Miasma on DanSec Daily

Cybersecurity Brief – 2026-06-11

Thu, 11 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The University of Nottingham suffered a data breach impacting over 450,000 current and former students, with the ShinyHunters group taking credit and leaking email addresses and other information^[13]^[39].
Oracle PeopleSoft servers have been targeted in ongoing data theft attacks by the ShinyHunters extortion gang, who claim to have stolen data from over 100 organizations^[18].
Data belonging to 2.4 million VRChat users has been stolen in a breach, exposing sensitive user information^[44].

Newly Discovered Vulnerabilities

Multiple critical vulnerabilities have been patched by Ivanti, Fortinet, and SAP, with risks including arbitrary code execution and information disclosure^[9].
Microsoft patched three zero-days as part of its largest-ever Patch Tuesday, addressing 206 vulnerabilities in total^[47].
A high-severity, unpatched path traversal vulnerability in the Langflow AI development platform (CVE-2026-5027) is under active exploitation, allowing unauthenticated attackers to write arbitrary files and achieve remote code execution^[10]^[15]^[34].
A maximum-severity flaw in Ivanti Sentry, recently patched, is being actively exploited to execute code with root privileges on exposed secure mobile gateways^[14].
Microsoft released a fix for a BitLocker recovery bug affecting Windows Server 2025 devices that caused systems to boot into recovery mode after a security update^[12].
Microsoft patched an actively exploited Exchange Server vulnerability (CVE-2026-42897) that allowed arbitrary JavaScript execution via cross-site scripting attacks in Outlook Web Access^[21]^[40].
CISA added actively exploited vulnerabilities in Cisco, Chrome, and Arista products to its Known Exploited Vulnerabilities (KEV) catalog, following reports of in-the-wild attacks^[11].
Splunk and Palo Alto Networks released patches for severe vulnerabilities that could allow attackers to create or modify arbitrary files and access protected resources^[37].
A Windows Defender bug, with proof-of-concept code released by the “Nightmare-Eclipse” actor, allows for system takeover and bypassing BitLocker protection^[26]^[38].

Notable Threat Actor Activity

The China-linked JDY botnet has expanded to over 1,500 SOHO devices, increasing its reconnaissance activity and specifically expanding targeting of US military networks^[8]^[19].
OceanLotus, a Vietnam-aligned threat actor, has been linked to campaigns targeting domestic entities and investors using the SPECTRALVIPER backdoor^[6].
The Miasma worm, a credential-stealing attack framework recently used in supply-chain attacks on open-source ecosystems, had its source code briefly leaked on GitHub^[16].
The ransomware group “The Gentlemen” has emerged as the second most active by victim count, rapidly recruiting skilled hackers through aggressive tactics^[31].
ShinyHunters continue to target enterprise systems for data theft and extortion, including attacks on the University of Nottingham and Oracle PeopleSoft servers^[13]^[18]^[39].

Trends, Tools, or Tactics of Interest

Infostealers are increasingly turning millions of devices into credential theft platforms, providing initial access for ransomware and other cybercrime operations^[41].
Free “Spotify Premium” hacks promoted on social media platforms like TikTok and Instagram are being used to distribute infostealers^[46].
Attackers are bypassing weak authentication controls via phishing, MFA fatigue, and service desk social engineering, highlighting the need for robust identity verification practices^[20].
AI-driven changes are disrupting traditional vulnerability management, leading CISOs to shift budgets toward Breach and Attack Simulation (BAS) tools^[5].
The rise of AI risks is causing some insurers to explicitly exclude AI-related incidents from cyber insurance policies, while others are developing new frameworks to address emerging threats^[25].

Regulatory or Policy Developments Affecting the Security Industry

CISA has issued a new directive requiring US federal agencies to patch the most dangerous vulnerabilities within three days, in response to the accelerated threat landscape driven by AI-enabled attacks^[23]^[28]^[33].
The UK government announced a requirement for Apple and Google to block nude images on children’s phones by September, with a stipulation that no data is collected during the process^[45].
GitHub will disable npm install scripts by default in npm version 12 to mitigate software supply chain attacks, representing a significant change for the open-source ecosystem^[7]^[17].

Sources

Nottingham University data breach affects over 450,000 students - bleepingcomputer.com
University of Nottingham Confirms Breach After Hackers Leak Data - securityweek.com
Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks - bleepingcomputer.com
Data of 2.4 million VRChat users stolen - malwarebytes.com
Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities - thehackernews.com
Microsoft’s biggest-ever Patch Tuesday fixes 206 bugs, including 3 zero-days - malwarebytes.com
Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE - thehackernews.com
Path traversal flaw in AI dev platform Langflow exploited in attacks - bleepingcomputer.com
Hackers Exploit Langflow Vulnerability for Remote Code Execution - securityweek.com
Max severity Ivanti Sentry vulnerability now exploited in attacks - bleepingcomputer.com
Microsoft fixes BitLocker recovery bug on Windows Server 2025 - bleepingcomputer.com
Microsoft patches Exchange Server zero-day exploited in attacks - bleepingcomputer.com
Microsoft Patches Exploited Exchange Server Vulnerability - securityweek.com
CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation - thehackernews.com
Splunk, Palo Alto Networks Patch Severe Vulnerabilities - securityweek.com
Nightmare-Eclipse Drops Yet Another Microsoft Exploit, RoguePlanet - darkreading.com
‘GreatXML’ Zero-Day Exploit Bypasses BitLocker - securityweek.com
China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance - thehackernews.com
China-linked JDY botnet expands targeting of U.S. military networks - bleepingcomputer.com
OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack - thehackernews.com
The ‘Miasma’ worm source code briefly leaked on GitHub - bleepingcomputer.com
Who Runs the Ransomware Group ‘The Gentlemen?’ - krebsonsecurity.com
Infostealers Turn Millions of Devices Into Credential Theft Machines - securityweek.com
Free Spotify Premium hacks on social media are spreading infostealers - malwarebytes.com
The 5 Best Practices for Secure Identity Verification - bleepingcomputer.com
AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS. - thehackernews.com
AI Risk Worries Insurers and Businesses Alike - darkreading.com
CISA Rewrites Federal Patching Requirements for AI Threat Era - darkreading.com
CISA Tells US Agencies to Fix Security Bugs in as Little as 3 Days Thanks to AI Threats - wired.com
CISA Issues New Directive Improving How Federal Agencies Prioritize the Mitigation of Cyber Vulnerabilities - cisa.gov
Children’s phones must block nude images by September, UK says - malwarebytes.com
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks - thehackernews.com
GitHub announces npm security changes to tackle supply-chain attacks - bleepingcomputer.com

Cybersecurity Brief – 2026-06-09

Tue, 09 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

SoFi confirmed a data breach at its Hong Kong subsidiary following unauthorised access to a third-party vendor database containing customer information ^[15].
The University of Oxford disclosed a data breach after its CareerConnect careers platform, managed by third-party provider Group GTI, was compromised ^[23].
Lansing Community College reported a breach impacting 174,000 individuals, with hackers accessing personal data from college systems ^[39].
DentaQuest, a US dental benefits administrator, suffered a breach exposing sensitive data, as reported in recent threat intelligence ^[40].
Silent Ransom Group targeted US law firms in escalating extortion attacks, using vishing, IT impersonation, and in-person intrusions to steal data ^[24].
Meta and WhatsApp detected and blocked new spear-phishing attacks linked to NSO Group, and Meta is pursuing a federal court contempt order against the spyware vendor for violating a no-hacking order ^[7]^[18]^[36].
Pirated PC games are being used to distribute password-stealing malware, with over 400,000 devices reportedly infected worldwide ^[42].

Newly Discovered Vulnerabilities

A critical authentication bypass vulnerability in Check Point Remote Access VPN and Mobile Access deployments using IKEv1 has been exploited in zero-day attacks by the Qilin ransomware gang. CISA has ordered US federal agencies to patch within three days ^[8]^[12]^[22]^[25]^[32].
BerriAI LiteLLM is affected by CVE-2026-42271, a high-severity flaw now being exploited in the wild, enabling unauthenticated remote code execution ^[5].
A one-character use-after-free vulnerability in the Linux kernel allows local privilege escalation to root and container escape. Exploits are now public ^[6].
Google patched a new Chrome zero-day vulnerability (CVE-2026-11645) exploited in the wild, marking the fifth such patch this year ^[13]^[33].
Gogs patched a critical zero-day vulnerability enabling remote code execution on Internet-facing instances and access to all repositories ^[19].
Ubiquiti UniFi OS is vulnerable to a chain of three bugs allowing unauthenticated remote code execution with root privileges ^[20].
Everest Forms, a popular WordPress plugin, has a vulnerability being exploited in the wild for remote code execution ^[38].

Notable Threat Actor Activity

The Qilin ransomware gang has been confirmed as the threat actor exploiting the Check Point VPN zero-day vulnerability in active attacks ^[22]^[25]^[32].
The Miasma supply chain campaign has evolved into the Hades attack, involving 37 malicious wheel artifacts across 19 PyPI packages, delivering the Bun credential stealer ^[4]^[27].
The Shai-Hulud supply chain attack compromised 19 science-focused PyPI packages, distributing malware to steal developer secrets ^[17]^[27].
NSO Group has been linked to new WhatsApp spear-phishing campaigns, which were detected and blocked by Meta and WhatsApp ^[7]^[18]^[36].
Silent Ransom Group is escalating its tactics against US law firms, combining vishing, impersonation, and physical intrusion ^[24].

Trends, Tools, or Tactics of Interest

AI-enabled social engineering attacks are increasing, with threat actors leveraging AI to bypass technical security controls and significantly boost phishing campaign volume ^[1]^[9]^[41].
A new side-channel attack called FROST allows malicious websites to track user browser and app activity via SSD timing using only JavaScript, requiring no native code or browser extensions ^[3].
Supply chain attacks via poisoned open-source packages, particularly on PyPI, continue to escalate with evolving tactics and the targeting of developer secrets ^[4]^[17]^[27]^[31].
Android malware (NFCShare) is being distributed as fake banking app updates on GitHub, targeting users with credential-stealing payloads ^[14].
Attackers are increasingly hiding password-stealing malware in cracked and pirated PC games, resulting in large-scale infections ^[42].

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated that US federal agencies patch the critical Check Point VPN vulnerability within three days due to confirmed exploitation by ransomware actors ^[12].
An extension of the Geneva Conventions is being considered to impose restrictions on cyberwarfare during ceasefire conditions, aiming to address current loopholes in international conflict law ^[26].

Sources

SoFi confirms third-party data breach at Hong Kong subsidiary - bleepingcomputer.com
Oxford University discloses data breach after careers platform hack - bleepingcomputer.com
174,000 Impacted by Lansing Community College Data Breach - securityweek.com
8th June – Threat Intelligence Report - research.checkpoint.com
Silent Ransom Group Hits US Law Firms in Escalating Extortion Attacks - darkreading.com
Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order - thehackernews.com
WhatsApp says it disrupted new NSO spyware phishing attacks - bleepingcomputer.com
WhatsApp Catches Spyware Firm NSO Defying No-Hacking Court Order - securityweek.com
Pirated PC games are delivering password-stealing malware - malwarebytes.com
Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups - thehackernews.com
CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day - bleepingcomputer.com
Check Point links VPN zero-day attacks to Qilin ransomware gang - bleepingcomputer.com
Check Point VPN Flaw Exploited Since Early May - darkreading.com
Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks - securityweek.com
LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE - thehackernews.com
One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public - thehackernews.com
Google patches new Chrome zero-day flaw exploited in the wild - bleepingcomputer.com
Google Patches 5th Chrome Zero-Day Exploited in 2026 - securityweek.com
Gogs patches critical zero-day enabling remote code execution - bleepingcomputer.com
Critical UniFi OS bug lets hackers gain root without authentication - bleepingcomputer.com
Everest Forms Vulnerability Exploited to Hack WordPress Sites - securityweek.com
Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer - thehackernews.com
'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud - darkreading.com
New Shai-Hulud attack trojanizes 19 science-focused PyPI packages - bleepingcomputer.com
Report: AI-Enabled Social Engineering Attacks Are on the Rise - blog.knowbe4.com
AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload - thehackernews.com
Americans lost nearly $900 million to AI-powered scams, FBI says - malwarebytes.com
New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing - thehackernews.com
TeamPCP Supply Chain Campaign: Activity Through 2026-06-07, (Mon, Jun 8th) - isc.sans.edu
NFCShare Android malware spreads via fake banking app updates on GitHub - bleepingcomputer.com
Iran Signed a Ceasefire — Its Hackers Didn't - darkreading.com

Cybersecurity Brief – 2026-06-06

Sat, 06 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group leaked approximately 234 GB of data allegedly stolen from DentaQuest, impacting 2.6 million individuals ^[26].
The Miasma worm campaign compromised 73 Microsoft GitHub repositories across four organizations in a major supply chain attack ^[7].
Multiple supply chain attacks hit the npm ecosystem, with threat actors using both malicious and trojanized versions of over 50 legitimate packages to distribute Rust-based information stealers, including IronWorm and a new Miasma variant ^[9].
Tech giant Toshiba and retailer Muji reported suspicious Polyfill login screens appearing on their websites, potentially harvesting user credentials ^[14].
Over 900 US automatic tank gauge systems used to monitor fuel and chemical storage tanks were found exposed online and are now under active attack by threat actors ^[18]^[20].

Newly Discovered Vulnerabilities

A high-severity vulnerability in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) is under active exploitation, with no patch currently available ^[8].
Hackers are actively exploiting a critical flaw in the Everest Forms Pro WordPress plugin, which allows arbitrary code execution and complete site takeover ^[13].
CISA reported that hackers are exploiting a recently patched high-severity SolarWinds Serv-U flaw to crash servers ^[15].
A security startup identified 21 previously unknown zero-day vulnerabilities in FFmpeg, a widely used media library ^[6].
Chrome 149 patched 429 vulnerabilities, with over 100 classified as critical or high-severity, primarily related to use-after-free and insufficient input validation ^[6]^[27].

Notable Threat Actor Activity

The FBI warned about the Kali365 phishing-as-a-service platform targeting Microsoft 365 accounts by harvesting OAuth tokens for direct access ^[1].
A Chinese espionage group tracked as UNC5221 accessed Microsoft 365 environments using the Brickstorm backdoor and newly discovered malware named Plenet and AgentPSD ^[16].
A previously unreported threat cluster, OP-512, was observed targeting Microsoft IIS servers with a custom web shell framework ^[11].
Five Eyes intelligence agencies reported that Chinese intelligence officers are targeting government and military staff with fake job opportunities to gain access to classified or privileged information ^[29].

Trends, Tools, or Tactics of Interest

Phishing campaigns increasingly leverage calendar invites to deceive targets and bypass traditional email security controls ^[5].
The 2026 Verizon DBIR highlights that phishing, shadow AI, malicious browser extensions, and credential theft are increasingly occurring at the browser layer ^[19].
Adaptive, agentic AI worms capable of autonomously seeking out vulnerabilities and adapting to new environments are anticipated to become a significant enterprise threat within a year ^[21].
AI-powered tools are being used both offensively and defensively, with public concern about AI’s dual role as threat and tool rising ^[2]^[3]^[12]^[21]^[30].
OWASP released CVE Lite CLI, a free open-source tool to help developers quickly identify and remediate vulnerable dependencies in their projects ^[24].

Regulatory or Policy Developments Affecting the Security Industry

The White House issued an executive order establishing a voluntary framework for early government access to frontier AI models and increased federal security investment ^[22].
Industry experts commented on the executive order’s voluntary nature, its approach to balancing innovation and security, and possible implementation challenges ^[28].

Sources

Hackers Leak DentaQuest Information Impacting 2.6 Million - securityweek.com
Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack - thehackernews.com
IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks - thehackernews.com
Suspicious Polyfill login prompts pop up on Toshiba, Muji websites - bleepingcomputer.com
Over 900 US gas station tank gauge systems exposed to attacks - bleepingcomputer.com
Exposed Fuel Tank Gauges Under Attack in the US - darkreading.com
Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available - thehackernews.com
Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites - thehackernews.com
CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers - bleepingcomputer.com
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs - thehackernews.com
Chrome 149 Patches 429 Vulnerabilities - securityweek.com
FBI: Kali365 Phishing Kit is Targeting Microsoft 365 Accounts - blog.knowbe4.com
Chinese APT deploys new malware to keep access to hacked networks - bleepingcomputer.com
New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework - thehackernews.com
Five Eyes: Chinese Spies Target Government, Military Staff With Fake Job Opportunities - securityweek.com
The Silent Invitation: A Deep Dive into Calendar Invite Phishing - blog.knowbe4.com
What 2026 DBIR Confirms: Attacks Are Living in the Browser - bleepingcomputer.com
Adaptive, Agentic AI Worms Loom as Next Enterprise Threat - darkreading.com
KB4-CON - AI Is Everything - blog.knowbe4.com
How to Secure AI Adoption In Your Organization - blog.knowbe4.com
Only 10% of SOCs Say They’re Getting Excellent Value From AI. Here’s What the Second Wave Has to Deliver - thehackernews.com
AI: Threat, tool, or both? - malwarebytes.com
OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds - securityweek.com
Trump AI Order Seeks Voluntary Frontier Model Testing - darkreading.com
Industry Reactions to New Trump AI Cybersecurity Executive Order: Feedback Friday - securityweek.com