CTI Daily Brief — 2026-06-11

ServiceNow unauthenticated REST endpoint queried customer instance tables before a silent 5 June patch

ServiceNow disclosed on 9 June 2026 that a Scripted REST Resource at /api/now/related_list_edit/create was shipped with requires_authentication=false, so the endpoint accepted unauthenticated requests and could be used to query arbitrary customer instance tables (BleepingComputer, 2026-06-09). Anomalous activity was observed from 2–4 June from a single source IP, and ServiceNow applied a server-side fix to hosted instances on 5 June, reconfiguring the endpoint to require authentication (The Hacker News, 2026-06-10). Instances on the "Australia" platform release, or older releases with specific configuration changes, were affected; no CVE has been assigned. ServiceNow's own assessment is that the observed activity was "likely tied to security researchers or customer-led research associated with bug bounty submissions rather than malicious threat actors," while NCSC-CH GovCERT recorded the issue as "Actively Exploited" — the company confirms it saw evidence of successful table queries against a subset of customers regardless of attribution (TechCrunch, 2026-06-10). Technique class: T1190 Exploit Public-Facing Application → T1213 Data from Information Repositories, with downstream T1078 Valid Accounts if tokens stored in tickets were harvested. The advisory (KB3067321) was initially gated behind the customer support portal, so organisations that do not actively monitor it may not know a case was opened on their tenant.

Why it matters to us: ServiceNow is a reference ITSM/CMDB/HR platform across the Swiss Confederation, cantonal administrations and EU institutions, and its instances routinely hold support-ticket credentials, embedded API tokens, asset inventories and security-incident records. Audit all Scripted REST Resources for requires_authentication=false (filter sys_ws_operation on acl.requires_authentication=false), review access_log_transaction for requests to /api/now/related_list_edit in the 2–5 June window, and rotate any secrets exposed in support workflows.

"RoguePlanet" Microsoft Defender zero-day: TOCTOU race in the scan engine yields a SYSTEM shell, no CVE, no patch

A researcher operating as "Nightmare Eclipse" (also tracked as Chaotic Eclipse) published a working proof-of-concept named RoguePlanet on 9 June 2026 — hours after Microsoft patched two of the researcher's earlier disclosures (YellowKey/CVE-2026-45585 and GreenPlasma/CVE-2026-50507) in June Patch Tuesday (BleepingComputer, 2026-06-09). RoguePlanet abuses a time-of-check/time-of-use race condition in the Microsoft Defender real-time scan engine (MsMpEng.exe, running as SYSTEM): an attacker times a file-system operation to coincide with Defender's scan pass and redirects it, achieving local privilege escalation to SYSTEM on fully-patched Windows 10 and 11 (SecurityWeek, 2026-06-10). NCSC-CH GovCERT consolidated this disclosure alongside the researcher's prior 2026 Defender drops — BlueHammer, RedSun, UnDefend, YellowKey and GreenPlasma (NCSC-CH GovCERT, 2026-06-10). The primitive requires local code execution first (a standard-user foothold is sufficient) and is reliability-limited by the race; no in-the-wild exploitation has been reported and Microsoft has not assigned a CVE or issued an advisory. Technique class: T1068 Exploitation for Privilege Escalation.

Why it matters to us: Microsoft Defender is the default endpoint protection on Windows fleets across Swiss federal and EU public-sector environments, so the affected component is universal. With no patch, detection is the control: alert on MsMpEng.exe spawning cmd.exe/powershell.exe child processes (Sysmon EID 1 / Windows 4688 with parent image in the Defender path) and on SYSTEM-context shells not tied to a service restart.

EDPB adopts a harmonised GDPR Article 33 breach-notification template; consultation open to 5 August

The European Data Protection Board adopted a common EU/EEA template for personal-data-breach notifications under GDPR Article 33 at its 10 June 2026 plenary, opening it for public consultation until 5 August 2026 (EDPB, 2026-06-10). The template provides predefined fields aligned to Article 33 content requirements — categories of data and data subjects, approximate number of individuals affected, likely consequences, and measures taken — and is intended to replace the current patchwork of national DPA forms, reducing notification friction for cross-border incidents and for smaller organisations without dedicated DPOs (EDPB template, 2026-06-10). After the consultation closes the EDPB will set an adoption timeline for national authorities.

CVE-2026-5027 — Langflow: unauthenticated path traversal to arbitrary file write, exploited in the wild

CVE-2026-5027 (CVSS 8.8, CWE-22) is a path-traversal flaw in Langflow — the widely deployed open-source low-code platform for building LLM pipelines, RAG systems and agentic workflows. The POST /api/v2/files endpoint fails to sanitise the filename parameter in multipart form data, allowing ../ sequences to write files to arbitrary filesystem locations (BleepingComputer, 2026-06-10). It is effectively pre-authentication: Langflow ships with LANGFLOW_AUTO_LOGIN enabled by default, so a single unauthenticated request obtains a valid session token before reaching the file-write primitive, which chains to code execution via webshell placement or .pth injection. Tenable discovered and disclosed the flaw on 27 March 2026 after two months of unsuccessful vendor contact (Tenable TRA-2026-26, 2026-03-27); VulnCheck subsequently observed active exploitation in honeypots, with attackers staging test files on victim systems, and Censys data shows roughly 7,000 publicly exposed instances. A patch is now available (Langflow 1.9.0 / langflow-base 0.8.3, with 1.10.0 released 10 June). Technique: T1190 Exploit Public-Facing Application → T1505.003 Web Shell.

CVE Summary Table

CVE-2026-41089 is carried as a § 4 update — see below; it is listed here for the consolidated vulnerability view.

Black Lotus Labs: the Volt Typhoon-linked JDY botnet doubles to 1,500+ devices and weaponises CVE disclosures within hours

Lumen's Black Lotus Labs reports that the JDY botnet — the reconnaissance cluster that survived the 2024 KV-botnet takedown and is assessed with high confidence to support multiple China-nexus actors including Volt Typhoon — has more than doubled from roughly 650 bots in January 2024 to over 1,500 compromised SOHO and IoT devices (Lumen Black Lotus Labs, 2026-06-10). The botnet now spans Cisco, Araknis, Mimosa Networks, Ubiquiti, Draytek, Hikvision and Linksys devices, performs multiprotocol service fingerprinting, banner-grabbing and TLS-certificate collection at scale, and routes C2 through hidden Tor services while managing victims with the open-source Platypus reverse-shell server. The operationally significant finding: scanning of Fortinet devices spiked within hours of the public disclosure of CVE-2026-35616, demonstrating sub-24-hour integration of new vulnerability intelligence into the recon-to-exploitation pipeline (The Hacker News, 2026-06-10). Targeting centres on US military and associated entities, with distributed European nodes. Technique mapping: T1595.002 Active Scanning: Vulnerability Scanning, T1590 Gather Victim Network Information, T1584.005 Compromise Infrastructure: Botnet.

Why it matters to us: JDY scanning should be treated as a precursor to targeted exploitation, not background noise — the sub-24-hour weaponisation window means CH/EU public-sector and critical-infrastructure operators must compress patch cycles for internet-facing edge appliances to hours, not weeks, after a disclosure. Hunt for outbound connections from edge/SOHO devices to the Platypus default service, unusual high-rate outbound SYN scanning, and unexpected TLS-certificate harvesting.

ANNUAL REPORT [SINGLE-SOURCE] — CrowdStrike 2026 Technology Threat Landscape Report: technology is now the most-targeted sector

CrowdStrike published its 2026 Technology Threat Landscape Report on 9 June 2026 (CrowdStrike, 2026-06-09). The findings most relevant to a Swiss/EU public-sector SOC running AI and cloud DevOps infrastructure: China-nexus adversaries (named clusters include MURKY PANDA, MUSTANG PANDA and WARP PANDA) drove more than 58% of state-sponsored intrusions against the technology sector, focused on AI capabilities, training data, ML infrastructure and semiconductor IP; and DPRK-nexus FAMOUS CHOLLIMA accounted for 47% of state-sponsored hands-on-keyboard activity through IT-worker infiltration using AI-enhanced personas and front companies across North America, Europe and Asia. The report frames AI/ML development pipelines and model weights as espionage targets warranting the same protection as source code and credentials. CrowdStrike also names a compromise of the axios npm package as part of a DPRK-linked supply-chain operation — a notable claim, but in this run only CrowdStrike asserts it, so treat the axios element as single-source pending independent corroboration.

UPDATE: Windows Netlogon RCE CVE-2026-41089 now confirmed exploited in the wild in the EU; CERT-EU issues advisory 2026-007

UPDATE (originally covered 2026-W23 weekly): CERT-EU published advisory 2026-007 on 10 June 2026 confirming that CVE-2026-41089 — a CVSS 9.8 stack-based buffer overflow (CWE-121) in the Windows Netlogon service — is being actively exploited in the wild, citing Belgium's Centre for Cybersecurity (CCB) (CERT-EU, 2026-06-10). This is the material delta since the weekly's disclosure-only coverage: an EU national authority has now attributed in-the-wild exploitation, roughly 20 days after the May 2026 Patch Tuesday fix.

An unauthenticated remote attacker sends a crafted Netlogon RPC packet to obtain SYSTEM-level code execution on an unpatched domain controller — functionally a full Active Directory forest compromise, in the ZeroLogon lineage of Netlogon-channel attacks (BleepingComputer, 2026-06-01). CERT-EU's advisory carries the per-version patched-build table: Server 2016 before 10.0.14393.9140, Server 2019 before 10.0.17763.8755, Server 2022 before 10.0.20348.5074, Server 2022 23H2 before 10.0.25398.2330, and Server 2025 before 10.0.26100.32772, with Server 2012/2012 R2 also affected.