2026 has arrived not with a whisper but with a full-blown digital alarm. As we approach the midpoint of the year, the cybersecurity landscape reads like a chronicle of escalating audacity — nation-state actors targeting civilian infrastructure, ransomware gangs holding hospitals and universities hostage, and supply-chain breaches cascading across enterprise software ecosystems. If 2025 was the year AI entered the cyber battlefield, 2026 is the year adversaries learned to wield it effectively.

According to TechCrunch’s mid-year security roundup, cybersecurity has moved from a background concern to a front-and-center business priority — woven into nearly every major story of the year. Wars are now fought on digital fronts alongside physical ones, governments are weaponizing citizens’ own data, and ransomware gangs are extracting massive payouts from companies and public institutions alike.

This blog post breaks down the five most significant cyber incidents and threat clusters of 2026 to date — drawing on reporting from TechCrunch, eSecurity Planet, Dark Reading, SWK Technologies, and F5 Labs — to give security leaders a clear picture of what has happened, what it means, and what to do next.

1. ShinyHunters & the Oracle PeopleSoft Zero-Day Campaign

The ShinyHunters cybercrime group — one of the most prolific data extortion actors of recent years — launched its most sweeping campaign in late May and early June 2026. The group exploited CVE-2026-35273, a critical unauthenticated remote code execution flaw in Oracle PeopleSoft Enterprise People Tools 8.61 and 8.62. The campaign, tracked as UNC6240 by Google Threat Intelligence Group and Mandiant, ran between May 27 and June 9, 2026, and compromised more than 100 organizations — 68% of them colleges and universities.

Stolen records included student names, home addresses, phone numbers, emails, dates of birth, ethnicity, enrollment status, GPAs, academic majors, and student IDs. Oracle issued a security advisory on June 10, the same day attacks became public knowledge, urging immediate mitigations. The campaign follows a year-long pattern from Shiny Hunters, which has systematically targeted shared vulnerabilities in widely deployed enterprise software — including prior attacks on Salesforce, Sales loft Drift, Snowflake, and the Instructure Canvas breach in May 2026.

🎯 Executive Takeaway Organizations running Oracle PeopleSoft should treat this as an emergency remediation. Apply all available patches immediately. Audit authentication logs for suspicious activity dating back to late May. Consider dark web monitoring for exposed student or employee records.

2. The DOGE Social Security Data Scandal

Perhaps the most politically charged data story of the year: the ongoing fallout from DOGE’s sweep through U.S. federal agencies. A whistleblower’s claim — still unresolved in federal court — alleges that operatives uploaded a live copy of the Social Security Administration’s database to an unsecured third-party server. The database allegedly contained Social Security numbers and associated personal information for the majority of living Americans.

The Social Security Administration itself has stated in court filings that it does not know for certain what was on the server. The fears are broad: that such a database could be misused to target Americans for political or financial purposes. This case highlights that data breach risk is not only a criminal-actor problem — internal governance failures, politically motivated data access, and poor access controls represent a different but equally dangerous attack surface.

3. A Wave of Zero-Day Exploits Across Enterprise Systems

The third week of June 2026 was defined by an alarming cluster of zero-day vulnerabilities under active exploitation. Among the most critical: an Oracle PeopleSoft zero-day allowing unauthenticated remote code execution (CVE-2026-35273), a LiteSpeed cPanel plugin flaw granting root access to compromised servers, and a CISA advisory flagging a command injection flaw in LiteLLM — an AI gateway used in enterprise environments — that could be chained with an authentication bypass to achieve remote code execution.

Separately, researchers uncovered 15 malicious plugins in the JetBrains Marketplace, collectively installed approximately 70,000 times. These plugins were stealing AI API keys from services including OpenAI and DeepSeek, highlighting the growing risk of third-party developer ecosystems and the need for extension audits. A max-severity Ivanti flaw was also exploited within 24 hours of public disclosure, underscoring the shrinking window organizations have to patch critical vulnerabilities.

4. FortiBleed: Fortinet Devices Turned Into Credential Stealers

Dark Reading reported in June 2026 that attackers have successfully turned Fortinet firewall devices into credential-harvesting tools — a campaign dubbed “FortiBleed.” Over 30,000 Fortinet devices were swept in a credential-harvesting heist, with attackers exploiting misconfigurations and unpatched vulnerabilities to intercept authentication credentials in transit. The campaign demonstrates a shift from purely destructive attacks to long-term persistent access — attackers staying quiet while harvesting intelligence and credentials for future lateral movement.

The FortiBleed campaign reinforces a critical lesson: perimeter security appliances themselves have become high-value targets. Any device that sits at the network edge and processes authentication traffic is a prize for threat actors seeking durable, scalable access to corporate infrastructure.

5. Salesforce Supply Chain Attacks: The Klue and Icarus Incidents

A sophisticated threat actor tracked as “Icarus” has been exploiting OAuth integrations in Salesforce-connected SaaS platforms. The Klue OAuth breach — reported by both Dark Reading and F5 Labs — involved attackers leveraging compromised OAuth tokens to gain unauthorized access to Salesforce environments, stealing sensitive business intelligence and customer data.

The Council of Europe also revealed it is investigating claims by ShinyHunters that 297GB of sensitive data was stolen, including HR and medical records. This SaaS supply-chain breach pattern is consistent with eSecurity Planet’s reporting on the Infinite Campus breach, where attackers compromised a Salesforce environment to expose data from 137,000 school staff accounts.

What Security Leaders Should Do Right Now

Given the threat clusters active in June 2026, security teams should prioritize these five actions immediately:

• Patch Oracle PeopleSoft (CVE-2026-35273) and audit authentication logs for the May 27 – June 9 period.
• Audit all third-party developer extensions and marketplace plugins — rotate any API keys that may have been exposed.
• Review all Salesforce OAuth integrations and revoke tokens for third-party applications that are not actively needed.
• Treat Fortinet and other edge appliances as high-value targets requiring their own hardening and monitoring regimes.
• Implement phishing-resistant MFA (FIDO2/passkeys) across all remote access pathways as a baseline.

📊 The Scale of 2026 Cyber Incidents at a Glance • 100+ organizations compromised in the Shiny Hunters/Oracle PeopleSoft campaign • 297 GB of Council of Europe data claimed stolen • 30,000+ Fortinet devices swept in the Forti Bleed campaign • 70,000+ installs of malicious JetBrains Marketplace plugins • 137,000 school staff accounts exposed in the Infinite Campus/Salesforce breach

2026 has confirmed what security professionals have long warned: the adversary ecosystem is now industrialized, AI-assisted, and operating at enterprise scale. Organizations that respond only after an incident — rather than implementing continuous monitoring and proactive threat hunting — will find themselves perpetually behind the curve. The time to act is before the breach notice arrives.