2026-06-24-de656486

• FortiBleed mechanism — contradiction resolved toward the primary reporting. SOCRadar's report (via SecurityWeek) and SpyCloud describe the access as SSH brute-force + the Golang FortigateSniffer + offline GPU cracking, with no new Fortinet CVE — consistent with the 2026-06-23 coverage. One reverse-engineering write-up framed the access around a legacy FortiOS path-traversal vulnerability; that mechanism is not corroborated by the SOCRadar reporting and is not asserted in § 4.
• UniFi OS exploitation sourcing. Active exploitation rests on the CISA KEV listing (CVE-2026-34908/-34909/-34910 added 2026-06-23, confirmed via the KEV bridge fetch this run). A dedicated exploitation write-up (PwnDefend, attributing a Mirai "zok" loader to the command-injection step) was unreachable this run (HTTP 503/403), so the Mirai-specific attribution is not independently re-verified and is omitted from § 5. BleepingComputer reports the set as "maximum severity" (no numeric score); the CVE records put the access-control and path-traversal flaws at CVSS 10.0, with some trackers listing the command-injection CVE-2026-34910 at 9.8 — the discrepancy does not change the pre-auth-to-root severity.
• Lantronix fix-version ambiguity. Forescout's April disclosure cites fixed firmware 2.0.0R1 for the EDS5000 series; secondary tracking around the KEV listing references later builds (e.g. 2.2.0.0R1). Operators should confirm against Lantronix's current advisory rather than a single version number.
• GMS AG (gms.net) — unconfirmed leak-site claim, not given item space. The Icarus extortion group listed a Swiss technology company "Gms-net" on ~2026-06-22, claiming Salesforce data exfiltration. Sourcing is the ransomware.live leak-site tracker and the DeXpose aggregator restating it: no GMS statement, no HIGH-reliability journalism, no regulator notice, and the cited sources do not substantiate the company's sector/role beyond "Swiss technology company." Below the PD-6 bar for a leak-site claim — recorded here for the Swiss nexus only; do not treat as a confirmed incident.
• Single-source items: Unit 42 cloud-bucket-hijacking research (§ 3, vendor lab, architectural — no named ITW exploitation); macOS ClickFix hdiutil variant (§ 3, BleepingComputer citing Unit 42 — the separate Unit 42 primary article for this specific technique was not located this run); Swiss Post Cybersecurity Swiss Threat Landscape Report (§ 3, vendor-authored, no independent corroboration yet, full report registration-gated); GMS listing (above).
• Research-pass note. The Unit 42 OpenClaw/ClawHub item and the FortiBleed scale figures were spot-checked by the main agent against the primary sources this run (both confirmed); the Cisco, Lantronix and UniFi non-NVD source URLs were re-pivoted to vendor/research/news pages because NVD per-CVE pages are not citable.
• Sub-agent note. The first S2 (Switzerland/Europe/public-sector) research worker returned with no findings written to disk; it was re-spawned and produced the two § 3 / § 4 CH items. The re-spawn confirms a genuinely thin in-window signal for CH/EU public-sector incidents — all national-CERT feeds (NCSC-CH, CERT-EU, CERT-FR, BSI WID-SEC, NCSC-NL) show their newest advisories dated 2026-06-17 to -22, outside the 36 h window.
• Coverage gaps: govcert-at (Austrian national CERT — TLS/DNS failure on the RSS endpoint, no usable alternate; not fetched this run); databreaches-net (article-level HTTP 403, mitigated via alternate publishers — content reached the brief); in-window-ch-eu-incidents (genuine thin-signal day, no fresh CH/EU public-sector incident in window); pwndefend (HTTP 503 on the UniFi exploitation write-up, covered via KEV + vendor/news).

Unmatched action items (migrated)

• Patch UniFi OS now on any internet-reachable console to 5.0.8 (UniFi OS Server) or the corresponding fixed 5.1.x build for your appliance (confirm the exact build per model against Ubiquiti's advisory), apply the full fixed version (the access-control flaw makes partial updates insufficient), and pull the management interface off the internet onto a segmented VLAN. Treat consoles exposed since 2026-06-23 as potentially compromised — pre-auth-to-root chain, CISA-confirmed exploitation (§ 5).
• Patch Lantronix EDS5000 firmware and segment serial-to-IP converters off any internet-reachable or flat OT segment; replace default credentials. First BRIDGE:BREAK CVE confirmed exploited (§ 2).
• Treat developer/CI hosts that installed postcss-minify-selector(-parser) or aes-decode-runner-pro as compromised — rotate browser-stored and developer credentials, and alert on node/npm parents spawning PowerShell and new HKCU\...\Run values (§ 1).
• Hunt for the WhatsApp→RMM chain: msiexec /quiet parented by wscript.exe/cscript.exe, writes to ...\Policies\System\ConsentPromptBehaviorAdmin, and ManageEngine DCAgentService.exe appearing with no provisioning ticket (§ 1).
• Run a retrospective Kerberoasting / replication-access hunt (EID 4769 anomalies, EID 4662) for any FortiGate exposed during the FortiBleed window, and enforce credential non-reuse between appliance and domain accounts (§ 4).
• Audit Salesforce Connected Apps (Setup → App Manager) for stale or over-scoped OAuth grants and monitor EventType=OAuthToken — the Klue/Icarus integration-abuse vector behind the 8x8 disclosure (§ 4).

Migrated from briefs/2026-06-24.md (v2).