Weekly Threat Intelligence Digest — Jun 15 to Jun 22, 2026

Weekly threat intelligence digest from 427 items (42 critical, 176 high).

LIVETHREAT WEEKLY THREAT DIGEST June 15 – June 22, 2026 This week the data reinforced a growing reality: attackers are bypassing traditional “software‑only” exploits and striking where trust resides. Credential‑dump leaks (24 billion records), the FortiBleed exposure of 75 k+ firewall admin passwords, and multiple supply‑chain compromises (Klue OAuth abuse, WordPress plugin hijacks) all point to privileged access as the primary weapon. The ripple effect is evident across SaaS, cloud, and OT environments, turning a single mis‑configuration into a systemic breach. 👉 Access – not a vulnerability – is now the dominant risk driver. 🚨 EXECUTIVE RISK SNAPSHOT * Supply‑chain entry → MSP platforms, CI/CD pipelines, and SaaS admin consoles were the most common breach origins. * Privilege amplification → A hijacked admin credential opened pathways to 194 countries, exposing 75 k firewalls and enabling credential‑spraying against thousands of downstream assets. * Visibility gaps → OT/industrial controllers and third‑party APIs remain outside most asset inventories, leaving auditors blind to downstream exposure. 🔍 WHAT CHANGED THIS WEEK * Credential‑as‑commodity attacks surged: multiple “credential‑as‑a‑service” leaks (FortiBleed, 24 B record dump) fed automated password‑spraying campaigns. * Misconfiguration exploitation outpaced vulnerability exploits: 46 incidents stemmed from exposed cloud storage, Elasticsearch, or Joomla plugins, underscoring the need for continuous configuration hygiene. * Supply‑chain attacks moved from “one‑off” to “platform‑wide”: OAuth token abuse in Klue and malicious WordPress CDN updates demonstrated how a single third‑party breach can compromise dozens of customers. 🎯 WHERE YOU ARE MOST LIKELY EXPOSED * Cloud admin accounts on AWS, Azure, or GCP that lack MFA or just‑in‑time provisioning. * SaaS integrations that rely on long‑lived OAuth tokens (Salesforce, Klue, API providers). * Managed security or endpoint products (Fortinet, FortiGate, FortiSandbox) where default or weak admin passwords are still in use. * Industrial control systems (Rockwell Automation, AVer cameras) exposed through public‑facing misconfigurations. * Third‑party plugins for widely used platforms (WordPress, Joomla, CRM/ERP add‑ons). ⚡ WHAT COMPLIANCE & SECURITY LEADERS SHOULD DO THIS WEEK 1. **Re‑audit privileged‑access controls** – Verify that every admin account has MFA, least‑privilege scopes, and just‑in‑time access. 👉 Ask: “If an auditor demanded logs of privileged‑access usage this week, can we produce them?” 2. **Map third‑party dependencies to SOC 2 Trust Services Criteria** – Identify where vendor‑managed APIs touch CC6.1 (Logical Access) and CC7.2 (System Operations). Document contracts and monitoring requirements. #Compliance #SOC2 #AuditReadiness #Cybersecurity #ThreatIntel #ContinuousCompliance #LiveThreat #VerisqAI

Daily breach, advisory, and vulnerability briefs publish every weekday.