Looking ahead — 2026-W24

A focused, justified list — items already in motion, not predictions.

• G7 Évian summit, 15–17 June — pre-stage DDoS mitigations now. NCSC-CH's advisory explicitly names Swiss organisations as the hacktivist-DDoS target pool for the summit window (Évian sits on the Swiss border), consistent with the NoName057(16) pattern around past Swiss-adjacent summits. Confirm upstream scrubbing burst capacity, test CDN/anycast failover, and pre-position out-of-band NOC comms before Monday. MITRE ATT&CK T1498/T1499. (NCSC-CH G7 advisory)
• GreatXML and RoguePlanet remain unpatched — watch MSRC for an out-of-band response. Two Chaotic Eclipse disclosures (GreatXML BitLocker bypass, RoguePlanet Defender SYSTEM EoP) have public PoCs and no fix after June Patch Tuesday closed three siblings; the researcher's cadence suggests more. Retain BitLocker PIN/TPM policy and monitor MSRC. (SecurityWeek — GreatXML; BleepingComputer — RoguePlanet; daily 06-12)
• CRA 11 September reporting-platform milestone is now ~90 days out. ENISA's SBOM survey shows generation outpacing consumption; the window to build SBOM-ingestion into your vulnerability-management workflow before the reporting obligation begins is closing. (ENISA SBOM)
• npm v12 will disable install scripts by default — audit CI/CD before July. GitHub's announced breaking change (preinstall/install/postinstall off by default, npm approve-builds required) is the single most effective structural mitigation against the Shai-Hulud/Atomic Arch install-time-execution kill chain, but it will break pipelines that rely on build scripts. Inventory affected pipelines now. (GitHub changelog; daily 06-12)
• Acer Wave-7 mesh-router maximum-severity zero-days (CVE-2026-49200/-49201) still await a fix targeted for end-June. Cleartext-credential logging plus a hardcoded backup key, CVSS 10.0, no patch yet — track the firmware release and treat exposed Wave-7 management as compromised in the interim. (BleepingComputer; daily 06-08)
• EDPB Article 33 harmonised-template consultation closes 5 August. Breach-response process owners with multi-jurisdiction obligations have a window to review and comment. (EDPB)