Fortinet FortiSandbox Vulnerabilities Under Active Exploitation
Threat actors are rapidly exploiting multiple high-severity vulnerabilities in Fortinet’s FortiSandbox, a widely used sandboxing solution for malware analysis. According to reports, exploits targeting CVE-2026-39813 (path traversal in JRPC API allowing authentication bypass), CVE-2026-39808 (OS command injection), and CVE-2026-25089 (another command injection) have been observed in the wild over the past day.
These CVSS 9.1 flaws enable unauthenticated remote attackers to execute arbitrary commands or escalate privileges via crafted HTTP requests. Many were patched earlier in 2026, but unpatched systems remain at high risk, potentially allowing attackers to undermine sandbox protections and use compromised instances for further network compromise or to deliver “clean” malicious files to downstream Fortinet products.
Key Takeaway: Organizations using FortiSandbox (on-prem, cloud, or PaaS) should prioritize patching immediately and monitor for suspicious API activity. This highlights the ongoing challenge of timely vulnerability remediation in security infrastructure itself.
Ransomware Disrupts Australia’s Mackay Sugar Operations
Australia’s second-largest sugar producer, Mackay Sugar, was hit by a ransomware attack attributed to the group “The Gentlemen,” forcing the shutdown of key mills (Farleigh and Racecourse) and disrupting cane harvesting and processing.
The incident, first reported around June 10, 2026, led to manual operations at one mill to process existing cane and avoid spoilage. While full details on data exfiltration remain limited, the attack underscores ransomware’s impact on critical food supply chain infrastructure. The group added the victim to their leak site on June 15.
Key Takeaway: Critical infrastructure sectors like agriculture are prime targets. Incident response plans should include offline/manual failover capabilities and robust segmentation to limit operational disruption.
Massive Supply Chain Attack Compromises 400+ Arch Linux AUR Packages
In one of the largest incidents targeting the Arch User Repository (AUR), attackers hijacked over 400 (reports suggest up to 1,500) orphaned or abandoned packages. They modified PKGBUILD scripts to install a malicious npm package (”atomic-lockfile”) that deploys a Rust-based credential stealer and, in some cases, an eBPF rootkit for persistence on root-privileged builds.
The campaign, dubbed “Atomic Arch” by Sonatype researchers, primarily affects users building from AUR (not official Arch repos). Compromised packages harvest SSH keys, browser data, GitHub tokens, etc. Arch maintainers responded by resetting packages, banning accounts, and advising credential rotation.
Key Takeaway: Community repositories like AUR require vigilance. Users should review package diffs, avoid untrusted AUR builds where possible, and use tools to audit systems. This incident emphasizes supply chain risks in open-source ecosystems.
Other Notable Mentions (Cisco Zero-Day, Oracle Exploits, Chinese Espionage)
Cisco patched a Catalyst SD-WAN Manager zero-day (arbitrary file write) actively exploited in attacks.
ShinyHunters continued exploiting an Oracle PeopleSoft zero-day for data theft and extortion.
Ongoing Chinese (UNC6508) espionage targeting medical, military, and AI research in North America.
These reflect a persistent theme of zero-days, supply chain weaknesses, and nation-state activity.
Overall Insights: The last 24 hours reinforce that attackers target both security tools and critical ops, with rapid exploitation of known vulns and supply chain vectors. Patch aggressively, monitor AUR/build processes, segment networks, and maintain backups/offline capabilities.