ctipilot.ch

CTI Daily Brief — 2026-06-23

Typedaily
Date2026-06-23
GeneratorClaude Opus 4.8 (`claude-opus-4-8`)
ClassificationTLP:CLEAR
LanguageEnglish
Promptv2.64
Items8
CVEs17
On this page

On this page

Tags (20)
Regions (5)
References (29)

0. TL;DR

  • Gitea's Docker image shipped with REVERSE_PROXY_TRUSTED_PROXIES defaulting to the trust-all wildcard *, so anyone who can reach the container's HTTP port can forge an X-WEBAUTH-USER header and authenticate as any account — including admin — with no credentials (CVE-2026-20896, CVSS 9.8). BSI flagged it as "hoch" on 2026-06-22; Gitea is the self-hosted Git platform of choice for DACH/EU sovereign-cloud and public-sector DevOps. Patched in 1.26.3 / 1.26.4 (Gitea, 2026-06-21). See § 2.
  • Attackers compromised ShapedPlugin's Easy Digital Downloads update pipeline and backdoored three paid WordPress plugins (Product Slider Pro, Real Testimonials Pro, Smart Post Show Pro), harvesting admin credentials and 2FA secrets and dropping a self-deleting web-shell loader (CVE-2026-10735). Any site that took a Pro update between ~21 May and mid-June should be treated as fully compromised, not merely patched (Wordfence, 2026-06-22). See § 1.
  • SonicWall firewalls that were patched against CVE-2024-40766 are still being breached by Akira and Fog ransomware within hours — because the patch leaves behind the stale local accounts, implicit-VPN LDAP default groups, and un-enforced SSLVPN MFA that the intrusions actually ride. A fresh SANS ISC write-up names the exact residual misconfigurations to remediate post-patch (SANS ISC, 2026-06-23). Today's deep dive — § 5.
  • The FortiBleed credential-harvesting campaign got its first full tool-chain disclosure: a Golang "FortigateSniffer" that abuses FortiOS's native diagnose sniffer packet to capture auth traffic, a PCAP converter, and a 36-GPU offline-cracking cluster — with Fortinet confirming no new CVE, only credential reuse and brute force. The detection opportunity is the sniffer's own footprint (BleepingComputer, 2026-06-22). See § 4.
  • A 29-year-old heap over-read in Squid's FTP gateway ("Squidbleed", CVE-2026-47729) lets an attacker-controlled FTP server leak other proxy users' cleartext HTTP credentials and cookies; the upstream fix version is disputed (the maintainer cited 7.6 then 7.7, while SecurityWeek and Debian indicate the commit is already in 7.6, released 8 June). Shared school/university/government proxies are the exposure class (Calif.io, 2026-06-18). See § 3.

3. Research & Investigative Reporting

"Squidbleed" — a 29-year-old heap over-read in Squid's FTP gateway leaks other users' cleartext HTTP credentials (CVE-2026-47729)

Researchers at Calif.io disclosed CVE-2026-47729, nicknamed Squidbleed: a heap buffer over-read in the Squid proxy's FTP-over-HTTP gateway (src/FtpGateway.cc) introduced by a 1997 code commit (Calif.io, 2026-06-18; The Hacker News, 2026-06-22). The root cause is a whitespace-skipping loop that calls strchr(w_space, *copyFrom) without first checking for the string terminator: strchr returns a non-NULL pointer when the search character is the embedded \0, so the parser walks past the end of the FTP directory-listing buffer into adjacent heap memory containing other users' cached HTTP requests. An attacker who controls an FTP server and can induce the proxy to fetch from it (FTP support and TCP/21 are in Squid's default Safe_ports ACL) can leak Authorization headers, session cookies, API keys and other cleartext request content from concurrent users sharing the same proxy worker (SecurityWeek, 2026-06-22). HTTPS relayed via CONNECT tunnels is not exposed; only cleartext HTTP and TLS-terminating proxy setups are. SUSE rates it moderate (CVSS 6.5) and there is no confirmed in-the-wild exploitation. The fixed-version picture is disputed upstream: the patch was merged in spring 2026, but the Squid maintainer first attributed the fix to 7.6 (released 8 June 2026) then corrected that to 7.7, while Debian's assessment is that the referenced commit is already present in 7.6, and SecurityWeek reports the fix shipped in 7.6 (The Hacker News, 2026-06-22; SecurityWeek, 2026-06-22). The safe reading for defenders is to treat the fixed version as uncertain and verify against your own build rather than assuming a single release line is clean — see § 7. Calif.io credits an AI model (Anthropic's "Claude Mythos") with surfacing the strchr edge case during AI-assisted fuzzing — another data point in the AI-assisted-vulnerability-discovery pattern the W25 weekly tracked.

Why it matters to us: Squid is widely deployed as a forward / caching / web-filtering proxy across EU public-sector networks, university perimeters and ISP infrastructure — exactly the multi-user environments where the cross-user leak has impact. Interim mitigation that does not depend on resolving the fixed-version dispute: disable FTP proxying (acl ftp proto FTP + http_access deny ftp, or drop FTP from Safe_ports) where it is not needed, and restrict who can reach the proxy from untrusted/multi-tenant segments. Confirm the fix is present in your actual build (RHEL/Debian/Ubuntu ship 4.x–6.x — check for a backport) rather than trusting a version number. Detection: monitor Squid access.log for ftp://-scheme requests from unusual clients and for worker heap-corruption / crash signals (T1190 Exploit Public-Facing Application; effective outcome resembles T1040 Network Sniffing).

Elastic shows how the newly-GA Azure AD Graph Activity Logs close a long-standing Entra enumeration blind spot `[SINGLE-SOURCE]`

Elastic Security Labs published a detection-engineering guide (2026-06-19) on ingesting the newly generally-available AADGraphActivityLogs into SIEM/XDR to catch tooling that has historically been invisible (Elastic Security Labs, 2026-06-19). Although Microsoft deprecated Azure AD Graph in favour of Microsoft Graph, the legacy API remains live and is actively used by ROADtools (ROADrecon), AzureHound and AADInternals for Entra ID tenant enumeration — the classic pre-lateral-movement step in identity attacks. The new log source (available from early 2026) records every legacy-Graph call with UPN, client_id, user-agent, source IP, HTTP method, resource path and response code. Elastic's rules surface ROADrecon-pattern user-agents, anomalous 4xx bursts (permission probing), FOCI (Family Of Client IDs) mismatches that signal lateral movement, device-code-flow auth immediately followed by Graph enumeration, and unusual ASN origins for Graph calls. [SINGLE-SOURCE] — Elastic is a vendor lab, not a national CERT, so the carve-out does not apply; the underlying log source and detections are independently verifiable against Microsoft documentation (see § 7).

Why it matters to us: Entra ID is the identity backbone for Swiss federal and cantonal administrations, EU institutions and essentially every Microsoft 365 tenant, and legacy-Graph enumeration has been a genuine detection gap for years. The concrete action is cheap and high-value: enable AADGraphActivityLogs in Entra diagnostic settings and route them to your SIEM, then build (or import Elastic's) detections on userAgent.original, client_id against your known app registrations, and http.response.status_code 4xx spikes (T1590 Gather Victim Network Information, T1087.004 Account Discovery: Cloud Account, T1078.004 Valid Accounts: Cloud Accounts).

4. Updates to Prior Coverage

UPDATE: FortiBleed — first full tool-chain disclosure (FortigateSniffer, SNIFTRAN, GPU cracking cluster); Fortinet confirms no new CVE

UPDATE (originally covered 2026-06-18, last 2026-06-20): New analysis published 2026-06-22 gives the first complete tool-chain picture of the FortiBleed credential-harvesting campaign. The operators deploy a purpose-built Golang tool, FortigateSniffer, that abuses FortiOS's native diagnose sniffer packet diagnostic command to capture authentication traffic on a compromised FortiGate; a second tool, SNIFTRAN, converts the captured traffic to PCAP, which a Python toolkit then parses for cleartext credentials, NTLM hashes, Kerberos tickets and LDAP/SQL auth material across ~24 protocols (BleepingComputer, 2026-06-22; SOCRadar, 2026-06-16).

Fortinet's PSIRT response confirms the campaign uses no new vulnerability — it reuses credentials from the previously-disclosed CVE-2026-24858, CVE-2025-59718 and CVE-2025-59719 plus brute force against devices lacking strong passwords and MFA (Fortinet PSIRT, 2026-06-19; SecurityWeek, 2026-06-22). Reported tradecraft includes a distributed 36-GPU cluster — rented from a generative-AI provider, per BleepingComputer — for offline cracking of the harvested hashes; SOCRadar characterises the operators as Russian-speaking (SOCRadar, 2026-06-16).

The delta for defenders is a concrete detection surface that earlier coverage lacked: FortiOS audit-logs diagnose sniffer packet execution, so hunt for unexpected CLI sniffer invocations and stray PCAP files on the appliance, and — because harvested AD credentials are the downstream prize — treat all domain credentials on any FortiBleed-corpus device as compromised and force a domain-wide rotation, watching for anomalous Kerberos service-ticket requests (event 4769) and new-source Logon Type 3 events (4624) against privileged accounts. Upgrade to firmware with PBKDF2 password hashing to make offline cracking expensive, terminate active sessions, enable MFA and disable external management access.

UPDATE: Klue/Icarus OAuth-token breach — named victim list expands to nine firms, mostly cybersecurity vendors

UPDATE (originally covered 2026-06-21): At least nine Klue customers have now publicly confirmed Salesforce-CRM data impact from the 11–12 June Icarus intrusion: HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, Tanium, Insurity and Sprout Social (SecurityWeek, 2026-06-22). Exposed data is sales-account and contact information — names, business emails, job titles, phone numbers and addresses — exfiltrated via OAuth tokens from a dormant Klue→Salesforce integration; the actor (Icarus, also tracked as UNC6395) had set a 22 June publication deadline.

The concentration of cybersecurity vendors in the victim list is the notable delta: contact data for security-operations staff at those firms' customers now sits in a threat-actor corpus and is prime material for precision spear-phishing aimed at security roles. The structural lesson is unchanged from first coverage — enumerate and revoke unused third-party OAuth grants in Salesforce (Setup → Identity → OAuth Usage), scope active grants to minimum-necessary objects, and alert via Salesforce Event Monitoring on a connected app pulling thousands of account records in a single short session.

5. Deep Dive — SonicWall CVE-2024-40766: why patched firewalls keep falling to Akira and Fog

Background. CVE-2024-40766 is an improper-access-control flaw (vendor advisory SNWLID-2024-0015, CVSS 9.3) in the SonicOS management interface and SSLVPN across Gen 5/6/7 SonicWall firewalls, with patches available since August 2024. Through late 2025 it became one of the most reliable ransomware on-ramps in the field: Arctic Wolf documented an aggressive Akira campaign that used compromised SSLVPN credentials tied to the CVE to reach full ransomware deployment in an hour or less (Arctic Wolf, 2025-09-26). Nearly a year after the patch, the same device class keeps appearing in Akira and Fog intrusions — which is the puzzle a fresh SANS Internet Storm Center diary (2026-06-23) sets out to explain (SANS ISC, 2026-06-23).

The mechanism is post-patch residue, not an unpatched bug. The SANS ISC analysis makes the operationally important point explicit: organisations apply the firmware update but never complete the hardening that the update assumes, so the access paths the intrusions ride survive the patch (SANS ISC, 2026-06-23). SANS ISC further notes that on Gen 6 devices the firmware update alone is insufficient: a related SSLVPN MFA-bypass weakness (CVE-2024-12802) needs manual LDAP reconfiguration to close. Four residual misconfigurations recur:

  • Stale local accounts created during initial device setup that were never removed and whose passwords were never rotated — including after the CVE-2024-40766 patch, even though the flaw's impact is precisely unauthorised access to such accounts.
  • LDAP "Default Group" with implicit SSLVPN access, which silently grants VPN rights to potentially hundreds of Active Directory accounts without the administrator realising the membership scope.
  • Unenforced or misconfigured MFA on the SSLVPN portal, so a single valid credential is sufficient.
  • A publicly reachable Virtual Office Portal (the SSLVPN self-service / MFA-enrolment page), which exposes credential-stuffing and self-enrolment attack surface to the internet.

Kill chain. The pattern maps cleanly: initial access via valid SSLVPN credentials (T1133 External Remote Services, T1133) using stolen or stale T1078 Valid Accounts (T1078) — frequently T1078.002 Domain Accounts (T1078.002) when the LDAP default-group grant pulls AD identities into the VPN scope — followed by rapid lateral movement and Akira/Fog encryption (T1486 Data Encrypted for Impact, T1486). Arctic Wolf's "deploys ransomware in an hour or less" framing is the operational tempo to plan against: there is little dwell time in which to react once the VPN foothold is established.

Why it matters to us. SonicWall is a common branch-office and SMB perimeter firewall across Swiss cantonal/communal IT, healthcare and education networks — the exact mid-market public-sector estate this brief serves, and the kind of environment where a device was patched in 2024, ticket closed, and never revisited. The defender lesson generalises beyond SonicWall: applying a firewall patch for an access-control CVE does not rotate the credentials the CVE may already have exposed, nor does it close the misconfigurations that let a single credential become VPN access.

Detection concepts (no IOCs). Review SonicOS SSLVPN authentication logs (the SSLVPN auth events; SonicOS exposes these via syslog) for logons from stale/rarely-used local accounts and for sessions authenticated through LDAP groups that have not been recently reviewed; alert on Virtual Office Portal access from external source addresses; and aggregate SSLVPN login events into the SIEM so brute-force and credential-stuffing bursts are visible. Because the endgame is ransomware, pair perimeter telemetry with host detections for mass file-rename / encryption behaviour on file servers.

Hardening / mitigation. Per the SANS ISC and vendor guidance: upgrade to firmware 7.3.0+; rotate every SonicWall account password after patching (treat the CVE as a credential-exposure event, not just a code fix); enforce MFA on all SSLVPN users, explicitly including those whose access derives from an LDAP default-group membership; audit the LDAP Default Group and remove implicit SSLVPN grants; restrict the Virtual Office Portal to internal networks only; and enable logging for all SSLVPN login attempts.

6. Action Items

  • Patch self-hosted Gitea to 1.26.4 and fix the reverse-proxy trust scope now if you run the Docker image — set REVERSE_PROXY_TRUSTED_PROXIES to your exact proxy IP/CIDR, or disable ENABLE_REVERSE_PROXY_AUTHENTICATION if you don't use header-auth. CVE-2026-20896 is an unauthenticated admin-takeover (CVSS 9.8). See § 2.
  • Audit WordPress estates for ShapedPlugin Pro plugins (Product Slider Pro, Real Testimonials Pro, Smart Post Show Pro). If any was on a Pro update between ~21 May and mid-June, treat the site as fully compromised: update to fixed versions and rotate admin passwords, 2FA, DB credentials and wp-config.php salts; hunt for LicenseLoader.php and hidden woocommerce-subscription/woocommerce-notification plugins. See § 1.
  • Run the SonicWall post-patch hardening pass on any Gen 5/6/7 device patched for CVE-2024-40766: rotate all SonicWall account passwords, enforce SSLVPN MFA (including LDAP default-group-derived users), remove the LDAP Default Group's implicit VPN grant, and restrict the Virtual Office Portal to internal networks. Patching alone did not close the path Akira/Fog use. See § 5.
  • Hunt FortiGate appliances for abuse of diagnose sniffer packet and stray PCAP files, and force a domain-wide credential rotation for any device in the FortiBleed corpus — harvested AD credentials are the downstream prize. See § 4.
  • Disable FTP proxying on Squid (drop FTP from Safe_ports / http_access deny ftp) as an interim mitigation for Squidbleed. The fixed version is disputed upstream (7.6 vs 7.7), so confirm the fix is present in your actual build rather than trusting a version number. See § 3.
  • Enable AADGraphActivityLogs in Entra diagnostic settings and route them to your SIEM, then deploy ROADrecon/AADInternals enumeration detections (user-agent, client_id vs known apps, 4xx bursts). Low-cost closure of a long-standing identity blind spot. See § 3.
  • For ILIAS LMS operators (no patch available): apply WAF rules on the learning-progress endpoints, restrict them to enrolled roles, and verify the ILIAS DB account lacks FILE/DROP/superuser rights. Monitor BSI/GitHub for a fix. See § 2.

7. Verification Notes

  • Items dropped:
    • CVE-2026-20245 — Cisco Catalyst SD-WAN Manager CLI command-injection-to-root ("sixth SD-WAN zero-day of 2026"). Verified live (Cisco PSIRT advisory cisco-sa-sdwan-privesc-4uxFrdzx, dated 2026-06-05; SecurityWeek 2026-06-09; CISA KEV dateAdded 2026-06-09) but dropped on recency: the primary source is ~14 days old, with no fresh in-window exploitation or attribution delta. The only in-window anchor was the CISA-KEV remediation deadline of 2026-06-23 — a US FCEB compliance date with no jurisdictional weight for a CH/EU SOC and, per PD-13, never sufficient on its own to justify coverage.
    • DifyTap — CVE-2026-41947 / -41948 / -41949 (cross-tenant authorization flaws in the Dify AI platform, CVSS up to 9.4). Did not clear the § 2 inclusion gate (exploitation requires an authenticated editor; no in-the-wild exploitation reported), and the only reachable sourcing was an aggregator (The Hacker News) plus NVD — the Zafran Security primary write-up was not separately resolvable. Held for future coverage if a primary source or exploitation emerges.
    • Microsoft 365 Copilot — CVE-2026-54130 (CVSS 9.8) / CVE-2026-47645 (8.8), BSI WID-SEC-2026-2020. Microsoft mitigated both server-side with no customer action required, so neither meets the daily relevance bar (nothing to patch/hunt/block/detect). Noted only as a SaaS-attack-surface signal — EU public-sector M365 tenants should keep Copilot in their SaaS bulletin-monitoring scope.
    • AryStinger botnet (legacy D-Link / QNAP reconnaissance-and-proxy mesh). Re-surfaced by a sub-agent but already covered as the 2026-06-22 deep dive; excluded per PD-8 (no material in-window delta).
  • Single-source items: Elastic Azure AD Graph Activity Logs detection guide (§ 3) — Elastic is a vendor lab, so the national-CERT carve-out does not apply; the underlying GA log source and the described detections are independently verifiable against Microsoft documentation.
  • Reduced-confidence / disambiguation: ShapedPlugin sources reference both CVE-2026-10735 (CVSS 9.8) and a duplicate submission CVE-2026-49777 (CVSS 10.0); this brief uses CVE-2026-10735 as the canonical identifier. ILIAS CVE-2026-12789 (§ 2) sits below the standard § 2 CVSS/exploitation gate (CVSS v4 2.0, authenticated) and is retained on CH/EU-public-sector-education relevance grounds: BSI-flagged, no patch available, public PoC, and DACH-ubiquitous deployment.
  • Contradictions: TfL incident cost (§ 1) — the NCA primary press release states £29M in loss and recovery costs, while ITV and the BBC report £39M; the brief uses the NCA figure and flags the discrepancy. Squidbleed fixed version (§ 3) — sources disagree: the Squid maintainer first cited 7.6 then 7.7, Debian assesses the commit is already in 7.6 (released 8 June), and SecurityWeek reports the fix shipped in 7.6; the brief treats the fixed version as disputed and advises verifying against the actual build rather than a release number.
  • Stalled sub-agents: none — all four research sub-agents returned within the wall-clock budget.
  • Coverage gaps: databreaches-net (HTTP 403 on per-article drill — RSS feed reachable, article bodies blocked; rotation-priority); inside-it-ch (Cloudflare-gated; 2026-06-22 content was administrative IT-governance only, no in-window security items; rotation-priority); xlab-qianxin (blog 403 to bridge — AryStinger material reached via BleepingComputer); anssi-fr, ncsc-nl, cert-eu, cert-fr-actu (freshest advisories dated just outside the 36 h window); cnil-fr, ico-uk, sec-disclosures-edgar (no in-window enforcement actions or 8-K Item 1.05 filings).