A mid-year 2026 roundup of the ten CVEs and incidents every blue team should already have patched, hunted, and built detections for — from CitrixBleed 3 to FortiBleed.
Who Actually Is ShinyHunters? Inside Cybersecurity's Messiest Attribution Fight of 2026
If you've followed cybersecurity headlines at all in the first half of 2026, you've seen the name ShinyHunters attached to an almost absurd number of breaches: Salesforce customers across more than a thousand organizations, Canvas/Instructure, Oracle PeopleSoft servers, SoundCloud, Grubhub, Panera Bread, Carnival, ADT, Charter, Kemper, McGraw-Hill, Rockstar Games, Telus, even the European Commission.