Looking ahead — 2026-W23

A focused, justified list — not predictions, but items already in motion.

• June 10 — Patch Tuesday: Chaotic Eclipse patches expected; researcher promises a "big surprise" the same day. YellowKey (CVE-2026-45585, BitLocker bypass via WinRE autofstx.exe), GreenPlasma (CTFMON SYSTEM escalation), and MiniPlasma (CVE-2020-17103, cldflt.sys Cloud Filter LPE) remain unpatched as of 7 June. Microsoft is expected to patch some or all in the June cumulative update. The Chaotic Eclipse researcher has explicitly promised a new disclosure to coincide with June Patch Tuesday — prepare for a simultaneous patch-and-new-zero-day drop. Pre-stage: verify YellowKey mitigation applied (WinRE autofstx.exe removal script or TPM+PIN BitLocker enforcement); monitor Microsoft MSRC on 10 June. (Help Net Security forecast; CPO Magazine)

• June 11 — CRA notifying-authority deadline AND FIFA World Cup kickoff. The first hard CRA milestone (§8) and the peak Ghost Stadium PhaaS threat arrive simultaneously. Ghost Stadium — a Chinese-speaking PhaaS operation active across 4,300+ fraudulent FIFA domains — has already claimed an estimated 47,000 victims and up to $1 billion in losses ahead of the kickoff (BankInfoSecurity, 2026-06-05; FBI IC3 PSA260527). The SSO-clone technique replicates PingIdentity login flows — corporate SSO credentials are at risk if employees mistake a sponsored-search-result phishing portal for an enterprise login. Defenders: add FIFA-themed domain alerts to email-gateway and DNS-filtering, block fifa.com typosquats at the proxy, and brief staff on avoiding paid/sponsored results for sports ticket purchases.

• June 15–17 — G7 Évian summit: pre-stage DDoS mitigations now. NCSC-CH expects hacktivist disruptive cyberspace operations on each summit day, following the NoName057(16) pattern from Bürgenstock 2024 (NCSC-CH). Organisations in the Geneva–Vaud corridor and Swiss federal/cantonal SOCs should verify DDoS mitigation playbooks, review MFA on customer-facing identity providers, and rotate administrative credentials before the event window.

• Gogs argument-injection RCE: still unpatched, Metasploit module public, 319 European instances exposed. The Rapid7-discovered pull-request-merge argument injection flaw remains unpatched; the Gogs maintainer has been silent since acknowledging receipt on 28 March. The Metasploit module availability means this will appear in opportunistic scan-and-exploit campaigns. Any internet-facing Gogs instance should have open registration disabled and the "Rebase before merging" strategy restricted to trusted owners. (Rapid7)

• Keycloak 26.6.3 rollout: CVE-2026-9704 token-exchange priv-esc and CVE-2026-4874 SSRF are immediate patch priorities for internet-reachable instances. Any e-government SSO, SAML federation, or OIDC brokering service running Keycloak < 26.6.3 should complete the upgrade before the G7 event window. (Keycloak; daily 2026-06-07)