ShapedPlugin update flow hacked to infect WordPress sites

Multiple high-impact security incidents reported 17–18 Jun 2026: a supply‑chain compromise of ShapedPlugin distributed backdoored WordPress plugin updates to paying customers; a large “FortiBleed” leak exposing ~73,932 Fortinet/FortiGate VPN credentials and firewall URLs; out‑of‑band F5 patches for multiple NGINX vulnerabilities including two critical RCEs; and a CISA order to urgently patch a maximum‑severity Joomla JCE plugin flaw actively exploited in the wild. Microsoft is addressing a Defender zero‑day called “RoguePlanet” while also fixing Windows Server 2016 update failures and Office‑l