The vulnerability is a CWE-680 integer overflow leading to a buffer overflow in libssh2's packet parsing logic. When a client connects to an SSH server, libssh2's ssh2_transport_read() function reads a packet_length field from the incoming data and uses it in a size calculation involving 32-bit arithmetic. An attacker-controlled server can set this field to a value such as 0xffffffff, which causes the arithmetic to wrap around to a very small number. libssh2 allocates a heap buffer sized for that small, incorrect number. Subsequent code, still operating on the original oversized packet_length value, then writes the full attacker-supplied packet into the undersized buffer, producing an out-of-bounds heap write.

The flaw affects every libssh2 release up to and including 1.11.1. Security researcher Tristan Madani reported the issue, and VulnCheck published the CVE on June 17, 2026. The fix, which adds a missing check rejecting any packet_length value above LIBSSH2_PACKET_MAXPAYLOAD before the vulnerable arithmetic runs, was merged into the project's mainline source as commit 97acf3d on June 12, but no official tagged version release containing the fix has shipped as of today. Linux distributions including Debian have begun backporting the patch independently into their own builds ahead of an upstream release.

A second related flaw disclosed alongside it, CVE-2026-55199, rated CVSS 8.2, allows a malicious server to trap a connecting client in a CPU loop via a bogus extension count during the key exchange phase, causing denial of service rather than code execution. A third, CVE-2025-15661, rated CVSS 8.3, is an SFTP heap over-read disclosed in the same batch.

SpyCloud's analysis, published as an update to Help Net Security's ongoing FortiBleed coverage today, examined the full dataset recovered from the operator's exposed infrastructure rather than only the Fortinet-specific portion that drove the original headlines. The researchers confirmed that FortiGate firewalls and SSL VPN gateways were the largest single target category, consistent with earlier reporting, but represented less than one third of the total internet-facing endpoints the operator scanned across its full campaign.

Beyond Fortinet, the operators collected and targeted login portal URLs for Synology DiskStation Manager network-attached storage administration interfaces and Sophos firewall SSL-VPN and Remote Desktop Web Access portals. SpyCloud noted it remains unclear whether the attackers progressed past the initial scanning phase for these targets, in contrast to the confirmed compromise of tens of thousands of Fortinet devices. Separately, the operator ran a dedicated credential checker against Microsoft SQL Server instances, working through 163,650 servers across approximately 2.1 billion login attempts, which surfaced two confirmed working hits using the default sa administrator account on live production SQL servers.

This confirms the assessment other researchers offered earlier in the campaign that FortiBleed is best understood as one visible piece of a much broader, ongoing edge-device and remote-access credential harvesting effort by a Russian-speaking, financially motivated initial access broker, rather than a Fortinet-specific incident.

A post appeared on a cybercrime forum claiming the seller possesses a database of approximately 310 million Temu user records, including account information, contact details, password hashes, and device metadata. To support the claim, the seller published 99 sample records. Researchers who reviewed the sample data found it contained a broad range of account information consistent with what a genuine internal database export would include, and noted that nearly all sample records carried account-creation or login timestamps from 2026.

Temu has not issued a public statement confirming or denying the claim as of this writing. The company has a prior pattern of denying similar claims: in a 2025 incident, an attacker claimed to have stolen 87 million lines of personal data from Temu users, and the company subsequently stated it had cross-checked the data internally and found no matching records, characterizing the claim as unsubstantiated.

The scale of the current 310 million record claim, against Temu's reported approximately 416 million monthly active users, would represent a substantial majority of the platform's active user base if fully accurate. Independent verification of the claim's scope and authenticity has not been completed as of today.