP/3 session to force NGINX to reopen the QPACK encoder stream — which, per the specification, should happen only once within a single connection. This creates a situation where the worker process accesses already-freed memory, crashes, and automatically restarts (repeatedly producing a DoS).

The second flaw, CVE-2026–42055, is a heap-based buffer overflow (CWE-122) in the ngx_http_proxy_v2_module and ngx_http_grpc_module, which manifests when proxying traffic over HTTP/2 to an upstream. Here three conditions must be met simultaneously: use of the grpc_pass directive or proxy_http_version 2, the ignore_invalid_headers directive set to off, and a large_client_header_buffers value greater than 2 MB. Only then can an attacker send HTTP/2 traffic that causes memory corruption resulting in a worker crash.

It needs to be said that this does not concern every NGINX server in the world. Both vulnerabilities are reachable only under a non-standard configuration, and for one of them the range of affected versions is fairly narrow.

The fixed versions are NGINX Open Source 1.31.2 (mainline) and 1.30.3 (stable).

CISA warns of an actively exploited vulnerability in Joomla Content Editor allowing remote code execution without authentication

On Tuesday 16 June, the U.S. agency CISA added a critical vulnerability to its Known Exploited Vulnerabilities (KEV) catalog — affecting the Widget Factory Joomla Content Editor (JCE) extension — citing evidence of active exploitation.

The flaw, tracked as CVE-2026–48907, received a CVSS score of 10.0 and is a case of improper access control (CWE-284). According to the description published on CVE[.]org, the problem allows an attacker to create new editor profiles for unauthenticated users, which opens the path to uploading and executing PHP code on the server.

According to W3Techs data, Joomla powers roughly 1.2% of all websites, making it the fifth most-used content management system, and JCE is among its most widespread add-ons.