CVE-2026-11645 on DanSec Daily

Cybersecurity Brief – 2026-06-10

Wed, 10 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Microsoft confirmed that 73 of its open-source GitHub repositories were compromised to inject password-stealing malware as part of a supply chain attack linked to the Miasma worm. Some repositories remain offline as the investigation continues, and the incident disrupted continuous integration pipelines for several Microsoft projects ^[11]^[27]^[31].
ServiceNow disclosed a security incident where attackers exploited an unauthenticated API flaw, enabling unauthorized access to customer data. The vulnerability had reportedly been known since April and has since been patched ^[6]^[20]^[43].
Two Russia-aligned threat actor campaigns continue to exploit a WinRAR vulnerability (CVE-2025-8088), patched last July, to deploy information stealers and conduct cyberespionage against Ukrainian government and military organizations ^[12]^[32].

Newly Discovered Vulnerabilities

Microsoft released a record 206 security fixes during the June 2026 Patch Tuesday, including three zero-day vulnerabilities. Notable among these are privilege escalation flaws in Microsoft Defender (“RoguePlanet”), YellowKey, GreenPlasma, and MiniPlasma, as well as critical remote code execution vulnerabilities across its software portfolio ^[4]^[7]^[16]^[19]^[24]^[29]^[38]^[41]^[47].
Google released patches for 74 Chrome vulnerabilities, including a high-severity V8 zero-day (CVE-2026-11645) that is being actively exploited in the wild ^[14].
Veeam patched a critical remote code execution flaw (CVE-2026-44963) in its Backup & Replication software, which allowed authenticated domain users to execute code remotely on affected servers ^[10]^[28].
Ivanti fixed two critical vulnerabilities in its Sentry secure mobile gateway, including a maximum-severity flaw enabling remote code execution as root, and Fortinet patched remotely exploitable OS command injection vulnerabilities ^[17]^[44].
SAP addressed 15 vulnerabilities in its June patch release, including four critical-severity flaws in NetWeaver and Commerce Cloud ^[22].
Adobe patched 123 vulnerabilities, nearly half of which could allow arbitrary code execution, primarily affecting Experience Manager ^[48].
OpenSSL addressed 18 vulnerabilities in its latest release, including high-severity issues, several of which were potentially discovered through AI-assisted analysis ^[50].
Six vulnerabilities were disclosed in protobuf.js, exposing Node.js applications to remote code execution and denial of service ^[8].
Microsoft Exchange was found vulnerable to email spoofing via the “Ghost-Sender” attack in hybrid environments using third-party mail servers or spam filters ^[30].

Notable Threat Actor Activity

Russia-aligned groups are actively exploiting a WinRAR vulnerability to deliver stealers and conduct espionage against Ukrainian targets, leveraging a flaw that has been patched for nearly a year ^[12]^[32].

Trends, Tools, or Tactics of Interest

The use of AI in cybersecurity is accelerating both vulnerability discovery and exploit development, contributing to the record number of vulnerabilities patched this month. AI-driven models such as Claude Mythos have demonstrated the ability to rapidly create working exploits for recently disclosed vulnerabilities, potentially shortening the window between disclosure and exploitation ^[29]^[37]^[49]^[51].
Anthropic released two versions of its new AI model: Claude Mythos 5, available to trusted cybersecurity partners with fewer restrictions, and Claude Fable 5, a public release with built-in cyberattack safeguards ^[5]^[18]^[37]^[49].
University of Toronto researchers demonstrated a proof-of-concept self-replicating AI worm using locally hosted open-weight LLMs to autonomously propagate and conduct network attacks ^[13].
Automated pentesting tools may miss critical vulnerabilities over time, highlighting the need for expert-driven assessments to supplement automation ^[3].
Phishing campaigns are increasingly leveraging real hotel reservation details to target travelers, indicating an evolution in social engineering tactics ^[2].
Simulation testing revealed that the OpenClaw AI email agent is susceptible to phishing attacks, leaking user data under conditions that commonly compromise human users ^[21].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft released extended security updates for Windows 10 (KB5094127) and cumulative updates for Windows 11 (KB5094126, KB5093998), addressing vulnerabilities and adding new security features ^[23]^[25].
Organizations are advised to apply vendor-supplied mitigations or discontinue use of vulnerable Arista EOS devices, as no patch will be issued for an exploited vulnerability ^[46].

Sources

Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues - thehackernews.com
GitHub disables Microsoft repos pushing password-stealing malware - bleepingcomputer.com
Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories - darkreading.com
ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances - thehackernews.com
ServiceNow discloses security incident exposing customer data - bleepingcomputer.com
ServiceNow Patches Vulnerability Exploited Against Some Customers - securityweek.com
WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine - thehackernews.com
Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs - darkreading.com
Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs - thehackernews.com
Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows - thehackernews.com
Microsoft patches YellowKey, GreenPlasma, MiniPlasma zero-days - bleepingcomputer.com
Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges - bleepingcomputer.com
Microsoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flaws - bleepingcomputer.com
Blame AI: Patch Tuesday Hits Record 206 CVEs - darkreading.com
A Record-Breaking Patch Tuesday for June 2026 - krebsonsecurity.com
Microsoft June 2026 Patch Tuesday, (Tue, Jun 9th) - isc.sans.edu
Microsoft Patches 200 Vulnerabilities - securityweek.com
Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now - thehackernews.com
Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code - thehackernews.com
New Veeam vulnerability exposes backup servers to RCE attacks - bleepingcomputer.com
Ivanti: Max severity Sentry flaw allows code execution as root - bleepingcomputer.com
Critical Vulnerabilities Patched in Fortinet, Ivanti Products - securityweek.com
SAP fixes critical flaws in NetWeaver and Commerce Cloud - bleepingcomputer.com
Adobe Patches 123 Vulnerabilities - securityweek.com
OpenSSL Patches High-Severity Vulnerability Found With AI - securityweek.com
Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS - thehackernews.com
Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address - darkreading.com
Anthropic Offers Mythos Upgrade for Cyber Partners and a ‘Safe’ Version for the Rest of You - wired.com
Anthropic Launches Claude Fable 5: Mythos-Class AI With Cybersecurity Guardrails - securityweek.com
Claude Mythos Turns N-Days Into N-Hours With Rapid Exploit Creation - securityweek.com
Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards - thehackernews.com
Anthropic rolls out Claude Fable 5, but it's available for a limited time - bleepingcomputer.com
Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models - thehackernews.com
Your Automated Pentest Looks Clean. See What It Missed in This Expert Webinar - thehackernews.com
CyberheistNews Vol 16 #23 Now Phishing Attacks Use Real Hotel Reservations to Target Travelers - blog.knowbe4.com
OpenClaw AI agent found falling for phishing attacks, spills user data - bleepingcomputer.com
Microsoft releases Windows 10 KB5094127 extended security update - bleepingcomputer.com
Windows 11 KB5094126 & KB5093998 cumulative updates released - bleepingcomputer.com
No Patch Planned for Exploited Arista EOS Vulnerability - securityweek.com

Cybersecurity Brief – 2026-06-09

Tue, 09 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

SoFi confirmed a data breach at its Hong Kong subsidiary following unauthorised access to a third-party vendor database containing customer information ^[15].
The University of Oxford disclosed a data breach after its CareerConnect careers platform, managed by third-party provider Group GTI, was compromised ^[23].
Lansing Community College reported a breach impacting 174,000 individuals, with hackers accessing personal data from college systems ^[39].
DentaQuest, a US dental benefits administrator, suffered a breach exposing sensitive data, as reported in recent threat intelligence ^[40].
Silent Ransom Group targeted US law firms in escalating extortion attacks, using vishing, IT impersonation, and in-person intrusions to steal data ^[24].
Meta and WhatsApp detected and blocked new spear-phishing attacks linked to NSO Group, and Meta is pursuing a federal court contempt order against the spyware vendor for violating a no-hacking order ^[7]^[18]^[36].
Pirated PC games are being used to distribute password-stealing malware, with over 400,000 devices reportedly infected worldwide ^[42].

Newly Discovered Vulnerabilities

A critical authentication bypass vulnerability in Check Point Remote Access VPN and Mobile Access deployments using IKEv1 has been exploited in zero-day attacks by the Qilin ransomware gang. CISA has ordered US federal agencies to patch within three days ^[8]^[12]^[22]^[25]^[32].
BerriAI LiteLLM is affected by CVE-2026-42271, a high-severity flaw now being exploited in the wild, enabling unauthenticated remote code execution ^[5].
A one-character use-after-free vulnerability in the Linux kernel allows local privilege escalation to root and container escape. Exploits are now public ^[6].
Google patched a new Chrome zero-day vulnerability (CVE-2026-11645) exploited in the wild, marking the fifth such patch this year ^[13]^[33].
Gogs patched a critical zero-day vulnerability enabling remote code execution on Internet-facing instances and access to all repositories ^[19].
Ubiquiti UniFi OS is vulnerable to a chain of three bugs allowing unauthenticated remote code execution with root privileges ^[20].
Everest Forms, a popular WordPress plugin, has a vulnerability being exploited in the wild for remote code execution ^[38].

Notable Threat Actor Activity

The Qilin ransomware gang has been confirmed as the threat actor exploiting the Check Point VPN zero-day vulnerability in active attacks ^[22]^[25]^[32].
The Miasma supply chain campaign has evolved into the Hades attack, involving 37 malicious wheel artifacts across 19 PyPI packages, delivering the Bun credential stealer ^[4]^[27].
The Shai-Hulud supply chain attack compromised 19 science-focused PyPI packages, distributing malware to steal developer secrets ^[17]^[27].
NSO Group has been linked to new WhatsApp spear-phishing campaigns, which were detected and blocked by Meta and WhatsApp ^[7]^[18]^[36].
Silent Ransom Group is escalating its tactics against US law firms, combining vishing, impersonation, and physical intrusion ^[24].

Trends, Tools, or Tactics of Interest

AI-enabled social engineering attacks are increasing, with threat actors leveraging AI to bypass technical security controls and significantly boost phishing campaign volume ^[1]^[9]^[41].
A new side-channel attack called FROST allows malicious websites to track user browser and app activity via SSD timing using only JavaScript, requiring no native code or browser extensions ^[3].
Supply chain attacks via poisoned open-source packages, particularly on PyPI, continue to escalate with evolving tactics and the targeting of developer secrets ^[4]^[17]^[27]^[31].
Android malware (NFCShare) is being distributed as fake banking app updates on GitHub, targeting users with credential-stealing payloads ^[14].
Attackers are increasingly hiding password-stealing malware in cracked and pirated PC games, resulting in large-scale infections ^[42].

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated that US federal agencies patch the critical Check Point VPN vulnerability within three days due to confirmed exploitation by ransomware actors ^[12].
An extension of the Geneva Conventions is being considered to impose restrictions on cyberwarfare during ceasefire conditions, aiming to address current loopholes in international conflict law ^[26].

Sources

SoFi confirms third-party data breach at Hong Kong subsidiary - bleepingcomputer.com
Oxford University discloses data breach after careers platform hack - bleepingcomputer.com
174,000 Impacted by Lansing Community College Data Breach - securityweek.com
8th June – Threat Intelligence Report - research.checkpoint.com
Silent Ransom Group Hits US Law Firms in Escalating Extortion Attacks - darkreading.com
Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order - thehackernews.com
WhatsApp says it disrupted new NSO spyware phishing attacks - bleepingcomputer.com
WhatsApp Catches Spyware Firm NSO Defying No-Hacking Court Order - securityweek.com
Pirated PC games are delivering password-stealing malware - malwarebytes.com
Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups - thehackernews.com
CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day - bleepingcomputer.com
Check Point links VPN zero-day attacks to Qilin ransomware gang - bleepingcomputer.com
Check Point VPN Flaw Exploited Since Early May - darkreading.com
Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks - securityweek.com
LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE - thehackernews.com
One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public - thehackernews.com
Google patches new Chrome zero-day flaw exploited in the wild - bleepingcomputer.com
Google Patches 5th Chrome Zero-Day Exploited in 2026 - securityweek.com
Gogs patches critical zero-day enabling remote code execution - bleepingcomputer.com
Critical UniFi OS bug lets hackers gain root without authentication - bleepingcomputer.com
Everest Forms Vulnerability Exploited to Hack WordPress Sites - securityweek.com
Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer - thehackernews.com
'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud - darkreading.com
New Shai-Hulud attack trojanizes 19 science-focused PyPI packages - bleepingcomputer.com
Report: AI-Enabled Social Engineering Attacks Are on the Rise - blog.knowbe4.com
AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload - thehackernews.com
Americans lost nearly $900 million to AI-powered scams, FBI says - malwarebytes.com
New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing - thehackernews.com
TeamPCP Supply Chain Campaign: Activity Through 2026-06-07, (Mon, Jun 8th) - isc.sans.edu
NFCShare Android malware spreads via fake banking app updates on GitHub - bleepingcomputer.com
Iran Signed a Ceasefire — Its Hackers Didn't - darkreading.com