Major Incidents or Breaches

  • SoFi confirmed a data breach at its Hong Kong subsidiary following unauthorised access to a third-party vendor database containing customer information [15].
  • The University of Oxford disclosed a data breach after its CareerConnect careers platform, managed by third-party provider Group GTI, was compromised [23].
  • Lansing Community College reported a breach impacting 174,000 individuals, with hackers accessing personal data from college systems [39].
  • DentaQuest, a US dental benefits administrator, suffered a breach exposing sensitive data, as reported in recent threat intelligence [40].
  • Silent Ransom Group targeted US law firms in escalating extortion attacks, using vishing, IT impersonation, and in-person intrusions to steal data [24].
  • Meta and WhatsApp detected and blocked new spear-phishing attacks linked to NSO Group, and Meta is pursuing a federal court contempt order against the spyware vendor for violating a no-hacking order [7][18][36].
  • Pirated PC games are being used to distribute password-stealing malware, with over 400,000 devices reportedly infected worldwide [42].

Newly Discovered Vulnerabilities

  • A critical authentication bypass vulnerability in Check Point Remote Access VPN and Mobile Access deployments using IKEv1 has been exploited in zero-day attacks by the Qilin ransomware gang. CISA has ordered US federal agencies to patch within three days [8][12][22][25][32].
  • BerriAI LiteLLM is affected by CVE-2026-42271, a high-severity flaw now being exploited in the wild, enabling unauthenticated remote code execution [5].
  • A one-character use-after-free vulnerability in the Linux kernel allows local privilege escalation to root and container escape. Exploits are now public [6].
  • Google patched a new Chrome zero-day vulnerability (CVE-2026-11645) exploited in the wild, marking the fifth such patch this year [13][33].
  • Gogs patched a critical zero-day vulnerability enabling remote code execution on Internet-facing instances and access to all repositories [19].
  • Ubiquiti UniFi OS is vulnerable to a chain of three bugs allowing unauthenticated remote code execution with root privileges [20].
  • Everest Forms, a popular WordPress plugin, has a vulnerability being exploited in the wild for remote code execution [38].

Notable Threat Actor Activity

  • The Qilin ransomware gang has been confirmed as the threat actor exploiting the Check Point VPN zero-day vulnerability in active attacks [22][25][32].
  • The Miasma supply chain campaign has evolved into the Hades attack, involving 37 malicious wheel artifacts across 19 PyPI packages, delivering the Bun credential stealer [4][27].
  • The Shai-Hulud supply chain attack compromised 19 science-focused PyPI packages, distributing malware to steal developer secrets [17][27].
  • NSO Group has been linked to new WhatsApp spear-phishing campaigns, which were detected and blocked by Meta and WhatsApp [7][18][36].
  • Silent Ransom Group is escalating its tactics against US law firms, combining vishing, impersonation, and physical intrusion [24].

Trends, Tools, or Tactics of Interest

  • AI-enabled social engineering attacks are increasing, with threat actors leveraging AI to bypass technical security controls and significantly boost phishing campaign volume [1][9][41].
  • A new side-channel attack called FROST allows malicious websites to track user browser and app activity via SSD timing using only JavaScript, requiring no native code or browser extensions [3].
  • Supply chain attacks via poisoned open-source packages, particularly on PyPI, continue to escalate with evolving tactics and the targeting of developer secrets [4][17][27][31].
  • Android malware (NFCShare) is being distributed as fake banking app updates on GitHub, targeting users with credential-stealing payloads [14].
  • Attackers are increasingly hiding password-stealing malware in cracked and pirated PC games, resulting in large-scale infections [42].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA has mandated that US federal agencies patch the critical Check Point VPN vulnerability within three days due to confirmed exploitation by ransomware actors [12].
  • An extension of the Geneva Conventions is being considered to impose restrictions on cyberwarfare during ceasefire conditions, aiming to address current loopholes in international conflict law [26].

Sources#

  1. SoFi confirms third-party data breach at Hong Kong subsidiary - bleepingcomputer.com
  2. Oxford University discloses data breach after careers platform hack - bleepingcomputer.com
  3. 174,000 Impacted by Lansing Community College Data Breach - securityweek.com
  4. 8th June – Threat Intelligence Report - research.checkpoint.com
  5. Silent Ransom Group Hits US Law Firms in Escalating Extortion Attacks - darkreading.com
  6. Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order - thehackernews.com
  7. WhatsApp says it disrupted new NSO spyware phishing attacks - bleepingcomputer.com
  8. WhatsApp Catches Spyware Firm NSO Defying No-Hacking Court Order - securityweek.com
  9. Pirated PC games are delivering password-stealing malware - malwarebytes.com
  10. Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups - thehackernews.com
  11. CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day - bleepingcomputer.com
  12. Check Point links VPN zero-day attacks to Qilin ransomware gang - bleepingcomputer.com
  13. Check Point VPN Flaw Exploited Since Early May - darkreading.com
  14. Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks - securityweek.com
  15. LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE - thehackernews.com
  16. One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public - thehackernews.com
  17. Google patches new Chrome zero-day flaw exploited in the wild - bleepingcomputer.com
  18. Google Patches 5th Chrome Zero-Day Exploited in 2026 - securityweek.com
  19. Gogs patches critical zero-day enabling remote code execution - bleepingcomputer.com
  20. Critical UniFi OS bug lets hackers gain root without authentication - bleepingcomputer.com
  21. Everest Forms Vulnerability Exploited to Hack WordPress Sites - securityweek.com
  22. Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer - thehackernews.com
  23. 'Hades' Campaign Against PyPI Puts New Spin on Shai-Hulud - darkreading.com
  24. New Shai-Hulud attack trojanizes 19 science-focused PyPI packages - bleepingcomputer.com
  25. Report: AI-Enabled Social Engineering Attacks Are on the Rise - blog.knowbe4.com
  26. AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload - thehackernews.com
  27. Americans lost nearly $900 million to AI-powered scams, FBI says - malwarebytes.com
  28. New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing - thehackernews.com
  29. TeamPCP Supply Chain Campaign: Activity Through 2026-06-07, (Mon, Jun 8th) - isc.sans.edu
  30. NFCShare Android malware spreads via fake banking app updates on GitHub - bleepingcomputer.com
  31. Iran Signed a Ceasefire — Its Hackers Didn't - darkreading.com