FortiBleed Exposes 73,000 VPN Logins

A security researcher discovered an exposed database containing login credentials for more than 73,000 Fortinet and FortiGate VPN devices, in plaintext, according to BleepingComputer. Big names show up in the data, including Chevron, Samsung, Toyota, and AT&T.

The attackers reportedly ran billions of password-guessing attempts against FortiGate VPNs, the boxes companies use to let employees connect securely from outside the office. Once a password worked, they grabbed login session data, cracked it with a cluster of graphics cards, and used the credentials to move deeper into company networks. They also left behind details on each victim's industry, revenue, and headcount, information that reads like a target list for follow-up attacks.

This is not a new software flaw. It is the result of weak or reused passwords being ground down at industrial scale, then the spoils left sitting on an open server for anyone to find.

What to do: If your organization uses a FortiGate VPN, assume your credentials may already be in this leak. Reset every VPN password today and require MFA, a second verification step beyond a password, for all VPN logins. If you are an individual employee, change your VPN password now and report any suspicious login alerts to your IT team immediately.

Researchers at Aikido Security found 15 malicious plugins on the JetBrains Marketplace, a store where developers download add-ons for their coding tools, according to The Hacker News. The plugins posed as AI coding assistants built on DeepSeek and other AI models, and they worked exactly as advertised: chat, code review, bug-finding, the works.

The catch was hidden underneath. Each plugin asked users to enter their own API key, a private password-like code that lets software talk to an AI provider on your behalf, then quietly sent that key to a server controlled by the attacker. Two of the plugins had more than 25,000 downloads each. Once attackers have your API key, they can run up usage charges on your account or access whatever data that key is connected to.

What to do: Only install developer plugins from the official publisher of the AI tool you actually use, and revoke any API key you entered into a third-party plugin you cannot fully verify.

What Cisco ISE is: Identity Services Engine (ISE) is software many large organizations use to control which devices and users are allowed onto their network.

What it is: An attacker who already has valid admin login credentials can send a specially crafted request that lets them run commands directly on the server's underlying operating system, then escalate to full root access (the highest level of control on the machine).

Who's at risk: Any organization running an unpatched ISE or ISE-PIC deployment where an attacker has obtained admin credentials, through phishing, credential leaks, or reuse from breaches like FortiBleed above.

CVSS: 9.1 (Critical) — patch today.

Root cause: The software does not properly check the input it receives in certain admin requests. Because that input is not validated, the system trusts data it should be inspecting first, similar to a guard waving through anyone holding a badge without checking if the badge is real.

Attack vector: An attacker with valid admin credentials sends a crafted HTTP request to the ISE server. The server processes it without proper validation, handing the attacker user-level access to the operating system underneath. From there, they escalate their own privileges until they control the entire machine as root.

Detection strategies: Watch admin account logs for unusual command-line activity following login, check for unexpected new processes running under the ISE service account, and review for failed escalation attempts that might signal probing before a successful breach.

Recommended actions:

1. Upgrade to ISE/ISE-PIC 3.3 Patch 11, 3.4 Patch 6, or the 3.5 hotfix (3.5 Patch 4 lands in August).
2. Restrict admin portal access to trusted internal networks only.
3. Enforce MFA on all ISE admin accounts and audit recent admin logins for anomalies.

If your organization runs a Fortinet or FortiGate VPN, do not wait for IT to mention it. Ask directly: has our VPN password been rotated since the FortiBleed leak?

Two steps matter most. First, every FortiGate VPN password should be reset, since the leaked database reportedly held working passwords for thousands of devices. Second, MFA, a second login step like a code from your phone, should be turned on for VPN access if it is not already. MFA means a stolen password alone is not enough to get in.

If you are not sure whether your company uses FortiGate, ask your IT contact today. This is the kind of leak that turns into a real breach only when nobody bothers to act on it.

CISA has added a maximum-severity Joomla plugin flaw, CVE-2026-48907, to its Known Exploited Vulnerabilities catalog and ordered U.S. federal agencies to patch it by Friday, June 19, 2026, according to BleepingComputer. The flaw lets attackers with no login at all upload and run malicious code on Joomla sites using the JCE editor plugin. If you run a Joomla website with this plugin, treat this the same way the federal government is: patch now, do not wait for a deadline that applies to someone else.