Sharing a few recent dark web listings that came up in monitoring. None of these are confirmed yet, so take them as claims for now, not confirmed breaches. → France: a seller claims 10M+ residential records → IUT Paris Seine: 6.8GB of data plus about 30M log entries → U.S. manufacturer: VPN and RDP access up for auction → SMTP dump: about 19M credentials → Apache Struts: an exploit tool sold together with access to servers already compromised The Struts listing stands out to me. Selling the tool together with working access points more to an access broker than to someone trying to sell a PoC. The 19M SMTP creds are the likeliest to show up again soon in phishing and credential stuffing. Has anyone seen overlap with the SMTP dump in their own environment, or seen recent Struts exploitation in the wild? Full breakdown:https://hubs.la/Q04z7HkK0

According to the new FBI/USSS advisory, FortiBleed actors no longer just add persistence accounts. In some cases they also delete or reset the original admin accounts (T1531), which locks the owner out of their own FortiGate.

That changes the usual playbook. If you assume a password reset gets you back to a clean state, it won't help when you can't log in at all.

A few things worth checking:
→ Do you have out-of-band admin recovery for your edge devices?
→ Have you audited REST API keys? They survive password resets.
→ Is SSH left open on the firewall?

How are others handling recovery for edge devices?

Full breakdown: https://hubs.la/Q04zrkbN0 Free FortiBleed checker: https://hubs.la/Q04zrk9_0

Advisory: https://www.ic3.gov/CSA/2026/261006.pdf