Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack

Weekly roundup: multiple high-impact incidents and product/security updates. Most urgent: an unauthenticated remote code execution in Splunk Enterprise (CVE-2026-20253) is under active exploitation and listed by CISA, requiring immediate mitigation/patching. Other notable items: theft of ~74k Fortinet firewall credentials; a Klue-origin breach that led to Salesforce data theft affecting Huntress; a crypto‑stealing malware campaign that abused GitHub, YouTube and VirusTotal to build trust for malicious tools; and academic research (HAMLOCK) demonstrating a stealthy hardware/software backdoor. R