Published Saturday, June 20, 2026 at 09:01 AM PT
20 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA
BLUF: FortiBleed actively compromising 86,644 FortiGate devices globally; GentleKiller EDR-killer now embedded in Gentlemen RaaS platform; your local stack has a critical multi-service outage and a possible kernel rootkit on pi requiring immediate investigation.
CYBER
FortiBleed / CVE-TBD: CISA issued advisory 19 JUN; 86,644 FortiGate devices confirmed exposed to credential/config exfiltration via memory disclosure vulnerability. Exploitation confirmed in-the-wild. Patch or isolate immediately if FortiGate present in environment. [CISA, The Hacker News] [HIGH CONFIDENCE]
GentleKiller EDR Framework: “The Gentlemen” RaaS group has integrated GentleKiller into affiliate tooling. Framework targets 400 distinct security processes for termination prior to ransomware deployment. Represents significant capability uplift for mid-tier affiliates who previously lacked EDR bypass. [The Hacker News, CSO Online] [HIGH CONFIDENCE]
Gravity SMTP WordPress Plugin (CVE pending): Active exploitation of information disclosure bug exposing SMTP API keys and OAuth tokens. Affects all sites running Gravity SMTP prior to patched version. If WordPress instances exist in your stack or client environments, treat as compromised until verified. [BleepingComputer, The Hacker News] [HIGH CONFIDENCE]
Klue OAuth Breach — Icarus Group: Victim list expanding. Icarus threat actor claimed responsibility for OAuth token theft affecting Klue and downstream SaaS integrations. OAuth chain compromise pattern consistent with prior supply-chain pivot campaigns. Audit OAuth grants on any SaaS tooling connected to Klue or similar competitive intelligence platforms. [BleepingComputer] [MODERATE CONFIDENCE]
usbliter8 / A12-A13 BootROM Exploit: Unpatchable checkm8-class exploit released for Apple A12 and A13 SoCs (iPhone XS through iPhone 11 generation). Requires physical USB access; not remotely exploitable. Relevant for device seizure scenarios, forensic bypass, and supply chain interdiction. [The Hacker News, The Register] [HIGH CONFIDENCE]
AutoJack AI Agent Attack: Proof-of-concept published demonstrating single malicious web page hijacking AI agent context to achieve host-level code execution. Relevant to any environment running autonomous AI agents with browser or tool-use capabilities. [The Hacker News] [MODERATE CONFIDENCE]
Large-Scale Credential Attacks — Security Vendor Devices: Unit42 published threat brief documenting coordinated credential stuffing campaigns specifically targeting perimeter security vendor management interfaces (firewalls, VPN concentrators, SASE platforms). Campaigns use distributed residential proxy networks to evade rate limiting. [Unit42] [HIGH CONFIDENCE]
Operation Endgame — SocGholish Disruption: Law enforcement action disrupted SocGholish C2 infrastructure; 14,971 WordPress sites cleaned. Threat not eliminated — SocGholish has reconstituted after prior takedowns. [The Hacker News] [HIGH CONFIDENCE]
MILITARY / GEOPOLITICAL
Iran-US MOU / Strait of Hormuz: US Navy lifted blockade of Strait of Hormuz following ceasefire memorandum of understanding between Washington and Tehran. USN ships remain on station for monitoring. Khamenei accepted deal while signaling intent to rebuild Hezbollah. [Task & Purpose, Long War Journal] [HIGH CONFIDENCE]
Gaza Negotiations: Hamas-Cairo talks ongoing; US-backed peace plan progress described as slow. Hamas disarmament terms remain primary sticking point. [Long War Journal] [HIGH CONFIDENCE]
Russia — Yasen-M SSN: Russia laid keel of ninth Yasen-M nuclear attack submarine 17 JUN. First new-start in six years. Signals resumed naval nuclear production capacity. [Defence Blog] [HIGH CONFIDENCE]
Russia — Mi-28NM EW Upgrade: Open-source imagery confirms Mi-28NM attack helicopters modified with new electronic warfare suite, assessed as counter-drone adaptation based on Ukraine operational lessons. [Defence Blog] [MODERATE CONFIDENCE]
Japan — Unidentified Aircraft at Gifu: Shrouded aircraft observed at Gifu Air Base 18 JUN. Consistent with advanced prototype or foreign evaluation aircraft. No confirmation of type or origin. [Defence Blog] [LOW CONFIDENCE]
US Army — 7th Infantry Division Multi-Domain Command Pacific: New unit activated, integrating drone swarm operations with Stryker maneuver brigades. Explicit Pacific/China contingency orientation. [The War Zone] [HIGH CONFIDENCE]
European Defense Industrial Ramp: Destinus (cruise missile engines) hit 1,000-unit production milestone. Eurosatory 2026 showcasing multiple new C-UAS and loitering munition systems (Rheinmetall CML, Valhalla Skythunder 300). European defense industrial base accelerating. [Defence Blog, MilitaryLeak] [HIGH CONFIDENCE]
PHYSICAL / LOCAL (Southern California)
NASCAR San Diego Race: Navy Reserve CDR Jesse Iwuji competing in historic NASCAR event in San Diego. Elevated public event; large crowd aggregation in San Diego metro. No specific threat reporting. [US Navy] NOSIG beyond standard event security posture.
Southern California Threat Environment: NOSIG. No significant reporting on physical threats to LA/SoCal infrastructure in ingested feeds past 24h.
NUCLEAR / WMD
Russia Skyfall (9M730 Burevestnik) — Technical Assessment: The War Zone published analysis concluding Skyfall nuclear-powered cruise missile uses direct-cycle engine design, meaning radioactive exhaust is vented continuously during flight. Operational use would constitute radiological contamination event along flight path. Assessment based on open-source technical analysis. [The War Zone] [MODERATE CONFIDENCE]
Russia Yasen-M SSN: See MILITARY above. Conventional nuclear-armed submarine; no indication of elevated nuclear readiness posture. [HIGH CONFIDENCE]
Iran: Post-MOU environment. No IAEA reporting of resumed enrichment activity in ingested feeds past 24h. [MODERATE CONFIDENCE]
LOCAL INFRASTRUCTURE — YOUR STACK (Wazuh / Big Brother / Syslog, last 24h)
CRITICAL — IMMEDIATE ACTION REQUIRED
Multi-Service Outage: mlx_chat, openwebui, searxng, tinychat all down simultaneously. Simultaneous failure of four services suggests common dependency failure (container runtime, shared volume, network bridge, or upstream model backend) rather than individual service crashes. 30 crash_storm events in syslog corroborate. Investigate shared infrastructure layer first. [Wazuh/BigBrother] [HIGH CONFIDENCE]
pi — Possible Kernel-Level Rootkit: Wazuh flagged kernel rootkit indicator on host
pi. This is an open incident. Given pi’s likely role as a low-visibility always-on device (Raspberry Pi class), it is a high-value persistence target. Treat as compromised. Recommended immediate actions: isolate from network segment, capture memory image if possible, do not trust binaries on host for investigation — boot from clean external media. [Wazuh] [MODERATE CONFIDENCE — rootkit detection has false positive rate, but cannot be dismissed]nuk — 1,543 SSH Events + Correlated Security Events: 1,543 SSH events in 24h on nuk is anomalous volume. Five correlated security events triggered warning. Could indicate brute force, scripted legitimate automation misfiring, or post-compromise lateral movement. Verify SSH source IPs — if external, block and rotate keys. If internal, identify the originating process. [Wazuh] [MODERATE CONFIDENCE]
wazuh.manager — Threat Score 45.0: Highest host threat score in environment. Manager itself showing elevated score warrants attention — confirm this is aggregated detection noise from its monitoring role and not indicator of tampering with the SIEM itself. A compromised SIEM is a blind SIEM. [Wazuh] [MODERATE CONFIDENCE]
itunes — Threat Score 20.0: Elevated. Likely low-severity but worth a glance given overall environment posture. [Wazuh] [LOW CONFIDENCE]
6 Sensitive Access Events: Logged across environment. Review access logs for which files/paths triggered. Context needed before assessing severity. [Wazuh]
448,913 syslog events / 73,711 warnings: Volume is high. The crash_storm events (30) are likely driving warning count. Confirm no volume_spike (1 flagged) is associated with data exfiltration or beaconing pattern on nuk or pi.
KEY JUDGMENTS
The simultaneous outage of four AI/chat services combined with a kernel rootkit indicator on pi and anomalous SSH volume on nuk represents a correlated local incident pattern that warrants treating the pi host as compromised until forensically cleared — the timing coincidence with the service outage is notable and should not be assumed benign. Externally, the GentleKiller EDR-killer’s integration into a mature RaaS platform materially lowers the barrier for affiliates to defeat endpoint detection, compounding the risk posed by the active FortiBleed campaign against perimeter devices; any organization running FortiGate without the patch applied should assume credential exposure. The Iran-US ceasefire reduces near-term Strait of Hormuz disruption risk to internet backbone and energy infrastructure, but Khamenei’s stated intent to rebuild Hezbollah and the slow Gaza negotiations indicate the regional threat environment remains structurally unstable.
Classification: UNCLASSIFIED // HANDLING: RECIPIENT ONLY Prepared: 20 JUN 2026 | Next update cycle: 21 JUN 2026 0600Z