The Edge Has Teeth: appliances, agents and control planes are now board-level cyber risk.
Week ending 26 June 2026 | Five-minute CISO briefing
Figure 1. White-background editorial hero image created for this issue.
| Editorial thesis This week was not about one spectacular breach. It was about a structural shift: attackers are finding leverage in the systems that define trust itself – edge devices, management consoles, ERP platforms, identity flows, AI agents and collaboration tools. The moat did not vanish; it became a stack of admin panels with feelings. |
What happened in the last week
The uncomfortable theme for CISOs this week is that defensive infrastructure has become offensive infrastructure when it is badly governed, externally exposed or credential-poor. FortiBleed reporting described a large credential-harvesting operation against FortiGate environments rather than a tidy single-CVE story; SecurityWeek cited SOCRadar reporting that more than 430,000 FortiGate firewalls were within campaign scope and more than 110 million credentials may have been compromised (Arghire, 2026a). Fortinet, importantly, pushed back on the idea of a new vulnerability, saying the activity involved reused credentials and brute force against weak password hygiene and no MFA (Arghire, 2026b). The CISO lesson is not kinder: whether the door opened through a zero-day or a recycled admin password, the attacker still got a door.
Mandiant then added a sharper edge to the story. Its Cisco Catalyst SD-WAN Manager investigation showed a threat actor escalating from a compromised administrative account to root through CVE-2026-20245, while using rogue peering, credential manipulation and anti-forensic cleanup (Mandiant, 2026a). The phrase that should make boards pay attention is “living off the edge”: Mandiant warned that network appliances often lack the telemetry required for deep forensics while acting as central control planes for enterprise traffic (Mandiant, 2026a). In other words, the place you trust most may be the place you observe least. Excellent. Very relaxing.
The application layer did not behave either. Mandiant and Google Threat Intelligence attributed an active Oracle PeopleSoft compromise and extortion campaign to UNC6240, also known as ShinyHunters, involving CVE-2026-35273, a critical remote code execution flaw exploited as a zero-day before Oracle’s advisory; more than 100 organizations were notified and 68% of exposed organizations were in higher education (Mandiant, 2026b). The attackers’ use of MeshCentral agents disguised as cloud services was a reminder that “remote management” and “remote compromise” can look depressingly similar when viewed through a noisy log pipeline.
Meanwhile, AI moved from boardroom abstraction into operational tempo. The Five Eyes cyber agencies warned that AI is already accelerating the speed, scale and sophistication of cyber threats, shrinking the window between vulnerability discovery and exploitation (Australian Signals Directorate [ASD], 2026a). Google Threat Intelligence reported that it had identified a threat actor using a zero-day exploit it believed was developed with AI, and highlighted autonomous malware operations as an emerging pattern (Google Threat Intelligence Group [GTIG], 2026). Darktrace’s 2026 research found that 87% of security leaders say AI is significantly increasing the number of threats requiring attention, while 92% are concerned about AI agents across the workforce (Darktrace, 2026).
This week’s board-level signals
| Signal | Why CISOs should care | Monday morning test |
| FortiBleed credential harvesting | A security appliance can become a credential capture platform. Identity exposure now includes traffic passing through the edge. | Can we list exposed firewall/VPN management interfaces, account owners, MFA status and recent suspicious admin access in one hour? |
| Cisco SD-WAN zero-day | Control-plane compromise can quietly alter trust relationships and undermine branch connectivity, routing and forensic certainty. | Do network controllers generate logs we can preserve, search and correlate without relying on the device being honest? |
| PeopleSoft extortion | ERP systems combine old exposure, privileged integrations and high-value personal data. They are not boring; they are extortion-ready. | Which business-critical apps have externally reachable admin or integration endpoints and outdated compensating controls? |
| Teams and browser abuse | Trusted collaboration and browser workflows are being turned into malware delivery systems that look like normal work. | Can we detect new RMM installs, native messaging host changes and unusual browser extension loads on privileged endpoints? |
| AI-accelerated offense | AI changes remediation economics by compressing discovery-to-exploitation windows and lowering adversary skill barriers. | Which vulnerability classes get emergency handling because they are externally reachable, automatable and control-plane significant? |
| Australia baseline evolution | ASD’s Essentials direction signals a shift from checklist maturity toward domain-specific, context-aware resilience. | Are our baselines mapped to cloud, OT, SaaS and AI reality, or to a network architecture from a happier decade? |
Figure 2. Threat map showing how this week’s signals converge around trust, control planes and observation gaps.
What did we learn?
1. Infrastructure is identity now.
Firewalls, VPNs, SD-WAN controllers, device servers and cloud access brokers do not merely pass packets; they authenticate, route, authorize, log and sometimes decrypt the business. That makes them privileged identity processors. A compromised firewall is not a network incident with identity side effects. It is an identity incident wearing a rack-mount disguise.
2. Telemetry-negative assets are governance debt.
The weakest point in many incident narratives is not the exploit itself; it is the uncertainty afterward. If a platform can grant root, change routing, peer with other devices or observe credentials, but cannot provide durable, exportable, correlated logs, then it is not just a technical gap. It is a board-level evidence problem.
3. Patch velocity is becoming a business constraint.
Krebs described June 2026 as a record-breaking Microsoft Patch Tuesday, with nearly 200 Microsoft security holes and almost three dozen rated critical (Krebs, 2026). Add Chrome, curl, Splunk, Cisco, Ubiquiti and Fortinet-adjacent signals, and the old SLA question – “Did we patch criticals in 14 days?” – starts to sound quaint. The better question is, “Which exposed systems let an attacker become us?”
4. AI is not a cyber category; it is a tempo modifier.
AI will not politely stay inside an “AI risk” spreadsheet. It affects phishing, exploit development, malware variation, vulnerability triage, defensive detection, analyst workflow and business automation. The University of Toronto AI-worm research remains a controlled proof of concept, not an in-the-wild worm, but its result is strategically important: in isolated trials, an AI-driven worm exploited 73.8% of the test network and replicated to 61.8% over seven days (Fang et al., 2026). That is not a reason to panic. It is a reason to redesign assumptions.
5. Compliance baselines are being dragged toward reality.
CISA’s SASE/TIC 3.0 guidance, NIST’s updated IoT product guidance, and ASD’s Essential Eight evolution all point in the same direction: static, one-size baselines are not enough for cloud, OT, edge devices, SaaS, AI agents and remote work. Compliance is becoming less about having a control and more about proving the control works under pressure (ASD, 2026b; Fagan, 2026; Markon, 2026).
Figure 3. Living-off-the-edge kill chain for explaining infrastructure compromise beyond CVSS scores.
What to watch out for
The biggest risk this week is not missing one patch. It is treating the new pattern as a patching problem only. Fortinet’s response to FortiBleed urged termination of sessions, credential rotation, MFA, review of accounts/configurations and restricting external management (Arghire, 2026b). Mandiant’s Cisco guidance similarly emphasized IOC sweeps, threat hunting, remediation support and hardening/logging guidelines, not just software upgrades (Mandiant, 2026a). That is the difference between “we updated the box” and “we know the box did not become a hostile witness.”
Collaboration and browser attacks deserve special attention. Cyber Security News reported a fake Microsoft Teams notification campaign leading users to install a signed remote monitoring and management tool configured for attacker control (Dutta, 2026a). It also reported the Edgecution campaign, where fake IT Teams messages pushed a malicious Edge extension and abused Chrome native messaging to pass commands from an extension to a Python backdoor outside the browser sandbox (Dutta, 2026b). This is not “user clicked bad link” nostalgia. It is trust chaining: familiar app, plausible IT story, signed tool, legitimate cloud transport, real administrative capability.
The AI-agent attack surface is no longer just prompt injection. SecurityWeek’s expert coverage this week framed information itself as an attack surface for AI agents, from hidden content injections to cognitive state poisoning, while also warning that AI-driven development must be governed rather than blocked (SecurityWeek, 2026a). Darktrace’s survey numbers show why: defenders are adopting AI because it improves speed and efficiency, but the same organizations are concerned about sensitive data exposure, third-party LLMs and agentic systems (Darktrace, 2026). The practical CISO position is not anti-AI. It is anti-unobserved-AI-with-production-permissions. Admittedly less catchy on a mug.
CISO watchlist for the next seven days
| Area | Trigger | Leadership question | Owner to involve |
| Edge and VPN | Any external management, VPN portal, SD-WAN controller or appliance in KEV/news coverage. | Would compromise change traffic, credentials or visibility? | Network, IAM, SOC, IR |
| ERP and high-value apps | PeopleSoft, payroll, student, HR, finance or customer platforms exposed to the internet. | Which integration token would hurt most if stolen? | App owners, legal, privacy |
| Browser and collaboration stack | New RMM tools, native messaging hosts, unusual extensions, Teams external contacts. | Can helpdesk impersonation be detected as an event type? | Endpoint, M365, service desk |
| AI agents | Any agent with tool use, production data, workflow automation or customer interaction. | Can we replay what it saw, decided and did? | AI platform, data, risk |
| Vulnerability management | CVEs involving control-plane access, unauthenticated RCE, active exploitation or public exploit code. | Do we prioritize by attack path, not just CVSS? | VM, architecture, ops |
| Australia and regional trust | Education, real estate, public sector and critical-infrastructure incidents. | Are local data-heavy sectors covered by global IR playbooks? | Regional CISO, comms, privacy |
Trending issues: the bold CISO conversation
The week’s most useful provocation is simple: stop asking whether AI will replace analysts; ask which production decisions an AI agent is already making without evidence-grade logging. The Five Eyes statement explicitly says cyber risk assumptions can become outdated in months, not years, and urges leaders to integrate cyber security into core business strategy rather than treating it as a technical sidebar (ASD, 2026a). That has practical implications. If an AI agent can read documents, call APIs, write code, update tickets, approve workflows or summarize customer data, then it is part of the control environment. It needs an owner, scoped permissions, data boundaries, monitoring, test cases and a kill switch.
The second conversation is vulnerability economics. Krebs linked the June Microsoft patch volume to AI-assisted bug finding and warned that heavy Patch Tuesdays may become the norm (Krebs, 2026). Google’s AI threat reporting showed adversaries using AI for vulnerability research, exploit development, malware operations and supply-chain targeting of AI environments themselves (GTIG, 2026). That combination should make CISOs evolve vulnerability management from a scanner-output function to an exposure-decision function. The operating model must know what is reachable, what is exploitable, what grants control, what exposes identity, and what would create operational loss.
Figure 4. AI governance needs runtime controls, not just policy acknowledgements.
Latest in People, Process, Technology and Compliance
Latest in People
SecurityWeek’s people moves showed CISOs arriving at Fable Security, iCOUNTER and 1Kosmos, with additional leadership movement in federal identity and security-adjacent roles (SecurityWeek, 2026b). The signal is not the names alone; it is the market. Security leadership is being pulled closer to identity assurance, product trust, federal programs and business execution. In Australia, the Australian Computer Society named Dr Prins Ralston as chief executive, another sign that cyber, digital capability and workforce strategy are increasingly entwined (Cyber Daily, 2026a).
Latest in Process
CISA’s new SASE/TIC 3.0 guide is a process story disguised as an architecture story. It helps agencies move away from legacy perimeter routing and toward zero-trust-aligned architectures with greater visibility and control, and CISA said the guidance may benefit state, local and critical-infrastructure entities as well (Markon, 2026). NIST’s updated IoT guidance similarly reframes IoT products as elements in risk management rather than as isolated gadgets (Fagan, 2026). The process lesson: architecture committees now need threat intelligence at the table, not just reference diagrams.
Latest in Technology
Technology leaders are under pressure to adopt AI and resilience tools without creating an accountability fog. Darktrace reported broad agreement that AI can improve speed and efficiency in security operations, with major impact areas including threat detection, automated response and vulnerability management (Darktrace, 2026). In Australia, Cyber Daily highlighted Dragos launching an OT-focused AI assistant, while IT Brief reported Commvault’s Azure partnership around recovery and cyber resilience. The better technology question is not “Can we add AI?” but “Can we trust, audit and recover from the actions AI helps us take?”
Compliance news
CISA’s June KEV additions around Lantronix EDS5000 and Ubiquiti UniFi OS reinforce a regulatory trend: exploited infrastructure vulnerabilities are operational deadlines (WindowsForum, 2026). NIST and ASD are moving baselines toward IoT products, context-aware Essentials guidance and controls that work in contemporary environments (ASD, 2026b; Fagan, 2026; SecurityWeek, 2026c).
Australia
Australia provided a compressed version of the global cyber story this week: policy modernization, critical-service resilience, data-rich sector compromise and executive-level readiness. The Microsoft-Australia digital resilience memorandum covered secure cloud, cybersecurity, AI, critical infrastructure, threat-information sharing and incident response, building on Microsoft’s AUD $25 billion commitment to AI and cloud infrastructure, cybersecurity and skills training (Tarre, 2026). The Horizon 2 Action Plan for Australia’s 2023-2030 Cyber Security Strategy set a 2026-2028 work program focused on workforce resilience, critical infrastructure, government systems and secure emerging technology adoption (Australian Cyber Security Magazine, 2026a).
The incident pattern is more human. Cyber Daily reported that the Interlock ransomware actor dumped hundreds of gigabytes of alleged Reynella East College teacher and student data, including passport scans and personal records (Hollingworth, 2026a). It also reported National Portrait Gallery breach claims involving names, emails and other data, and Harcourts investigating SafePay ransomware claims against a data-rich real estate environment (Croft, 2026; Hollingworth, 2026b). These are not merely “Australian incidents”; they are examples of sectors where identity, trust and personal history are concentrated, while security budgets often lag the value of the data. Real estate and education are not soft targets because people are careless. They are soft targets because the business model collects sensitive life-context data and the security model often arrives after the fact.
The more encouraging signal is that cyber resilience is being rehearsed, not just documented. CyberCX renewed its Rugby Australia cybersecurity partnership through 2027, covering executive simulations, risk assessments and penetration testing; IT Brief quoted CyberCX data that one in three assessments had at least one severe finding (Lagonsin, 2026). That is a useful metaphor for CISOs globally: practice does not prevent every breach, but it keeps the first real incident from becoming the first time the executive team discovers who owns the decision.
Figure 5. Australia focus image: local signals with global CISO relevance.
| The Friday question Ask the executive team: “Which three systems would make us blind if an attacker owned them?” If the room answers only with laptops and servers, your edge, SaaS, ERP, OT and AI agent inventories are probably about to have an interesting week. |
References
Arghire, I. (2026a, June 23). Russian initial access broker behind FortiBleed campaign. SecurityWeek. https://www.securityweek.com/russian-initial-access-broker-behind-fortibleed-campaign/
Arghire, I. (2026b, June 22). Fortinet responds to FortiBleed campaign. SecurityWeek. https://www.securityweek.com/fortinet-responds-to-fortibleed-campaign/
Australian Cyber Security Magazine. (2026a, June 12). Government launches Horizon 2 action plan for Australia’s cyber security strategy. https://australiancybersecuritymagazine.com.au/government-launches-horizon-2-action-plan-for-australias-cyber-security-strategy/
Australian Cyber Security Magazine. (2026b, June 17). Clayton Utz report urges boards to address third-party risk and AI rollout gaps. https://australiancybersecuritymagazine.com.au/clayton-utz-report-urges-boards-to-address-third-party-risk-and-ai-rollout-gaps/
Australian Signals Directorate. (2026a, June 22). Five Eyes cyber security agencies statement: The AI shift in cyber risk: Why leaders must act now. https://www.cyber.gov.au/about-us/view-all-content/news/five-eyes-cyber-security-agencies-statement
Australian Signals Directorate. (2026b, June 15). Consultation on evolution of Essential Eight. https://www.cyber.gov.au/about-us/view-all-content/news/consultation-on-evolution-of-essential-eight
Croft, D. (2026, June 18). Exclusive: Harcourts allegedly hacked by SafePay ransomware. Cyber Daily. https://www.cyberdaily.au/security
Cyber Daily. (2026a, June 23). Australian Computer Society appoints former president Prins Ralston as chief executive. https://www.cyberdaily.au/security
Darktrace. (2026). The state of AI cybersecurity 2026. https://www.darktrace.com/resource/the-state-of-ai-cybersecurity-2026
Dutta, T. S. (2026a, June 24). Microsoft Teams impersonation campaign enables unauthorized access through RMM abuse. Cyber Security News. https://cybersecuritynews.com/microsoft-teams-impersonation-campaign-enables-unauthorized-access/
Dutta, T. S. (2026b, June 24). Malicious Edge extension uses Chrome native messaging to execute code on victim systems. Cyber Security News. https://cybersecuritynews.com/malicious-edge-extension-uses-chrome-native-messaging/
Fagan, M. (2026, June 24). Advancing product security: New IoT guidance and new engagement. National Institute of Standards and Technology. https://www.nist.gov/blogs/cybersecurity-insights/advancing-product-security-new-iot-guidance-and-new-engagement
Fang, R., Liu, A., Lu, Y., Bailey, J., Gleave, A., & Papernot, N. (2026). AI agents enable adaptive computer worms. arXiv. https://arxiv.org/html/2606.03811v1
Google Threat Intelligence Group. (2026, May 11). GTIG AI Threat Tracker: Adversaries leverage AI for vulnerability exploitation, augmented operations, and initial access. Google Cloud Blog. https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access
Hollingworth, D. (2026a, June 24). Exclusive: Hacker behind Reynella East College hack dumps hundreds of gigabytes of alleged teacher, student data on dark web. Cyber Daily. https://www.cyberdaily.au/security
Hollingworth, D. (2026b, June 23). Exclusive: National Portrait Gallery of Australia investigating data breach claims. Cyber Daily. https://www.cyberdaily.au/security
Krebs, B. (2026, June 9). A record-breaking Patch Tuesday for June 2026. Krebs on Security. https://krebsonsecurity.com/2026/06/a-record-breaking-patch-tuesday-for-june-2026/
Lagonsin, J. G. (2026, June 24). CyberCX extends Rugby Australia cybersecurity deal. IT Brief Australia. https://itbrief.com.au/story/cybercx-extends-rugby-australia-cyber-security-deal
Mandiant. (2026a, June 24). Zero-day exploitation of vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager. Google Cloud Blog. https://cloud.google.com/blog/topics/threat-intelligence/zero-day-exploitation-cisco-catalyst-sd-wan-manager
Mandiant. (2026b, June 11). ShinyHunters targets education sector with Oracle PeopleSoft exploit. Google Cloud Blog. https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit
Markon, J. (2026, June 24). CISA releases guide to help agencies transition to zero trust. MeriTalk. https://www.meritalk.com/articles/cisa-releases-guide-to-help-agencies-transition-to-zero-trust/
SecurityWeek. (2026a). Cybersecurity news, insights and analysis. https://www.securityweek.com/
SecurityWeek. (2026b, June 22). Industry moves for the week of June 22, 2026. https://www.securityweek.com/industry-moves/jun-22-2026/
SecurityWeek. (2026c, June 25). NIST opens updated IoT security guidance to public review. https://www.securityweek.com/
Tarre, M. (2026, June 11). Microsoft & Australia sign digital resilience deal. IT Brief Australia. https://itbrief.com.au/story/microsoft-australia-sign-digital-resilience-deal
University of Toronto. (2026, June 2). U of T researchers demonstrate AI worm could target any online device. https://www.utoronto.ca/news/u-t-researchers-demonstrate-ai-worm-could-target-any-online-device
WindowsForum. (2026, June 23). CISA KEV update: Patch Lantronix EDS5000 & UniFi OS now. https://windowsforum.com/threads/cisa-kev-update-patch-lantronix-eds5000-amp-unifi-os-now.429725/