DanSec

Cybersecurity Brief

Thursday 11 June 2026

In this brief Oracle, Ivanti, Microsoft, VRChat, Langflow, Cisco, +13 more
Vendors
Oracle, Ivanti, Microsoft, VRChat, Langflow, Cisco, Splunk, GitHub, Google, Arista, Palo Alto Networks
Threat actors
ShinyHunters, JDY botnet, Miasma, The Gentlemen, APT32, Nightmare Eclipse
CVEs
CVE-2026-5027, CVE-2026-42897

Major Incidents or Breaches

  • The University of Nottingham suffered a data breach impacting over 450,000 current and former students, with the ShinyHunters group taking credit and leaking email addresses and other information[13][39].
  • Oracle PeopleSoft servers have been targeted in ongoing data theft attacks by the ShinyHunters extortion gang, who claim to have stolen data from over 100 organizations[18].
  • Data belonging to 2.4 million VRChat users has been stolen in a breach, exposing sensitive user information[44].

Newly Discovered Vulnerabilities

  • Multiple critical vulnerabilities have been patched by Ivanti, Fortinet, and SAP, with risks including arbitrary code execution and information disclosure[9].
  • Microsoft patched three zero-days as part of its largest-ever Patch Tuesday, addressing 206 vulnerabilities in total[47].
  • A high-severity, unpatched path traversal vulnerability in the Langflow AI development platform (CVE-2026-5027) is under active exploitation, allowing unauthenticated attackers to write arbitrary files and achieve remote code execution[10][15][34].
  • A maximum-severity flaw in Ivanti Sentry, recently patched, is being actively exploited to execute code with root privileges on exposed secure mobile gateways[14].
  • Microsoft released a fix for a BitLocker recovery bug affecting Windows Server 2025 devices that caused systems to boot into recovery mode after a security update[12].
  • Microsoft patched an actively exploited Exchange Server vulnerability (CVE-2026-42897) that allowed arbitrary JavaScript execution via cross-site scripting attacks in Outlook Web Access[21][40].
  • CISA added actively exploited vulnerabilities in Cisco, Chrome, and Arista products to its Known Exploited Vulnerabilities (KEV) catalog, following reports of in-the-wild attacks[11].
  • Splunk and Palo Alto Networks released patches for severe vulnerabilities that could allow attackers to create or modify arbitrary files and access protected resources[37].
  • A Windows Defender bug, with proof-of-concept code released by the “Nightmare-Eclipse” actor, allows for system takeover and bypassing BitLocker protection[26][38].

Notable Threat Actor Activity

  • The China-linked JDY botnet has expanded to over 1,500 SOHO devices, increasing its reconnaissance activity and specifically expanding targeting of US military networks[8][19].
  • OceanLotus, a Vietnam-aligned threat actor, has been linked to campaigns targeting domestic entities and investors using the SPECTRALVIPER backdoor[6].
  • The Miasma worm, a credential-stealing attack framework recently used in supply-chain attacks on open-source ecosystems, had its source code briefly leaked on GitHub[16].
  • The ransomware group “The Gentlemen” has emerged as the second most active by victim count, rapidly recruiting skilled hackers through aggressive tactics[31].
  • ShinyHunters continue to target enterprise systems for data theft and extortion, including attacks on the University of Nottingham and Oracle PeopleSoft servers[13][18][39].
  • Infostealers are increasingly turning millions of devices into credential theft platforms, providing initial access for ransomware and other cybercrime operations[41].
  • Free “Spotify Premium” hacks promoted on social media platforms like TikTok and Instagram are being used to distribute infostealers[46].
  • Attackers are bypassing weak authentication controls via phishing, MFA fatigue, and service desk social engineering, highlighting the need for robust identity verification practices[20].
  • AI-driven changes are disrupting traditional vulnerability management, leading CISOs to shift budgets toward Breach and Attack Simulation (BAS) tools[5].
  • The rise of AI risks is causing some insurers to explicitly exclude AI-related incidents from cyber insurance policies, while others are developing new frameworks to address emerging threats[25].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA has issued a new directive requiring US federal agencies to patch the most dangerous vulnerabilities within three days, in response to the accelerated threat landscape driven by AI-enabled attacks[23][28][33].
  • The UK government announced a requirement for Apple and Google to block nude images on children’s phones by September, with a stipulation that no data is collected during the process[45].
  • GitHub will disable npm install scripts by default in npm version 12 to mitigate software supply chain attacks, representing a significant change for the open-source ecosystem[7][17].

Sources

  1. Nottingham University data breach affects over 450,000 students - bleepingcomputer.com
  2. University of Nottingham Confirms Breach After Hackers Leak Data - securityweek.com
  3. Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks - bleepingcomputer.com
  4. Data of 2.4 million VRChat users stolen - malwarebytes.com
  5. Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities - thehackernews.com
  6. Microsoft’s biggest-ever Patch Tuesday fixes 206 bugs, including 3 zero-days - malwarebytes.com
  7. Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE - thehackernews.com
  8. Path traversal flaw in AI dev platform Langflow exploited in attacks - bleepingcomputer.com
  9. Hackers Exploit Langflow Vulnerability for Remote Code Execution - securityweek.com
  10. Max severity Ivanti Sentry vulnerability now exploited in attacks - bleepingcomputer.com
  11. Microsoft fixes BitLocker recovery bug on Windows Server 2025 - bleepingcomputer.com
  12. Microsoft patches Exchange Server zero-day exploited in attacks - bleepingcomputer.com
  13. Microsoft Patches Exploited Exchange Server Vulnerability - securityweek.com
  14. CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation - thehackernews.com
  15. Splunk, Palo Alto Networks Patch Severe Vulnerabilities - securityweek.com
  16. Nightmare-Eclipse Drops Yet Another Microsoft Exploit, RoguePlanet - darkreading.com
  17. ‘GreatXML’ Zero-Day Exploit Bypasses BitLocker - securityweek.com
  18. China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance - thehackernews.com
  19. China-linked JDY botnet expands targeting of U.S. military networks - bleepingcomputer.com
  20. OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack - thehackernews.com
  21. The ‘Miasma’ worm source code briefly leaked on GitHub - bleepingcomputer.com
  22. Who Runs the Ransomware Group ‘The Gentlemen?’ - krebsonsecurity.com
  23. Infostealers Turn Millions of Devices Into Credential Theft Machines - securityweek.com
  24. Free Spotify Premium hacks on social media are spreading infostealers - malwarebytes.com
  25. The 5 Best Practices for Secure Identity Verification - bleepingcomputer.com
  26. AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS. - thehackernews.com
  27. AI Risk Worries Insurers and Businesses Alike - darkreading.com
  28. CISA Rewrites Federal Patching Requirements for AI Threat Era - darkreading.com
  29. CISA Tells US Agencies to Fix Security Bugs in as Little as 3 Days Thanks to AI Threats - wired.com
  30. CISA Issues New Directive Improving How Federal Agencies Prioritize the Mitigation of Cyber Vulnerabilities - cisa.gov
  31. Children’s phones must block nude images by September, UK says - malwarebytes.com
  32. GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks - thehackernews.com
  33. GitHub announces npm security changes to tackle supply-chain attacks - bleepingcomputer.com