← Latest security roundup All past issues

securitySaturday, June 20, 2026

Fortinet breach and AI-powered scams dominate security news

Today's security landscape is a tale of two threats: massive, old-school attacks on infrastructure and a new wave of AI-augmented social engineering. The Fortinet firewall compromise shows that traditional network devices remain juicy targets, while the rise of AI-generated phishing and MCP exploitation proves attackers are quick to adopt new tools. Even criminals are worried about AI taking their jobs.

Sources

Infrastructure under siege

The biggest story today is a massive credential theft from Fortinet firewalls, but it's not the only infrastructure attack making headlines.

#01www.theregister.comJun 20

Massive password-stealing attack hits 75k Fortinet firewalls

A massive attack on 75,000 Fortinet firewalls across 194 countries has stolen credentials from major corporations like FoxConn, Samsung, and Oracle, with some networks fully compromised.

3 min readRead original

#02labs.watchtowr.comJun 20

More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)

Ivanti Sentry has a pre-auth RCE vulnerability with a CVSS 10 score, a rare and critical flaw that attackers can exploit remotely without authentication.

9 min readRead original

#03briefly.coJun 20

Hackers are mass-exploiting a Gravity SMTP flaw to steal API keys from 100,000 WordPress sites

Hackers are mass-exploiting a Gravity SMTP WordPress plugin flaw on 100,000 sites to steal API keys, two months after the patch was released.

AI amplifies social engineering

Attackers are weaponizing AI to make scams more convincing, from personalized phishing to fake CAPTCHA malware.

#04cnet.coJun 20

Is That Call, Text or Email Real? Here’s How to Identify Scams

Scams are at an all-time high, with AI-generated phishing messages that are grammatically flawless and personalized, costing Americans $119 billion annually.

#05krebsonsecurity.comJun 20

ClickFix: How to Infect Your PC in Three Easy Steps

The ClickFix scam tricks users into pressing keyboard shortcuts to download malware, mimicking CAPTCHA tests and going mainstream after targeted attacks last year.

#06www.infosecurity-magazine.comJun 20

Cybercriminals Are Worried About AI Taking Their Jobs Too

Sophos research shows cybercriminals on dark web forums fear AI will automate hacking tasks and replace their manual services, mirroring legitimate industry concerns.

New vulnerabilities and exploits

A handful of critical flaws surfaced today, including an unpatchable Apple chip exploit and a novel phishing technique.

#07www.privacyguides.orgJun 20

Unpatchable Exploit Found Apple's A12 and A13 Chips

An unpatchable Boot ROM vulnerability called usbliter8 affects Apple's A12 and A13 chips, giving attackers persistent low-level access that even Apple can't fix.

#08isc.sans.eduJun 20

eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address

Phishers are using IPv4-mapped IPv6 addresses to bypass security controls that extract domains via regex, targeting a Belgian bank with a novel URL trick.

#09arstechnica.comJun 20

Apple patches high-severity eavesdropping vulnerability in Beats Studio Buds

Apple patched a high-severity eavesdropping bug in Beats Studio Buds after a 12-month disclosure, with researchers noting the attack chain could also leak call history and contacts.