Wednesday 10 June 2026

Major Incidents or Breaches

• Microsoft confirmed that 73 of its open-source GitHub repositories were compromised to inject password-stealing malware as part of a supply chain attack linked to the Miasma worm. Some repositories remain offline as the investigation continues, and the incident disrupted continuous integration pipelines for several Microsoft projects ^[11][27][31].
• ServiceNow disclosed a security incident where attackers exploited an unauthenticated API flaw, enabling unauthorized access to customer data. The vulnerability had reportedly been known since April and has since been patched ^[6][20][43].
• Two Russia-aligned threat actor campaigns continue to exploit a WinRAR vulnerability (CVE-2025-8088), patched last July, to deploy information stealers and conduct cyberespionage against Ukrainian government and military organizations ^[12][32].

Newly Discovered Vulnerabilities

• Microsoft released a record 206 security fixes during the June 2026 Patch Tuesday, including three zero-day vulnerabilities. Notable among these are privilege escalation flaws in Microsoft Defender (“RoguePlanet”), YellowKey, GreenPlasma, and MiniPlasma, as well as critical remote code execution vulnerabilities across its software portfolio ^{[4][7][16][19][24][29][38][41][47]}.
• Google released patches for 74 Chrome vulnerabilities, including a high-severity V8 zero-day (CVE-2026-11645) that is being actively exploited in the wild ^[14].
• Veeam patched a critical remote code execution flaw (CVE-2026-44963) in its Backup & Replication software, which allowed authenticated domain users to execute code remotely on affected servers ^[10][28].
• Ivanti fixed two critical vulnerabilities in its Sentry secure mobile gateway, including a maximum-severity flaw enabling remote code execution as root, and Fortinet patched remotely exploitable OS command injection vulnerabilities ^[17][44].
• SAP addressed 15 vulnerabilities in its June patch release, including four critical-severity flaws in NetWeaver and Commerce Cloud ^[22].
• Adobe patched 123 vulnerabilities, nearly half of which could allow arbitrary code execution, primarily affecting Experience Manager ^[48].
• OpenSSL addressed 18 vulnerabilities in its latest release, including high-severity issues, several of which were potentially discovered through AI-assisted analysis ^[50].
• Six vulnerabilities were disclosed in protobuf.js, exposing Node.js applications to remote code execution and denial of service ^[8].
• Microsoft Exchange was found vulnerable to email spoofing via the “Ghost-Sender” attack in hybrid environments using third-party mail servers or spam filters ^[30].

Notable Threat Actor Activity

• Russia-aligned groups are actively exploiting a WinRAR vulnerability to deliver stealers and conduct espionage against Ukrainian targets, leveraging a flaw that has been patched for nearly a year ^[12][32].

Trends, Tools, or Tactics of Interest

• The use of AI in cybersecurity is accelerating both vulnerability discovery and exploit development, contributing to the record number of vulnerabilities patched this month. AI-driven models such as Claude Mythos have demonstrated the ability to rapidly create working exploits for recently disclosed vulnerabilities, potentially shortening the window between disclosure and exploitation ^{[29][37][49][51]}.
• Anthropic released two versions of its new AI model: Claude Mythos 5, available to trusted cybersecurity partners with fewer restrictions, and Claude Fable 5, a public release with built-in cyberattack safeguards ^{[5][18][37][49]}.
• University of Toronto researchers demonstrated a proof-of-concept self-replicating AI worm using locally hosted open-weight LLMs to autonomously propagate and conduct network attacks ^[13].
• Automated pentesting tools may miss critical vulnerabilities over time, highlighting the need for expert-driven assessments to supplement automation ^[3].
• Phishing campaigns are increasingly leveraging real hotel reservation details to target travelers, indicating an evolution in social engineering tactics ^[2].
• Simulation testing revealed that the OpenClaw AI email agent is susceptible to phishing attacks, leaking user data under conditions that commonly compromise human users ^[21].

Regulatory or Policy Developments Affecting the Security Industry

• Microsoft released extended security updates for Windows 10 (KB5094127) and cumulative updates for Windows 11 (KB5094126, KB5093998), addressing vulnerabilities and adding new security features ^[23][25].
• Organizations are advised to apply vendor-supplied mitigations or discontinue use of vulnerable Arista EOS devices, as no patch will be issued for an exploited vulnerability ^[46].

Sources

1. Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues - thehackernews.com
2. GitHub disables Microsoft repos pushing password-stealing malware - bleepingcomputer.com
3. Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories - darkreading.com
4. ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances - thehackernews.com
5. ServiceNow discloses security incident exposing customer data - bleepingcomputer.com
6. ServiceNow Patches Vulnerability Exploited Against Some Customers - securityweek.com
7. WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine - thehackernews.com
8. Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs - darkreading.com
9. Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs - thehackernews.com
10. Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows - thehackernews.com
11. Microsoft patches YellowKey, GreenPlasma, MiniPlasma zero-days - bleepingcomputer.com
12. Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges - bleepingcomputer.com
13. Microsoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flaws - bleepingcomputer.com
14. Blame AI: Patch Tuesday Hits Record 206 CVEs - darkreading.com
15. A Record-Breaking Patch Tuesday for June 2026 - krebsonsecurity.com
16. Microsoft June 2026 Patch Tuesday, (Tue, Jun 9th) - isc.sans.edu
17. Microsoft Patches 200 Vulnerabilities - securityweek.com
18. Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now - thehackernews.com
19. Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code - thehackernews.com
20. New Veeam vulnerability exposes backup servers to RCE attacks - bleepingcomputer.com
21. Ivanti: Max severity Sentry flaw allows code execution as root - bleepingcomputer.com
22. Critical Vulnerabilities Patched in Fortinet, Ivanti Products - securityweek.com
23. SAP fixes critical flaws in NetWeaver and Commerce Cloud - bleepingcomputer.com
24. Adobe Patches 123 Vulnerabilities - securityweek.com
25. OpenSSL Patches High-Severity Vulnerability Found With AI - securityweek.com
26. Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS - thehackernews.com
27. Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address - darkreading.com
28. Anthropic Offers Mythos Upgrade for Cyber Partners and a ‘Safe’ Version for the Rest of You - wired.com
29. Anthropic Launches Claude Fable 5: Mythos-Class AI With Cybersecurity Guardrails - securityweek.com
30. Claude Mythos Turns N-Days Into N-Hours With Rapid Exploit Creation - securityweek.com
31. Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards - thehackernews.com
32. Anthropic rolls out Claude Fable 5, but it's available for a limited time - bleepingcomputer.com
33. Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models - thehackernews.com
34. Your Automated Pentest Looks Clean. See What It Missed in This Expert Webinar - thehackernews.com
35. CyberheistNews Vol 16 #23 Now Phishing Attacks Use Real Hotel Reservations to Target Travelers - blog.knowbe4.com
36. OpenClaw AI agent found falling for phishing attacks, spills user data - bleepingcomputer.com
37. Microsoft releases Windows 10 KB5094127 extended security update - bleepingcomputer.com
38. Windows 11 KB5094126 & KB5093998 cumulative updates released - bleepingcomputer.com
39. No Patch Planned for Exploited Arista EOS Vulnerability - securityweek.com