Cybersecurity Brief – 2026-06-06

Sat, 06 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group leaked approximately 234 GB of data allegedly stolen from DentaQuest, impacting 2.6 million individuals ^[26].
The Miasma worm campaign compromised 73 Microsoft GitHub repositories across four organizations in a major supply chain attack ^[7].
Multiple supply chain attacks hit the npm ecosystem, with threat actors using both malicious and trojanized versions of over 50 legitimate packages to distribute Rust-based information stealers, including IronWorm and a new Miasma variant ^[9].
Tech giant Toshiba and retailer Muji reported suspicious Polyfill login screens appearing on their websites, potentially harvesting user credentials ^[14].
Over 900 US automatic tank gauge systems used to monitor fuel and chemical storage tanks were found exposed online and are now under active attack by threat actors ^[18]^[20].

Newly Discovered Vulnerabilities

A high-severity vulnerability in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) is under active exploitation, with no patch currently available ^[8].
Hackers are actively exploiting a critical flaw in the Everest Forms Pro WordPress plugin, which allows arbitrary code execution and complete site takeover ^[13].
CISA reported that hackers are exploiting a recently patched high-severity SolarWinds Serv-U flaw to crash servers ^[15].
A security startup identified 21 previously unknown zero-day vulnerabilities in FFmpeg, a widely used media library ^[6].
Chrome 149 patched 429 vulnerabilities, with over 100 classified as critical or high-severity, primarily related to use-after-free and insufficient input validation ^[6]^[27].

Notable Threat Actor Activity

The FBI warned about the Kali365 phishing-as-a-service platform targeting Microsoft 365 accounts by harvesting OAuth tokens for direct access ^[1].
A Chinese espionage group tracked as UNC5221 accessed Microsoft 365 environments using the Brickstorm backdoor and newly discovered malware named Plenet and AgentPSD ^[16].
A previously unreported threat cluster, OP-512, was observed targeting Microsoft IIS servers with a custom web shell framework ^[11].
Five Eyes intelligence agencies reported that Chinese intelligence officers are targeting government and military staff with fake job opportunities to gain access to classified or privileged information ^[29].

Trends, Tools, or Tactics of Interest

Phishing campaigns increasingly leverage calendar invites to deceive targets and bypass traditional email security controls ^[5].
The 2026 Verizon DBIR highlights that phishing, shadow AI, malicious browser extensions, and credential theft are increasingly occurring at the browser layer ^[19].
Adaptive, agentic AI worms capable of autonomously seeking out vulnerabilities and adapting to new environments are anticipated to become a significant enterprise threat within a year ^[21].
AI-powered tools are being used both offensively and defensively, with public concern about AI’s dual role as threat and tool rising ^[2]^[3]^[12]^[21]^[30].
OWASP released CVE Lite CLI, a free open-source tool to help developers quickly identify and remediate vulnerable dependencies in their projects ^[24].

Regulatory or Policy Developments Affecting the Security Industry

The White House issued an executive order establishing a voluntary framework for early government access to frontier AI models and increased federal security investment ^[22].
Industry experts commented on the executive order’s voluntary nature, its approach to balancing innovation and security, and possible implementation challenges ^[28].

Sources

Hackers Leak DentaQuest Information Impacting 2.6 Million - securityweek.com
Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack - thehackernews.com
IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks - thehackernews.com
Suspicious Polyfill login prompts pop up on Toshiba, Muji websites - bleepingcomputer.com
Over 900 US gas station tank gauge systems exposed to attacks - bleepingcomputer.com
Exposed Fuel Tank Gauges Under Attack in the US - darkreading.com
Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available - thehackernews.com
Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites - thehackernews.com
CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers - bleepingcomputer.com
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs - thehackernews.com
Chrome 149 Patches 429 Vulnerabilities - securityweek.com
FBI: Kali365 Phishing Kit is Targeting Microsoft 365 Accounts - blog.knowbe4.com
Chinese APT deploys new malware to keep access to hacked networks - bleepingcomputer.com
New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework - thehackernews.com
Five Eyes: Chinese Spies Target Government, Military Staff With Fake Job Opportunities - securityweek.com
The Silent Invitation: A Deep Dive into Calendar Invite Phishing - blog.knowbe4.com
What 2026 DBIR Confirms: Attacks Are Living in the Browser - bleepingcomputer.com
Adaptive, Agentic AI Worms Loom as Next Enterprise Threat - darkreading.com
KB4-CON - AI Is Everything - blog.knowbe4.com
How to Secure AI Adoption In Your Organization - blog.knowbe4.com
Only 10% of SOCs Say They’re Getting Excellent Value From AI. Here’s What the Second Wave Has to Deliver - thehackernews.com
AI: Threat, tool, or both? - malwarebytes.com
OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds - securityweek.com
Trump AI Order Seeks Voluntary Frontier Model Testing - darkreading.com
Industry Reactions to New Trump AI Cybersecurity Executive Order: Feedback Friday - securityweek.com

OP-512 on DanSec Daily

Cybersecurity Brief – 2026-06-06

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources