CVE-2026-20230 on DanSec Daily

Cybersecurity Brief – 2026-06-24

Wed, 24 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Tata Electronics confirmed a cyberattack that impacted parts of its IT infrastructure, with hackers leaking company data online ^[11].
Healthtech firm Xsolis suffered a data breach impacting nearly 1.4 million individuals after attackers gained access via a phishing attack ^[13].
LastPass reported a data breach resulting from the Klue supply chain attack, where attackers used stolen OAuth tokens to access customer data in its Salesforce environment ^[17]^[19].
The scope of Salesforce attacks has expanded, with more victims reporting data breaches as a result of attackers leveraging Klue’s compromised OAuth tokens ^[19].
Dialog, a private events group, experienced a data exposure incident due to a misconfigured website, leaving member information accessible without evidence of a break-in ^[23].
The Texas Parks and Wildlife Department suffered a breach at a third-party vendor, exposing passport and driver’s license data of over three million Texans ^[39].

Newly Discovered Vulnerabilities

A critical SSRF vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager is being actively exploited in the wild after public proof-of-concept code was released ^[3]^[10]^[28].
Researchers found data exposure vulnerabilities in the Dify AI platform, potentially allowing attackers to read private chats, preview documents, and access internal APIs across over one million apps ^[31].
An eight-year-old high-severity use-after-free vulnerability in Samsung’s KNOX security framework affected Galaxy devices from S9 through S25, exposing millions of devices to kernel-level attacks ^[32].
The FFmpeg PixelSmash flaw enables remote code execution via crafted media files when processed by applications using the libavcodec library ^[35].
Malicious npm packages masquerading as PostCSS tools have been identified delivering a Windows-based remote access trojan (RAT) ^[9].
A new macOS ClickFix attack uses terminal commands to silently mount DMG files and deploy infostealer malware without user interaction ^[14].

Notable Threat Actor Activity

The Russian-speaking FortiBleed initial access broker is behind a large-scale campaign targeting over 430,000 FortiGate firewalls globally, harvesting 110 million credentials using a Golang-based sniffer ^[4]^[22].
A newly identified extortion group, “Pink,” is using voice phishing and IT support impersonation calls to breach organizations, possibly as a rebrand of previous extortion actors ^[2].
Two members of the Scattered Spider cybercrime group pleaded guilty to hacking Transport for London in 2024, following an attack that disrupted public transport systems ^[15]^[24].
SocGholish, linked to Evil Corp, continues using traffic distribution systems (TDSs) to facilitate initial access for cybercrime operations ^[21].

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging workplace collaboration tools such as Microsoft Teams to launch social engineering and phishing attacks ^[1].
Fake AI agent skills have been shown to pass security scans and reach thousands of corporate and individual agents via skill marketplaces and social media promotion ^[5].
There is a trend of attackers exploiting newly disclosed vulnerabilities rapidly, often before organizations can patch, with security teams urged to validate exploitability as soon as vulnerabilities are public ^[16].
GitHub updated its actions/checkout to block common pwn request attack patterns, targeting the misuse of pull_request_target workflows in CI/CD pipelines ^[7].
Malicious pull requests, dubbed “Cordyceps,” are threatening developer workflows across multiple major platforms including Azure Sentinel, Google’s AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and Python Software Foundation’s Black ^[20].
Dragos introduced EmberAI, an AI-driven capability for operational technology security, leveraging its OT cybersecurity dataset ^[30].
OpenAI has shifted its cybersecurity focus toward patching vulnerabilities over merely discovering them, expanding its Daybreak initiative with new tools and partnerships ^[36].

Regulatory or Policy Developments Affecting the Security Industry

A US executive order signed on June 22 mandates federal agencies to migrate high-value assets and high-impact systems to post-quantum cryptography by 2030, with specific deadlines for key establishment and digital signature protections ^[6].

Sources

Tata Electronics confirms cyberattack as hackers leak data - bleepingcomputer.com
Healthtech firm Xolis suffers data breach impacting 1.4 million people - bleepingcomputer.com
LastPass confirms data breach in Klue supply chain attack - bleepingcomputer.com
Scope of Salesforce Attacks Expands as Icarus Leaks Data - darkreading.com
Dialog Claims It Was Hacked. A Misconfigured Website Left Its Members Exposed - wired.com
Hackers steal passport and driver’s license data of 3 million Texans - malwarebytes.com
Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root - thehackernews.com
Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks - bleepingcomputer.com
Hackers Exploiting Cisco Unified CM Vulnerability - securityweek.com
Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps - securityweek.com
Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel Attacks - securityweek.com
FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances - securityweek.com
Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT - thehackernews.com
New macOS ClickFix attack silently mounts DMGs to push infostealer - bleepingcomputer.com
FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation - thehackernews.com
FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist - darkreading.com
New Extortion Brand Uses IT Impersonation to Breach Organizations - blog.knowbe4.com
Scattered Spider members plead guilty to hacking Transport for London - bleepingcomputer.com
Scattered Spider Hackers Plead Guilty on Day 1 of Trial - krebsonsecurity.com
SocGholish Takedown Highlights Malicious TDS Threats - darkreading.com
Social Engineering Attacks Abuse Workplace Collaboration Tools - blog.knowbe4.com
Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents - thehackernews.com
The Exploit Doesn't Exist. You Can Still Prove It Works Against You - bleepingcomputer.com
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns - thehackernews.com
'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows - darkreading.com
Dragos Unveils AI for OT Security - securityweek.com
OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery - securityweek.com
Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration - thehackernews.com

Cybersecurity Brief – 2026-06-05

Fri, 05 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

The Windows version of Hola Browser was compromised in a supply chain attack, resulting in the delivery of an undeclared cryptocurrency miner to users ^[15].
DentaQuest, a dental benefits administrator, suffered a data breach exposing sensitive information of 2.6 million accounts ^[17].
The United Nations World Food Programme disclosed a breach of its self-registration application for Palestine, affecting 600,000 Gaza households ^[18].
Nightclub operator RCI reported a data breach after detecting a network intrusion in March, with files containing information on 40,000 individuals stolen ^[32].
Unknown attackers maintained persistent access to the Outlook mailbox of a senior executive at a major global stock exchange for at least five months, exfiltrating inbox data in small batches ^[12].
Meta’s AI support bot was manipulated by attackers to hand over control of Instagram accounts by changing recovery email addresses ^[42].

Newly Discovered Vulnerabilities

Cisco patched a critical vulnerability (CVE-2026-20230) in Unified Communications Manager that allowed unauthenticated attackers to write files and escalate privileges to root. Proof-of-concept exploit code is public ^[5]^[23].
Cisco warned of an actively exploited, unpatched zero-day in Cisco Catalyst SD-WAN Manager (CVE-2026-20245), enabling root privilege escalation. This is the seventh SD-WAN zero-day exploited in 2026 ^[13]^[33].
A flaw in Anthropic’s Claude Code GitHub Action allowed attackers to hijack public repositories by submitting a single malicious GitHub issue ^[6].
A vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento can be exploited without authentication to execute code on Magento servers using serialized PHP object payloads ^[38].
Researchers identified a hijack method for Google’s Gemini voice assistant via messaging notifications, enabling attackers to control smart home devices and initiate Zoom calls ^[37].

Notable Threat Actor Activity

The threat actor PCPJack hijacked 230 cloud servers across AWS, Google Cloud, and Azure to create a covert SMTP relay network for email-based attacks ^[4].
The China-linked cybercrime group TA4922 expanded its phishing and malware campaigns to target organizations in the UK, Germany, Italy, and South Africa, leveraging credential phishing, malware distribution, and fraud ^[9]^[25]^[39].
A new Magecart campaign is abusing Stripe’s API infrastructure to host credit card-stealing payloads and exfiltrate stolen payment data from checkout pages ^[16].
Researchers and the FBI warned of a surge in FIFA World Cup 2026 scams, including fake sites, banking malware, and credential theft targeting fans ahead of the event ^[3].
Operation FlutterBridge is distributing the FlutterShell backdoor to macOS users via malicious Google and YouTube ads ^[10].
A supply chain attack infected 36 npm packages with infostealer malware named IronWorm, targeting developers and propagating via compromised credentials ^[19]^[24].

Trends, Tools, or Tactics of Interest

Chinese-language phishing kits are becoming more advanced, with phishing-as-a-service offerings proliferating in Chinese cybercriminal circles ^[2].
Large-scale operations are impersonating open-source and freeware tools using Traffic Distribution Systems (TDS) to deliver malware through highly ranked fake sites in Google search results ^[11].
Attackers are increasingly exploiting gaps in vulnerability management programs, with underground tutorials teaching newcomers how to identify and profit from unpatched systems ^[20].
The use of MSI-branded background payloads embedded in JPEG images for malware delivery has re-emerged, indicating continued evolution of steganographic techniques ^[30].
Law enforcement and technology companies disrupted infrastructure linked to scammers across Southeast Asia, impacting over 1.4 million accounts ^[40].

Regulatory or Policy Developments Affecting the Security Industry

Bugcrowd launched a European Union data residency option to address evolving data sovereignty requirements amid growing geopolitical tensions ^[27].

Sources

Hola Browser for Windows compromised to deliver cryptominer - bleepingcomputer.com
DentaQuest data breach exposed info of 2.6 million accounts - bleepingcomputer.com
UN food agency discloses breach affecting 600,000 Gaza households - bleepingcomputer.com
Nightclub Giant RCI Says Data Breach Affects 40,000 Individuals - securityweek.com
Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months - thehackernews.com
Meta’s AI support bot happily handed Instagram accounts to hackers - malwarebytes.com
Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public - thehackernews.com
Cisco warns of critical Unified CM flaw with PoC exploit code - bleepingcomputer.com
Cisco warns of unpatched SD-WAN zero-day exploited in attacks - bleepingcomputer.com
Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026 - securityweek.com
Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories - thehackernews.com
Mirasvit Vulnerability Exploited to Execute Code on Magento Servers - securityweek.com
Gemini Voice Assistant Hijacked via Messaging Notifications - securityweek.com
PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network - thehackernews.com
China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa - thehackernews.com
China's TA4922 Expands Cybercrime Attacks Globally - darkreading.com
Chinese Cybercrime Group in Spotlight for Record Campaign Pace - securityweek.com
Credit card theft campaign abuses Stripe to host stolen payment info - bleepingcomputer.com
FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins - thehackernews.com
FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads - thehackernews.com
New IronWorm malware hits 36 packages in npm supply-chain attack - bleepingcomputer.com
Rust-Written IronWorm Hits NPM Supply Chain - darkreading.com
Chinese-Language Phishing Kits Are Growing More Advanced - blog.knowbe4.com
Fake Sites Mimicking Open-Source Tools Rank High on Google to Deliver Malware via TDS - thehackernews.com
Hackers Are After the Gaps in Your Vulnerability Program: Here's Their Playbook - bleepingcomputer.com
The Evil MSI Background is Back!, (Fri, Jun 5th) - isc.sans.edu
Over 1.4 Million Accounts Disrupted in Cybercrime Crackdown - securityweek.com
Bugcrowd Launches EU Data Residency Option For Evolving Data Sovereignty Needs - darkreading.com