22nd June – Threat Intelligence Report
This week’s Check Point Research roundup highlights multiple incidents and vulnerabilities affecting several vendors. A supply-chain attack targeting ShapedPlugin WordPress plugins delivered a hidden malicious WooCommerce component to steal admin, database, and 2FA credentials, while Fortinet FortiSandbox flaws CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 are reported as being exploited via unauthenticated API requests. Other actively targeted issues include Microsoft Defender CVE-2026-50656, Cisco Catalyst SD-WAN Manager CVE-2026-20262, and Splunk Enterprise CVE-2026-20253, where exploitation can enable privilege escalation or remote code execution—making patching and exposure review urgent.
For the latest discoveries in cyber research for the week of 22nd June, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
- Texas Parks and Wildlife Department has been affected by a third-party data breach involving its license system vendor. The incident exposed driver’s license information, passport numbers, emails, phone numbers, and residential addresses for 3,087,721 hunting and fishing license customers. Social Security numbers and payment data were not affected.
- ShapedPlugin, a WordPress plugin vendor, has faced a supply chain attack that delivered malicious updates for three paid plugins through its official updater. The malware installed a hidden fake WooCommerce plugin to steal admin, database, and 2FA credentials and modify affected websites. Incident analysis tied the compromise to vendor release infrastructure.
- iRhythm Technologies, a US digital health company focused on remote cardiac monitoring, has experienced a cyberattack involving third-party-hosted business applications. The company confirmed that attackers stole protected health information, proprietary data, and other personal data through a social engineering attack. Clinical systems were not affected.
- Market intelligence platform Klue has confirmed a breach after attackers used compromised legacy integration credentials to steal OAuth tokens connected to customer Salesforce environments. The tokens enabled theft of sales and customer data from several clients, including Huntress, Recorded Future, Tanium, and Jamf. The Icarus extortion group claimed responsibility.…