Kaspersky: the HelloNet campaign blinds user-mode security tools by hooking raw AFD IOCTLs, persisting via DLL-sideload into a secure-network product's own auto-updater

Kaspersky's GReAT team detailed "HelloNet," an APT campaign (active since at least May 2026) that abuses the update mechanism of ViPNet — a Russian GOST-certified secure-networking suite — to persist inside targeted Russian government, energy, transport, education, logistics and industrial organizations (Kaspersky Securelist, 2026-07-16). The attackers drop a malicious wtsapi32.dll into the ViPNet update directory that the OS-start-launched updater itcsrvup64.exe sideloads. That loader ("HelloInjector") injects a second stage ("HelloProxy") into svchost.exe — but only after verifying the target's name is svchost.exe and its command line carries netsvcs. HelloProxy's distinguishing move is defense evasion at the socket layer: it uses the Microsoft Detours library to hook NtDeviceIoControlFile, closesocket and shutdown, intercepting the raw AFD IOCTL codes AFD_RECV (0x12017) and AFD_GET_TDI_HANDLES (0x12037) so that, in Kaspersky's words, it can "hinder security solutions operating in user mode for filtering network connections." It then acts as a traffic proxy or in-memory loader for further modules — recovered examples include "HelloExecutor" (shell-command execution) and "HelloCleaner" (deletes ViPNet log files to hide activity) — and on one host the operators opened an SSH reverse tunnel using a legitimate Plink binary renamed frontpage.exe.

Microsoft maps three ShinyHunters-tradecraft OAuth-abuse paths against Salesforce customers — none exploiting a Salesforce vulnerability

Microsoft Threat Intelligence documented a year-long (mid-2025 to mid-2026) set of campaigns using tradecraft commonly associated with ShinyHunters (registry alias UNC6240) against Salesforce-integrated environments, through three distinct paths rather than any Salesforce product vulnerability (Microsoft Threat Intelligence, 2026-07-13). First, vishing-driven OAuth-consent abuse: attackers impersonating IT support socially engineer employees through the OAuth authorization workflow into granting a malicious connected app — disguised as the legitimate Salesforce Data Loader — full API access inherited from the victim's own privileges, letting them enumerate and exfiltrate CRM data through sanctioned application access that never trips a sign-in anomaly. Second, SaaS supply-chain compromise: compromised Salesloft Drift credentials (August 2025) exposed OAuth connection secrets reused across customer tenants; a November 2025 campaign abused Gainsight-published Salesforce apps the same way; and in June 2026 an actor Microsoft tracks as Storm-3138 compromised the Klue competitive-intelligence platform and reused harvested Salesforce credentials to query and exfiltrate customer CRM data. Third, guest-access abuse: requests chained against Salesforce's Aura framework via misconfigured guest-user accounts pulled far more data than a guest session should reach (The Hacker News, 2026-07-14). Microsoft observed the activity across retail, education and manufacturing tenants and states existing authentication-focused detections gave "limited visibility" because the traffic is indistinguishable from legitimate integration.

DragonForce lists Geneva's IFAGE adult-education foundation on its leak site, claiming 850 GB — an attribution and volume IFAGE has not confirmed

The German-title source reads "the DragonForce group claims to have captured 850 gigabytes of data from IFAGE; the foundation had already warned of a leak of sensitive data." IFAGE (Fondation pour la formation des adultes à Genève), a Geneva adult-education foundation, disclosed in May 2026 that it suffered an intrusion on 11–12 April 2026 (detected 13 April): unauthorized exfiltration of current- and former-employee data, no ransom demand recorded at the time, reported to the Federal Data Protection and Transparency Commissioner, and described by IFAGE as resolved (La Télé, 2026-05-15). On 14 July 2026, Swiss IT outlet Inside IT reported that the extortion group DragonForce has now listed IFAGE on its leak site, claiming 850 GB — an order of magnitude beyond the scope IFAGE described, and a specific actor attribution IFAGE itself never made (Inside IT, 2026-07-14). No IFAGE statement responding to the listing, and no second independent outlet corroborating the DragonForce name or the 850 GB figure, could be located as of this run.

Open WebUI's six broken-access-control CVEs are one recurring authorization-architecture defect, not six isolated bugs

CSA Labs' research note ties six broken-access-control CVEs disclosed in the self-hosted Open WebUI LLM front-end between November 2025 and June 2026 to a single architectural cause: authorization implemented ad hoc, endpoint by endpoint, rather than enforced through one policy layer that asks a consistent question — not "is this a valid session" but "is this specific user permitted to perform this specific action on this specific resource" (CSA Labs, 2026-07-10). The most severe, CVE-2025-64496, exploits the Direct Connections feature: the client trusted server-sent events of type "execute" and evaluated them with JavaScript's new Function(), treating output from an attacker-controlled model server as code in the victim's authenticated browser session — enough to steal the auth token from browser local storage, and, for a session holding the workspace.tools permission, to escalate via the backend's unsandboxed Python exec() to full RCE on the host (fixed 0.6.35; NVD later scored it 8.0 versus the advisory's 7.3). Four more affect the 0.9.x line: CVE-2026-44556 (7.1) reaches any configured model through the /api/openai/responses proxy that checks only session validity, not per-model grants (CWE-862); CVE-2026-44557 (4.3) exposes system-wide knowledge-base metadata via an incomplete allowlist; CVE-2026-44564 (5.4) lets a read-only Socket.IO room member emit ydoc:document:update events because the handler checks room membership, not write permission; and CVE-2026-54015 (6.4) is a prompt-history IDOR validating the URL prompt-ID but not the caller-supplied history-ID (CWE-639). CVE-2025-63681 (2.1, task-cancellation IDOR) "remains unpatched as of this writing" (CSA Labs, 2026-07-10); two of the advisories were confirmed against the GitHub Security Advisory Database this run (GitHub Security Advisories; GitHub Security Advisories).

Because Open WebUI is self-hosted rather than a managed service, the compensating-control burden falls on the operator, not a vendor — and self-hosting is exactly the deployment public-sector and research teams choose to keep prompts, documents and credentials off third-party SaaS, which is why the cluster matters to this constituency.

CVE-2026-20896 — NCSC-CH escalates the Gitea Docker reverse-proxy auth bypass to 'actively exploited'

UPDATE · originally covered CVE-2026-20896 — Gitea (Docker): trust-all reverse-proxy default lets an unauthenticated attacker impersonate any user via X-WEBAUTH-USER (2026-06-23)

Switzerland's NCSC added CVE-2026-20896 to its Cyber Security Hub on 2026-07-10 (08:55 UTC) and set its current exploitation status to "Actively Exploited, Proof of Concept Available", reiterating that "[s]uccessful exploitation allows unauthenticated attackers to gain full administrative control of Gitea instances via a single custom HTTP header" (NCSC-CH, 2026-07-10). This is the first national-CERT escalation of the flaw's status since the June disclosure of the Docker image's trust-all REVERSE_PROXY_TRUSTED_PROXIES default (mechanics and patch unchanged from the original entry).

The escalation warrants a caveat rather than a panic. The only public exploitation reporting traces to Sysdig telemetry surfaced on 2026-07-06, and the two outlets that carried it diverge. The Hacker News quotes Sysdig's Michael Clark saying the single probe from a ProtonVPN-associated IP had "not so far progressed to any exploitation or attack progress" and characterises the activity as initial investigation by the threat actor rather than compromise (The Hacker News, 2026-07-06). SecurityWeek's coverage of the same Sysdig telemetry frames it as active exploitation and omits that caveat (SecurityWeek, 2026-07-07) — so the "actively exploited" characterisation is itself contested across the very reporting NCSC-CH cites. NCSC-CH's advisory does not resolve the gap with its own data, so the defensible read is "scanning confirmed, compromise unconfirmed" — which changes nothing about the remediation priority: a public PoC exists for a pre-auth admin-takeover on software Sysdig counts at roughly 6,200 internet-facing instances, and self-hosted Gitea is common across DACH/EU public-sector and academic DevOps.

UNK_MassTraction: suspected China-aligned actor exploits Roundcube as an edge device, chaining CVE-2024-42009 XSS into CVE-2025-49113 deserialization

Proofpoint Threat Research documented UNK_MassTraction, a suspected China-aligned espionage cluster that since May 2026 has targeted physics and engineering departments at US and Canadian universities by exploiting Roundcube webmail as an edge device rather than phishing end users for credentials (Proofpoint, 2026-07-07). The initial vector is CVE-2024-42009, a Roundcube XSS that executes attacker JavaScript via the onanimationstart handler the moment a crafted email is opened in a vulnerable client — no attachment or link click required (T1566 delivery, T1203 client-side execution). That JavaScript loads IceCube, a Roundcube stealer that escapes the mail client's iframe by DOM traversal to reach the full DOM and the authenticated session, harvesting usernames, passwords, 2FA material and cookies; Proofpoint notes IceCube's verbose, well-commented code was likely produced with LLM assistance (Proofpoint, 2026-07-07).

IceCube then uses "helper" modules and the session's CSRF token to trigger CVE-2025-49113, a PHP object-deserialization flaw in Roundcube's handling of the embedded Crypt_GPG_Engine: a serialized gadget whose __destruct() passes _gpgconf into a shell-execution path lets the actor plant the SquareShell webshell into a plugin directory — timestomped to match a legitimate plugin — for remote code execution (T1190 server-side exploitation, T1505.003 web shell) (Proofpoint, 2026-07-07). A fallback channel introduced in June 2026 downloads an architecture-specific ELF loader that reflectively loads the publicly available VShell Go backdoor into memory (T1620), spoofing a kernel-worker process name; VShell's interactive shell and port-forwarding are the likely pivot into the target network. IceCube also installs "deferred triggers" that re-attempt exploitation if the user changes tabs or clicks logout, then destroys Roundcube sessions to force logout and remove forensic evidence. Attribution to a China-aligned actor rests on covert-VPS infrastructure reuse across China-aligned actors, Chinese-language build artifacts, and VShell tradecraft precedent (cited as tooling overlap, not the same actor) (Proofpoint, 2026-07-07).

ShinyHunters / UNC6240 Oracle campaign — status update: Nissan is the largest named victim, notifications keep landing, and a separate Medtronic claim surfaces

UPDATE · originally covered ShinyHunters / UNC6240 Oracle PeopleSoft campaign (2026-06-29)

the ShinyHunters/UNC6240 Oracle PeopleSoft campaign (CVE-2026-35273, unauthenticated RCE in PeopleTools Environment Management) kept acquiring named victims this week — the delta since the prior weekly's status.

Nissan is the largest named victim yet. SecurityWeek reported Nissan disclosed a breach tied to the Oracle PeopleSoft attacks, exposing current and former employee HR/payroll PII across four countries — a different exposure profile than the NAIC breach the W26 weekly led with (SecurityWeek, 2026-06-30; § references). It confirms the "still acquiring victims" throughline the W26 looking-ahead flagged, and that named victims now span beyond the education sector GTIG originally emphasised.

A separate Medtronic claim — attribution precision matters. Medtronic is notifying ~9 million people of a ShinyHunters-claimed breach of corporate IT systems from April 2026 (names, DOB, SSNs, health data), with medical devices reported unaffected (BleepingComputer, 2026-07-02; § references). This is a distinct incident from the PeopleSoft campaign — a corporate-IT breach the brand claimed, not tied to the Oracle zero-day path — and the weekly notes it to keep the ShinyHunters cluster's several concurrent operations from being conflated: the PeopleSoft ERP zero-day campaign is one line of effort; opportunistic corporate-IT data extortion under the same brand is another.

Status: GTIG's ~100-organisation notification set (68% higher education) is still landing, so more European education and public-finance victims are likely in the un-notified tail (Google GTIG). The separate, unattributed Oracle E-Business Suite RCE now exploited in the wild (this week's Oracle top story) compounds the message: internet-facing Oracle application tiers are a priority patch-and-isolate class regardless of which actor is behind any single CVE.

Builds on: 2026-07-01/nissan-is-the-largest-named-victim-yet-in-the-shinyhunters-o · 2026-07-03/medtronic-notifies-9-million-people-of-a-shinyhunters-claime

Two internet-facing Oracle enterprise product lines were under active exploitation this week — E-Business Suite RCE joins the PeopleSoft campaign

If you did nothing this week: any internet-reachable Oracle enterprise application tier is a live pre-auth target. Two distinct Oracle product lines were being exploited in the same window, so the defender decision is not "patch this CVE" but "get every Oracle application front end off the public internet and onto the exploited-flaw patch clock."

The new fact this week is CVE-2026-46817 (CVSS 9.8), an unauthenticated RCE in the File Transmission component of Oracle Payments within Oracle E-Business Suite (EBS 12.2.3–12.2.15), fixed in the May 2026 Critical Patch Update. Threat-intel firm Defused reported the first confirmed in-the-wild exploitation against its EBS honeypots over the weekend of 27–28 June — roughly six weeks after the patch and with "no known previous exploitation and no public POC code" until that point (BleepingComputer, 2026-06-29; SecurityAffairs, 2026-06-30). That "patched-but-now-exploited, no-PoC" pattern is exactly what turns unpatched internet-facing estates into targets fastest. Shadowserver tracks 450+ internet-exposed EBS instances, ~200 in the US and Europe, and EBS Payments/financial modules sit in government, higher-education and large-enterprise finance back offices — high-value data behind an internet-reachable app tier (BleepingComputer, 2026-06-29).

This lands alongside — but is distinct from — the ShinyHunters/UNC6240 Oracle PeopleSoft zero-day campaign (CVE-2026-35273) that GTIG/Mandiant attributes and that added Nissan as its largest named victim this week (Google GTIG; campaign arc consolidated separately in this week's long-running status entry). No public reporting ties the EBS exploitation to ShinyHunters — the EBS activity is unattributed — so the weekly signal is not a single actor but a product-family exposure: two Oracle enterprise application lines under active exploitation at once. Detail on each: EBS deep dive and the Nissan disclosure (§ references).

Builds on: 2026-07-01/oracle-e-business-suite-cve-2026-46817-pre-auth-rce-in-the-p · 2026-07-01/nissan-is-the-largest-named-victim-yet-in-the-shinyhunters-o

CVE-2026-57517 — Control Web Panel: pre-auth blind SQL injection to web-shell RCE (CVSS 9.8)

CCB Belgium published a fresh advisory for CVE-2026-57517, a pre-authentication blind SQL injection in Control Web Panel — the widely deployed Linux hosting/server-management platform formerly known as CentOS Web Panel (CCB, 2026-07-03). The vulnerable input is the userRes POST parameter in the CWP user module; insufficient sanitisation lets an unauthenticated attacker inject SQL that runs with the backend database's privileges (CWE-89, CVSS 3.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; CVSS 4.0 9.3). The disclosed chain uses INTO DUMPFILE to blind-write an attacker-controlled PHP web shell into a web-accessible directory without needing query output or credentials; the shell then executes commands as the cwpsvc service account, yielding full server compromise. CCB states there is no evidence of in-the-wild exploitation yet but flags the pre-auth, no-interaction nature and CWP's large internet-facing footprint as a high-priority risk. The vendor changelog shows 0.9.8.1225 shipped 2026-05-06 — roughly two months before the public CVE disclosure on 2026-07-01 — so instances left unpatched since the silent fix remain exposed today (Control Web Panel changelog, 2026-05-06). Mapped to T1190 Exploit Public-Facing Application for the SQLi vector and T1505.003 Server Software Component: Web Shell for the DUMPFILE-written shell.

Oracle E-Business Suite CVE-2026-46817: pre-auth RCE in the Payments File Transmission servlet, first in-the-wild exploitation

What it is. CVE-2026-46817 (CVSS 9.8) is an unauthenticated remote-code-execution flaw in the File Transmission component of Oracle Payments, part of Oracle E-Business Suite, affecting EBS 12.2.3 through 12.2.15. The reporting characterises it as allowing "remote, unauthenticated attackers to take over Oracle Payments" with only HTTP network access and a low-complexity attack. Oracle fixed it in the May 2026 Critical Patch Update (SecurityAffairs, 2026-06-30).

Exploitation status. Threat-intel firm Defused reported the first confirmed in-the-wild exploitation against its Oracle EBS honeypots, with the first attempts observed over the weekend of 27–28 June 2026 — roughly six weeks after the patch, and the flaw had "no known previous exploitation and no public POC code" until that point (BleepingComputer, 2026-06-29). Defused did not publicly disclose the technical mechanics of the observed attacks or the attackers' motivation, and no named threat cluster has been attributed. The operationally important signals are therefore the timeline and exposure, not a public exploit: a critical pre-auth flaw in a widely-deployed ERP moved from "patched, no known exploitation" to "exploited in the wild" without a public PoC, which is the pattern that turns unpatched internet-facing estates into targets fastest. Oracle's statement notes it "continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches."

Exposure surface. Shadowserver tracks over 450 internet-exposed Oracle EBS instances, with nearly 200 across the United States and Europe (BleepingComputer, 2026-06-29). Patch-adoption six weeks after the May CPU is unknown, so a meaningful exposed-and-unpatched population is plausible. EBS Payments/financial modules are common in government, higher-education and large-enterprise finance back offices — high-value data behind an internet-reachable application tier.

Why this product line draws attacker interest. Oracle back-office suites have become a recurring extortion target: this flaw lands while the separate, still-active ShinyHunters Oracle PeopleSoft campaign (§ 4, CVE-2026-35273) continues to acquire named victims. Two distinct Oracle enterprise product lines under active exploitation in the same window is the signal for defenders to treat all internet-facing Oracle application tiers as priority patch-and-isolate targets, not just the specific CVE.

ATT&CK, hunt and hardening. The observable stage is unauthenticated exploitation of an internet-facing application (T1190 Exploit Public-Facing Application). Because the exploit mechanics are not public, prioritise patch verification and exposure reduction over signature-based hunting: confirm the May 2026 Critical Patch Update is applied to every EBS 12.2.x instance; remove EBS / Oracle Payments web interfaces from public internet reachability, fronting them with authenticated VPN or restricting to internal networks; and review the Oracle Payments web tier's access logs for anomalous unauthenticated HTTP requests, treating any exposed, unpatched instance as potentially already-probed given the pre-PoC exploitation timing.

CVE-2026-46817 — Oracle E-Business Suite (Oracle Payments): pre-auth RCE now exploited in the wild

Critical (CVSS 9.8) unauthenticated RCE in the File Transmission component of Oracle Payments within Oracle E-Business Suite 12.2.3–12.2.15, allowing a remote attacker with HTTP network access to take over Oracle Payments via a low-complexity attack; patched in the May 2026 Critical Patch Update. Threat-intel firm Defused reported the first confirmed in-the-wild exploitation against its Oracle EBS honeypots, with the first attempts observed over the weekend of 27–28 June — roughly six weeks post-patch, and with the vulnerability having "no known previous exploitation and no public POC code" until then (BleepingComputer, 2026-06-29 · SecurityAffairs, 2026-06-30). Defused did not publicly disclose the technical mechanics; exploitation is so far confirmed only against honeypots and is not attributed to a named cluster. Exposure and defender guidance in § 5.

Gogs CVE-2026-52806 moves from "no observed exploitation" to active cryptojacking campaign

UPDATE · originally covered CVE-2026-52806 — Gogs self-hosted Git server: argument injection to OS command execution (BSI critical batch) (2026-06-20)

When this brief first covered the Gogs argument-injection RCE CVE-2026-52806 (branch name injects --exec into git rebase; fixed in 0.14.3 on 2026-06-07), exploitation status was not observed. Wiz Threat Research now reports the flaw under active in-the-wild exploitation: a cryptojacking campaign active 2026-06-13–23 chained Gogs and Argo Workflows vulnerabilities for initial access, compromised thousands of Linux hosts, and pivoted across more than 300 additional Kubernetes nodes (Wiz Threat Research, 2026-06-28). The new development is the exploitation, not the bug — the CVE mechanics and patch were covered on 2026-06-20.

Per Wiz, once on a node the operators stole Kubernetes service-account tokens and used them to schedule workloads cluster-wide, then escaped to host via privileged containers to deploy cryptominers; Wiz designates the actor "Unknown" and names the C2 framework "Realm C2." The Gogs argument-injection vector is the same one documented by Rapid7 — an authenticated (effectively unauthenticated on default open-registration instances) RCE via a malicious pull-request branch name during a "rebase before merging" operation (Rapid7 Labs). ATT&CK chain as reported: T1190 (exploit public-facing Argo Workflows / Gogs) → T1078.004 (stolen K8s service-account tokens) → T1610 (deploy container) → T1611 (escape to host) → T1496 (resource hijacking).

Defender delta since 2026-06-20: the patch urgency is now exploitation-driven, not advisory-driven. If self-hosted Gogs is still below 0.14.3, prioritise the upgrade and disable open self-registration (DISABLE_REGISTRATION = true). Hunt K8s API-server audit logs for create on workflows.argoproj.io and on pods from unexpected service accounts, git rebase child processes spawned by the Gogs service user, and privileged-container/nsenter activity. Enforce Pod Security Admission (restricted) and audit RBAC to remove default service accounts with node-escalation rights. Scope/attribution figures (thousands of hosts, 300+ nodes, "Realm C2") are Wiz's single-source assessment

ShinyHunters / UNC6240 Oracle PeopleSoft campaign

The campaign behind the § 1 NAIC breach. GTIG/Mandiant attributes to UNC6240 an active zero-day exploitation of Oracle PeopleSoft (CVE-2026-35273) between May 27 and June 9, predating Oracle's advisory; staging environments deployed customised MeshCentral agents masquerading as cloud endpoints, then ran a per-victim [victim]_fanout.sh lateral-movement-and-defacement script (Google GTIG). ~300 PeopleSoft instances compromised, ~100 organisations notified, 68% higher education, with the University of Nottingham among the first named public victims (SecurityWeek). The status this week: NAIC confirmed (§ 1), and notifications are still landing, so more European education and public-finance victims are likely. The weekly lens: this is ShinyHunters operating as a zero-day-capable ERP attacker — a capability shift from the brand's 2021–2024 credential-stuffing persona. Outstanding question: which EU universities running PeopleSoft are in the un-notified tail.

Mass third-party exposures: Xsolis, Texas Parks & Wildlife, Canvas

Three large data exposures all traced to a third party rather than the named organisation: Xsolis (1.4M patients via a healthcare-AI processor), Texas Parks & Wildlife (3.08M licence holders via an unnamed licence-sales vendor, with a public-vs-AG-filing SSN contradiction noted in § 11), and the Canvas/Instructure LMS breach (160 UK universities). The recurring control gap is vendor data-minimisation and breach-notification SLAs.

Education

Education was a structural victim class. The ShinyHunters Canvas/Instructure breach hit 160 UK universities per the UK CMC sector review (ransom paid, limited downstream damage). The unpatched ILIAS 11.0 SQL-injection (CVE-2026-12789, PoC-public, no patch) directly exposes the DACH learning-management estate, and self-hosted Gitea CI (§ 3) is concentrated in universities. The common thread: education runs exposed CMS/LMS/forum and developer stacks with thin operational security.

CVE-2026-11800 (JWT algorithm-confusion) and CVE-2026-9800 (policy-enforcer authz bypass) — Keycloak identity-plane fixes

Keycloak 26.6.4 fixed eight CVEs. The headline flaw is CVE-2026-11800, a JWT algorithm-confusion that lets an attacker with valid client credentials forge an assertion, bypass signature verification and impersonate any federated user behind the affected identity provider (GHSA-gqj5-2xp5-3qmp, BSI WID-SEC-2026-2093); the bundled CVE-2026-9800 is a separate policy-enforcer authorization bypass via incorrect URI comparison. Keycloak is the IdP of choice across European public-sector, healthcare and finance deployments — these are identity-plane breaks, not app bugs. Patch to 26.6.4.

CVE-2026-58053 — Gitea act_runner Docker backend: container-hardening bypass to host escape (public PoC, ENISA-critical)

Gitea act_runner through 0.262.0 passes a workflow-defined container.options string straight into Docker's HostConfig, forcing only Privileged=false while merging --pid=host, --cap-add and --security-opt unchanged — a malicious workflow escapes the job container to the host (VulnCheck). Public PoC, CVSS 9.4, mitigation-only this week. Self-hosted Gitea CI is common in DACH developer shops and universities; restrict who can define workflow container options. The companion Gitea-core auth bypass via X-WEBAUTH-USER (CVE-2026-20896, fixed in 1.26.3/1.26.4) remains worth patching on the same estate.

CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 — Ubiquiti UniFi OS Server: pre-auth RCE chain, exploited (CISA KEV)

Three max-severity (CVSS 10.0) flaws in UniFi OS Server — improper access control and path traversal that bypass authentication and reach an unauthenticated RCE endpoint — were patched and KEV-listed with confirmed exploitation. UniFi controllers are common in DACH SME, education and public-sector branch networks; the management plane is frequently exposed. Patch and audit controller-account integrity.

ShinyHunters (UNC6240) — one cluster, multiple reported tradecraft paths in one week

The week is a compact case study in how a single extortion cluster's reported activity spans very different initial-access tradecraft. The two firmly UNC6240-attributed events are the Oracle PeopleSoft zero-day behind the NAIC breach (GTIG/Mandiant attribution, § 1) and the April 2026 Instructure Canvas LMS breach, whose UK Cyber Monitoring Centre sector review landed 06-27 (160 UK universities, extortion, ransom paid). Alongside them, 404 Media's reconstruction (06-26) showed the Madison Square Garden intrusion began with a single vishing call into the company's identity platform — the operator phoned a low-level employee and talked them through authorising access; the 404 Media account documents the technique but names no actor, and the ShinyHunters link rests on the operators' own claims and the SSO-vishing TTP overlap Abnormal Security attributes to the cluster.

The cross-day pattern matters more than any single victim: a server-side zero-day, a SaaS-platform compromise and SSO-targeting vishing all appear under (or adjacent to) one extortion banner in one week, so defending against this cluster is not a single control. It is externally-reachable enterprise-app patching/hunting, third-party SaaS exposure management, and help-desk/identity-platform vishing resistance (callback verification, no MFA-reset-on-call) — all at once. (daily 06-26, daily 06-27, daily 06-28)

Keycloak JWT algorithm confusion (CVE-2026-11800): forging federated identity in the EU public sector's dominant IdP

Background. JWT algorithm confusion is a long-known token-forgery class — public research dating to the mid-2010s showed that if a verifier trusts the attacker-controlled alg header field, an attacker can substitute the signing algorithm (classically RS256→HS256, treating the public RSA key as an HMAC secret, or downgrading to alg: none) to forge a validly-"signed" token. The defensive consensus has been settled for years: pin the accepted algorithm server-side and never let the token dictate it. CVE-2026-11800 is notable not because the class is new but because it lands in Keycloak, the dominant open-source identity-and-access platform across European public administration (and the upstream of Red Hat Build of Keycloak / Red Hat SSO), where a token-layer bypass collapses the entire federated-identity trust boundary.

What the flaw is. Keycloak 26.6.4 (released 2026-06-26) patches eight CVEs; the headline issue is CVE-2026-11800 (CVSS 8.1, CWE-347 Improper Verification of Cryptographic Signature): an attacker holding any valid client credential in a realm can forge an assertion in the JWT Authorization Grant flow by manipulating the algorithm field, bypassing signature verification to mint unauthorised access tokens and impersonate any federated user linked to the affected identity provider — including administrators (Keycloak Project, 2026-06-26; GitHub Advisory GHSA-gqj5-2xp5-3qmp, 2026-06-25; BSI WID-SEC-2026-2093, 2026-06-26). The prerequisite — a single low-privilege registered OAuth client — is a low bar in a multi-tenant realm with many onboarded applications.

Why the release matters beyond the headline. The same 26.6.4 release fixes CVE-2026-9800 (CVSS 8.1, CWE-1025 policy-enforcer authorization bypass: an authenticated attacker who places the configured access-denied-page path into a request URL as a path segment or query parameter bypasses role/scope/UMA permission checks) and a privilege-escalation path from group-admin to realm-admin (CVE-2026-9099), plus information-disclosure, XSS, disabled-client-re-enablement and scope-mapping-bypass issues. CVE-2026-11800 maps to T1550.001 (Application Access Token abuse) and, where MFA is policy-enforced at the IdP, T1556.006 (the token issuer is bypassed, so MFA is moot); CVE-2026-9800 maps to T1078.004 valid-account abuse with elevated privilege.

Affected / fixed. Upgrade to Keycloak 26.6.4 per the project release notes; Red Hat Build of Keycloak users apply the matching advisories (Red Hat issued RHSA errata for RHBK alongside the upstream release). Treat any internet-reachable Keycloak admin or token endpoint as priority.

Hunt and detection concepts (no IOCs). In Keycloak's own event log, alert on token issuances where the JWT alg does not match the realm's configured signature algorithm (e.g. HS256 appearing on a realm configured for RS256/ES256), and on CODE_TO_TOKEN/CLIENT_AUTH events that resolve to a user the requesting client should not be able to assert. For the policy-enforcer bypass, review access-enforcer logs for requests containing the access-denied-page path as a query parameter or trailing path segment. Correlate admin REST calls (POST /admin/realms/{realm}/clients, role-mapping changes) against accounts that were previously only group-admins (the CVE-2026-9099 vector). Pipe these into the SIEM as identity-tier detections, not just app logs.

Hardening / mitigation. Beyond patching: enforce an explicit algorithm allowlist in realm OIDC settings so the alg field cannot be downgraded (none/HS256 must be rejected where asymmetric signing is expected); review group-to-role mappings for any realm-admin delegation; tighten Registration Access Token expiry; and keep the admin console off the public internet. The structural lesson for any IdP — Keycloak or not — is that the token verifier must own the algorithm decision; the token must never be allowed to choose how it is verified.

CVE-2026-58053 — Gitea act_runner Docker backend: container-hardening bypass to host escape (CVSS 9.4, public PoC)

Gitea act_runner through 0.262.0 with the Docker backend passes the workflow-defined container.options string straight into Docker's HostConfig for the job container. When an operator hardens the runner with privileged: false, the code forces only the Privileged flag off but still merges the rest of container.options unchanged — so options such as --pid=host, --cap-add=SYS_PTRACE, --security-opt=seccomp:unconfined or arbitrary bind mounts pass through, allowing any user with write access to a repository whose workflows run on that runner to escape to the host as root despite the hardening (VulnCheck, 2026-06-27; ENISA EUVD EUVD-2026-58053, 2026-06-28). ENISA EUVD scores it CVSS 4.0 9.4 and a public PoC is referenced. Technique class: T1611 Escape to Host via Docker HostConfig injection → T1068. Prerequisite is write access (or accepted external contribution) to a repo whose workflows execute on a Docker-backed runner configured privileged: false — the common hardened setting, which is what makes this dangerous. Self-service CI on internal Gitea + Docker is common in Swiss/EU public-sector and academic IT. Detection: watch Docker daemon audit logs for containers launched with unusual HostConfig flags (pid_mode=host, non-baseline cap_add, custom seccomp); review CI workflow-YAML diffs from external contributors for container.options injection. Mitigation now (vendor fix act_runner >= 0.263.0 was pending at advisory time): strip or allowlist container.options at the runner policy layer, require approval for fork/external-contributor workflow runs, and use a kernel-isolation runtime (e.g. gVisor) for untrusted CI.

UK Cyber Monitoring Centre publishes sector review of the Canvas/Instructure LMS breach — 160 universities, ShinyHunters extortion, ransom paid

The UK Cyber Monitoring Centre (CMC) published a post-incident sector review on 2026-06-25 of the April 2026 ShinyHunters (UNC6240) breach of Instructure's Canvas learning-management platform, which affected roughly 160 UK higher-education institutions (Computer Weekly, 2026-06-25). Attackers exfiltrated usernames, email addresses, course/enrolment data and student IDs, then pursued extortion by publishing victim lists, disrupting LMS access and defacing virtual learning environments; Instructure reportedly paid an undisclosed sum to have the stolen data destroyed (Computer Weekly, 2026-06-25), though Instructure's own incident statement describes only reaching an agreement and receiving deletion logs, without confirming a monetary payment (Instructure incident update). The CMC found no evidence of lateral movement into institutional networks but flagged residual phishing risk from the exfiltrated student/staff identity data. Its hardening recommendations are directly transferable: separate application and data layers to support clean recovery; inventory and contractually govern dependencies on offshore SaaS providers not subject to local law; and rehearse breach/business-continuity scenarios in tabletop exercises.

"Mistic" backdoor: signed-Defender DLL sideloading and in-memory tradecraft by access broker Woodgnat/KongTuke

Symantec disclosed Backdoor.Mistic (also tracked as MLTBackdoor), deployed since April 2026 by initial-access broker Woodgnat (a.k.a. KongTuke) that sells footholds to ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base and Black Basta (Symantec, 2026-06-24 · SecurityWeek, 2026-06-24). Mistic achieves DLL sideloading via a digitally-signed Microsoft Defender executable (MpExtMs.exe) loading a malicious EndpointDlp.dll (T1574.002, T1036.005), so its activity reads as legitimate Defender behaviour to EDR. Per Symantec it also supports in-memory tradecraft and file manipulation/arbitrary code execution with a kill switch for stealth. Delivery uses ClickFix / FileFix / CrashFix lures (fake CAPTCHAs, browser-crash pages, Teams IT-helpdesk impersonation directing victims to run PowerShell). Why it matters to us: The downstream affiliates are all active public-sector ransomware actors. Detection is precise: legitimate Defender DLPs load from %ProgramFiles%\Windows Defender\ under a Microsoft certificate — any EndpointDlp.dll loaded from a user-writable path or with a non-Microsoft signature is high-confidence (Sysmon EID 7). Pair with EID 1 parent-chains for PowerShell spawned by Teams/Office clients.

Ubiquiti UniFi OS triple-flaw chain to unauthenticated root (CVE-2026-34908 / -34909 / -34910)

On 2026-06-23 CISA added three Ubiquiti UniFi OS vulnerabilities to its Known Exploited Vulnerabilities catalog — confirmation that they are being exploited in the wild — having entered them as the "Improper Access Control," "Path Traversal" and "Improper Input Validation" vulnerabilities respectively. All three are rated maximum severity by BleepingComputer's reporting (CVSS 10.0 on the CVE records for the access-control and path-traversal flaws), and chained they take an unauthenticated, network-adjacent attacker to OS command execution as root on the management plane of Ubiquiti's UniFi OS appliance family (BleepingComputer, 2026-05-22; SC Media, 2026-06-08). UniFi OS is the management substrate for UniFi Dream Machine gateways/firewalls, UniFi consoles, Network Video Recorders (UNVR), Express, EFG and the software UniFi OS Server — a footprint that is dense across DACH/EU schools, clinics, SMEs and local-government networks, frequently with the console reachable for remote administration.

The chain. The three flaws compose into a single pre-authentication path:

• CVE-2026-34908 — improper access control (CWE-284). Bypasses authentication on a management endpoint, granting an unauthenticated request access it should not have. On its own it yields no code execution, but it changes the trust boundary the later steps depend on.
• CVE-2026-34909 — path traversal (CWE-22). Reads files on the underlying system that should not be reachable through the endpoint — the practical role being to surface material the final step consumes.
• CVE-2026-34910 — improper input validation → command injection (CWE-20). The endpoint passes attacker-controlled input into an OS command without sanitisation, achieving command execution as root. This is the flaw CISA names in the KEV entry as actively exploited.

SC Media's analysis states the access-control and path-traversal flaws "can bypass authentication, allowing access to a vulnerable endpoint," after which the input-validation flaw yields unauthenticated RCE with root privileges (SC Media, 2026-06-08). Because CVE-2026-34908 is what re-shapes the trust boundary, a partial update that addresses only the command-injection flaw is not sufficient — the full fixed UniFi OS version must be applied. Maps to T1190 Exploit Public-Facing Application for initial access and T1068 Exploitation for Privilege Escalation for the root outcome.

Affected and patched versions. UniFi OS Server is affected through 5.0.6 and fixed in 5.0.8 (SC Media, 2026-06-08); the appliance line (UDM / UDR / Express / UNVR / EFG consoles) is fixed in the corresponding UniFi OS 5.1.x release (BleepingComputer, 2026-05-22 reports the patched set but not per-model build strings). Confirm the exact fixed build for each model against Ubiquiti's advisory rather than assuming a single release line is clean, and verify that auto-update actually applied the fixed build.

Hunt and detection concepts (no IOCs). These are Linux-based network appliances that rarely carry EDR, so detection leans on the network and the device's own logs: the highest-value signal is the UniFi OS management process spawning unexpected shell children or executing curl/wget (anomalous process lineage from the web daemon); outbound connections originating from the appliance to infrastructure that is not Ubiquiti's update/cloud endpoints; and inbound scanning or anomalous request patterns against the management endpoints from outside the management network. Treat any UniFi console that has been internet-reachable and unpatched since the 2026-06-23 KEV date as potentially compromised, not merely vulnerable, and inspect for unauthorised configuration or account changes.

Hardening / mitigation. Apply the full fixed UniFi OS version per model; remove the management interface from internet exposure entirely (administer over LAN/VPN only) and place UniFi consoles on a segmented management VLAN with tight ingress; and, post-patch, rotate any credentials that the device handled and audit local accounts and configuration for tampering during the exposure window. The KEV remediation due date (2026-06-26) is a US-FCEB compliance date with no jurisdictional weight in CH/EU; the operational driver here is the confirmed in-the-wild exploitation of a pre-auth-to-root chain on widely-deployed, often-internet-reachable gear — not the deadline.

SonicWall CVE-2024-40766: why patched firewalls keep falling to Akira and Fog

Background. CVE-2024-40766 is an improper-access-control flaw (vendor advisory SNWLID-2024-0015, CVSS 9.3) in the SonicOS management interface and SSLVPN across Gen 5/6/7 SonicWall firewalls, with patches available since August 2024. Through late 2025 it became one of the most reliable ransomware on-ramps in the field: Arctic Wolf documented an aggressive Akira campaign that used compromised SSLVPN credentials tied to the CVE to reach full ransomware deployment in an hour or less (Arctic Wolf, 2025-09-26). Nearly a year after the patch, the same device class keeps appearing in Akira and Fog intrusions — which is the puzzle a fresh SANS Internet Storm Center diary (2026-06-23) sets out to explain (SANS ISC, 2026-06-23).

The mechanism is post-patch residue, not an unpatched bug. The SANS ISC analysis makes the operationally important point explicit: organisations apply the firmware update but never complete the hardening that the update assumes, so the access paths the intrusions ride survive the patch (SANS ISC, 2026-06-23). SANS ISC further notes that on Gen 6 devices the firmware update alone is insufficient: a related SSLVPN MFA-bypass weakness (CVE-2024-12802) needs manual LDAP reconfiguration to close. Four residual misconfigurations recur:

• Stale local accounts created during initial device setup that were never removed and whose passwords were never rotated — including after the CVE-2024-40766 patch, even though the flaw's impact is precisely unauthorised access to such accounts.
• LDAP "Default Group" with implicit SSLVPN access, which silently grants VPN rights to potentially hundreds of Active Directory accounts without the administrator realising the membership scope.
• Unenforced or misconfigured MFA on the SSLVPN portal, so a single valid credential is sufficient.
• A publicly reachable Virtual Office Portal (the SSLVPN self-service / MFA-enrolment page), which exposes credential-stuffing and self-enrolment attack surface to the internet.

Kill chain. The pattern maps cleanly: initial access via valid SSLVPN credentials (T1133 External Remote Services, T1133) using stolen or stale T1078 Valid Accounts (T1078) — frequently T1078.002 Domain Accounts (T1078.002) when the LDAP default-group grant pulls AD identities into the VPN scope — followed by rapid lateral movement and Akira/Fog encryption (T1486 Data Encrypted for Impact, T1486). Arctic Wolf's "deploys ransomware in an hour or less" framing is the operational tempo to plan against: there is little dwell time in which to react once the VPN foothold is established.

Why it matters to us. SonicWall is a common branch-office and SMB perimeter firewall across Swiss cantonal/communal IT, healthcare and education networks — the exact mid-market public-sector estate this brief serves, and the kind of environment where a device was patched in 2024, ticket closed, and never revisited. The defender lesson generalises beyond SonicWall: applying a firewall patch for an access-control CVE does not rotate the credentials the CVE may already have exposed, nor does it close the misconfigurations that let a single credential become VPN access.

Detection concepts (no IOCs). Review SonicOS SSLVPN authentication logs (the SSLVPN auth events; SonicOS exposes these via syslog) for logons from stale/rarely-used local accounts and for sessions authenticated through LDAP groups that have not been recently reviewed; alert on Virtual Office Portal access from external source addresses; and aggregate SSLVPN login events into the SIEM so brute-force and credential-stuffing bursts are visible. Because the endgame is ransomware, pair perimeter telemetry with host detections for mass file-rename / encryption behaviour on file servers.

Hardening / mitigation. Per the SANS ISC and vendor guidance: upgrade to firmware 7.3.0+; rotate every SonicWall account password after patching (treat the CVE as a credential-exposure event, not just a code fix); enforce MFA on all SSLVPN users, explicitly including those whose access derives from an LDAP default-group membership; audit the LDAP Default Group and remove implicit SSLVPN grants; restrict the Virtual Office Portal to internal networks only; and enable logging for all SSLVPN login attempts.

"Squidbleed" — a 29-year-old heap over-read in Squid's FTP gateway leaks other users' cleartext HTTP credentials (CVE-2026-47729)

Researchers at Calif.io disclosed CVE-2026-47729, nicknamed Squidbleed: a heap buffer over-read in the Squid proxy's FTP-over-HTTP gateway (src/FtpGateway.cc) introduced by a 1997 code commit (Calif.io, 2026-06-18; The Hacker News, 2026-06-22). The root cause is a whitespace-skipping loop that calls strchr(w_space, *copyFrom) without first checking for the string terminator: strchr returns a non-NULL pointer when the search character is the embedded \0, so the parser walks past the end of the FTP directory-listing buffer into adjacent heap memory containing other users' cached HTTP requests. An attacker who controls an FTP server and can induce the proxy to fetch from it (FTP support and TCP/21 are in Squid's default Safe_ports ACL) can leak Authorization headers, session cookies, API keys and other cleartext request content from concurrent users sharing the same proxy worker (SecurityWeek, 2026-06-22). HTTPS relayed via CONNECT tunnels is not exposed; only cleartext HTTP and TLS-terminating proxy setups are. SUSE rates it moderate (CVSS 6.5) and there is no confirmed in-the-wild exploitation. The fixed-version picture is disputed upstream: the patch was merged in spring 2026, but the Squid maintainer first attributed the fix to 7.6 (released 8 June 2026) then corrected that to 7.7, while Debian's assessment is that the referenced commit is already present in 7.6, and SecurityWeek reports the fix shipped in 7.6 (The Hacker News, 2026-06-22; SecurityWeek, 2026-06-22). The safe reading for defenders is to treat the fixed version as uncertain and verify against your own build rather than assuming a single release line is clean Calif.io credits an AI model (Anthropic's "Claude Mythos") with surfacing the strchr edge case during AI-assisted fuzzing — another data point in the AI-assisted-vulnerability-discovery pattern the W25 weekly tracked.

Why it matters to us: Squid is widely deployed as a forward / caching / web-filtering proxy across EU public-sector networks, university perimeters and ISP infrastructure — exactly the multi-user environments where the cross-user leak has impact. Interim mitigation that does not depend on resolving the fixed-version dispute: disable FTP proxying (acl ftp proto FTP + http_access deny ftp, or drop FTP from Safe_ports) where it is not needed, and restrict who can reach the proxy from untrusted/multi-tenant segments. Confirm the fix is present in your actual build (RHEL/Debian/Ubuntu ship 4.x–6.x — check for a backport) rather than trusting a version number. Detection: monitor Squid access.log for ftp://-scheme requests from unusual clients and for worker heap-corruption / crash signals (T1190 Exploit Public-Facing Application; effective outcome resembles T1040 Network Sniffing).

CVE-2026-12789 — ILIAS 11.0: unpatched, PoC-public SQL injection in the learning-progress subsystem (DACH education exposure)

BSI WID-SEC-2026-2016 (2026-06-22) flags CVE-2026-12789, an SQL injection in ILIAS 11.0's learning-progress tracking — specifically ilTrQuery::executeQueries in components/ILIAS/Tracking/classes/class.ilTrQuery.php (BSI WID, 2026-06-22; GitHub Advisory GHSA-69G6-PGGC-389P, 2026-06-21). Exploitation requires an authenticated session (the advisory indicates elevated privileges are needed — PR:High), and the CVSS v4 base score is a low 2.0, reflecting the auth prerequisite and limited data-exposure scope. The operational concern is not the score: no patch is available (the vendor has been unresponsive to coordinated disclosure), a proof-of-concept is public, and ILIAS is the dominant open-source LMS across Swiss, German and Austrian universities, vocational schools (Berufsschulen) and public-sector training portals; an ENISA EUVD record exists (EUVD-2026-38153) (ENISA EUVD, 2026-06-22). Below the standard § 2 CVSS/exploitation gate, retained on CH/EU-public-sector-education relevance Until a fix ships: apply WAF rules blocking SQL metacharacter sequences on the tracking endpoints; restrict learning-progress endpoints to enrolled roles; and confirm the ILIAS database account lacks FILE/DROP/superuser rights (T1190 Exploit Public-Facing Application, T1078 Valid Accounts). Hunt DB slow-query / WAF logs for UNION SELECT patterns in POST bodies to tracking endpoints and anomalous result-set volumes.

CVE-2026-20896 — Gitea (Docker): trust-all reverse-proxy default lets an unauthenticated attacker impersonate any user via X-WEBAUTH-USER

Gitea 1.26.3 (2026-06-20) and 1.26.4 (2026-06-21) fix a cluster of four flaws; the critical one is CVE-2026-20896 (CVSS 9.8). The official Gitea Docker image shipped with REVERSE_PROXY_TRUSTED_PROXIES defaulting to the wildcard *, meaning Gitea trusts the reverse-proxy authentication header from any source. Any attacker who can reach the container's HTTP port can therefore send an X-WEBAUTH-USER header naming an arbitrary user — including an administrator — and be authenticated as that user with no credentials (Gitea, 2026-06-21; GitHub Security Advisory GHSA-f75j-4cw6-rmx4, 2026-06-21). Bare-metal deployments with an explicit trusted-proxy CIDR are unaffected unless they also set the wildcard. The same release also patches CVE-2026-27775 (protected-branch enforcement race in single-push batch operations), CVE-2026-20779 (CVSS 7.1 — TOTP 2FA bypass via a web-flow TOCTOU race and stateless X-Gitea-OTP replay inside the OTP validity window) and CVE-2026-22874 (SSRF in the webhook / repo-migration subsystems). Germany's BSI issued WID-SEC-2026-2027 on 2026-06-22 rating the set "hoch" (BSI WID, 2026-06-22). No in-the-wild exploitation reported yet; included on the pre-auth-critical-on-widely-deployed-software gate. Gitea is the dominant self-hosted GitHub alternative across DACH/EU public-sector DevOps and sovereign-cloud environments, so an internet-reachable or loosely-segmented Docker instance is an immediate admin-takeover risk (T1190 Exploit Public-Facing Application, T1078.001 Default Accounts). Mitigations: set REVERSE_PROXY_TRUSTED_PROXIES to the exact reverse-proxy IP/CIDR, or disable ENABLE_REVERSE_PROXY_AUTHENTICATION entirely if header-auth is not used; upgrade to 1.26.4. Hunt for admin logins sourced from the reverse-proxy IP with no corresponding password-auth audit entry, and webhook calls to RFC-1918 addresses.

AryStinger: a reconnaissance-and-proxy botnet built on end-of-life D-Link routers and QNAP NAS

QiAnXin XLab disclosed AryStinger, a previously-undocumented botnet its telemetry first observed on 2026-03-12, with English-language follow-up reporting on 2026-06-21 (QiAnXin XLab, 2026-06-17; BleepingComputer, 2026-06-21). Unlike the DDoS- and cryptomining-oriented router botnets that dominate this device class, AryStinger's design centre is pre-intrusion reconnaissance and traffic laundering: infected nodes are enrolled as "Executors" and handed distributed scanning and DNS-brute-force tasks by a C2 controller, and they relay the operator's attack traffic so its true origin is hidden. XLab counts at least 4,300 infected nodes and rising, distributed South Korea 48.5%, China 31.8%, Sweden 6.4%, Malaysia 3.5%, Singapore 2.5%; detection rate on public multi-engine scanning was zero at disclosure.

Initial access — three public CVEs across two device classes. The router variant spreads through CVE-2013-3307 (command injection in Linksys/D-Link models built on the Realtek RTL819X SoC family) and CVE-2016-5681 (a stack-based buffer overflow in the D-Link DIR-850L HTTP service) — both unauthenticated RCE on devices manufactured 2012–2015. From 2026-04-26 a second, NAS-targeting variant began exploiting CVE-2025-11837, a code-injection flaw in QNAP's Malware Remover utility (fixed in build 6.6.8.20251023; QNAP's advisory scopes the affected product to the 6.6.x line — update to the latest build). Mapped to T1190 Exploit Public-Facing Application (T1190). The most infected models — D-Link DIR-850L (75% of nodes) and DIR-818LW (13%) — are end-of-life with no firmware fix (D-Link support bulletin SAP10503), so for the router population there is no patch and replacement is the only remediation.

Post-exploitation and persistence. After exploitation a downloader pulls the current payload from C2, the bot authenticates with a unique Executor ID, and a Dropbear SSH server is deployed on a fixed non-standard port with an iptables rule added to allow inbound C2 traffic — establishing persistent, system-level remote access (QiAnXin XLab, 2026-06-17). This combines T1133 External Remote Services (T1133) for the SSH backdoor with T1562.004 Impair Defenses: Disable or Modify System Firewall (T1562.004) for the firewall change. The router binary masquerades under a system-daemon-like process name (T1036 Masquerading, T1036).

Two malware variants, different capability tiers. The constrained RTL819X C variant carries massdns-style distributed DNS reconnaissance and a NAT-traversal tunnelling module (T1572 Protocol Tunneling, T1572; T1090.002 external proxy, T1090.002). The Go "Standard" variant for more-capable hosts (NAS) bundles off-the-shelf offensive tooling — fscan, ksubdomain, httpx, tlsx — for network-service discovery and subdomain enumeration (T1046 Network Service Discovery, T1046; T1595 Active Scanning, T1595), plus remote command execution and source-level payload execution in Go/Java/Python. C2 is HTTP/HTTPS with Protobuf message bodies under XOR obfuscation; a hardcoded key string embeds a 2024 marker, suggesting the operation predates the 2026 first-sighting.

Why this matters to a Swiss/EU public-sector SOC. The direct exposure is indirect but real: EoL D-Link SOHO routers persist in branch offices, municipal sites, and home-office setups, and QNAP NAS appliances are widely used as departmental file shares — both populations sit on the audience's attack surface, and Sweden's 6.4% share shows European devices are already being conscripted. A node's job is to scan and proxy, so a compromised device inside or adjacent to an organisation's network becomes a launch point for credential brute-forcing and lateral reconnaissance that looks like it originates from trusted infrastructure.

Hunt and detection concepts (no IOCs). On Linux/MIPS network appliances, hunt for an unexpected Dropbear (or any) SSH daemon listening on a non-standard port and for iptables rules added outside change management. On QNAP and other Linux NAS, alert on curl/python (or other interpreters) spawned from the security-utility process tree (T1059.006, T1059.006) and on file writes into /tmp/bin/ by a service account that should not be writing executables. Network-side, watch for bursts of outbound DNS queries consistent with mass subdomain brute-forcing from edge/IoT VLAN segments, and for long-lived outbound SSH from device-management ranges. Inventory edge devices for the affected D-Link models and for QNAP Malware Remover build numbers.

Hardening. Replace EoL D-Link DIR-850L / DIR-818LW (and same-era RTL819X models) — there is no firmware path. Patch QNAP Malware Remover to 6.6.8.20251023 or later. Restrict inbound SSH on management VLANs to known jump hosts, and apply egress filtering so SOHO/IoT segments cannot freely initiate outbound SSH or high-volume DNS. Attribution: XLab claims none; the brief reports the activity as XLab characterises it, not as a named actor.

Insider and process failures — Munich school data, a lost SSD, and an NHS records caution

Several of the week's incidents were not external intrusions at all. Munich's municipal IT subsidiary is investigating ~120,000 student records suspected on the darknet, with a terminated employee under investigation (Heise, 2026-06-17; daily 06-17). The Kyushu Electric SSD loss (§ 4) was a physical-custody failure. And the UK ICO closed a two-year criminal investigation into deliberate misuse of Catherine, Princess of Wales' medical records at The London Clinic with a formal caution (ICO, 2026-06-19; daily 06-19). The common thread: privileged-insider and data-custody controls — offboarding, removable-media encryption, and access auditing on sensitive records — are as consequential as perimeter defence.

Education — exposed CMS and forum software stack a structural risk

Education entities sat under two pressures this week: the continuing ShinyHunters PeopleSoft campaign that W24 documented landing disproportionately on universities, and a cluster of critical web-application CVEs in software ubiquitous across European universities and student communities — JCE for Joomla (CVE-2026-48907, exploited), phpBB (CVE-2026-48611), Drupal core (CVE-2026-55803, BSI critical) and LiteSpeed shared-hosting (CVE-2026-54420, exploited), all in § 3. The pattern is not a single incident but an attack-surface concentration: the open-source CMS/forum/hosting stack that the education sector runs widely all took critical, partly-exploited disclosures in one week.

CVE-2026-55803 / CVE-2026-55804 — Drupal core: PHP object-injection chain in JSON:API, BSI-rated critical

The Drupal Security Team published six advisories on 2026-06-17 (fixed in 10.5.12, 10.6.11, 11.2.14, 11.3.12); BSI escalated the aggregate to kritisch (Drupal SA-CORE-2026-005; BSI CERT-Bund; daily 06-19). Drupal runs a large share of European government and university sites, making this a public-sector CMS patch priority. Update core immediately.

CVE-2026-20181 / CVE-2026-20190 — Cisco Identity Services Engine: unauthenticated credential read chaining to root command execution

Two flaws in Cisco ISE and the ISE Passive Identity Connector let an unauthenticated attacker read credentials (CVE-2026-20181, 9.1) that chain to authenticated root command execution (CVE-2026-20190, 7.5); BSI flagged the pair for DACH operators (Cisco PSIRT; daily 06-19). ISE is the network-access-control and policy backbone in many enterprise and public-sector networks — a rooted ISE undermines NAC posture wholesale. Patch promptly.

CVE-2026-48907 — Joomla Content Editor (JCE): unauthenticated profile-import to PHP RCE (CVSS 4.0 10.0, CISA KEV)

JCE is one of the most widely installed Joomla editors across European universities, municipalities and community portals. CVE-2026-48907 chains weaknesses in the profile-import workflow into unauthenticated PHP remote code execution, is rated CVSS 4.0 10.0, and was KEV-listed on 2026-06-16 (Widget Factory / JCE; YesWeHack; daily 06-17). Update to JCE 2.9.99.5 or later; the vendor also shipped a free patch for older sites.

CVE-2026-0257 — Palo Alto Networks PAN-OS GlobalProtect: authentication bypass under active exploitation

First disclosed in May and KEV-listed on 2026-05-29, the GlobalProtect portal/gateway authentication bypass moved into a confirmed exploitation wave this week. Unit 42 observed active exploitation by an unidentified actor attempting to access GlobalProtect, with Arctic Wolf reporting increasing exploitation volume and NCSC-CH refreshing its advisory on 2026-06-16 (Unit 42; daily 06-17). Notably, Unit 42 states no post-access lateral movement had been identified as of its analysis — so the current operational signal is unauthorised VPN session establishment, not yet confirmed downstream compromise. Patch to the fixed PAN-OS trains, and hunt GlobalProtect logs for authentications that bypass the expected portal flow.

Prinz Eugen: a Go-based encryptor that targets recent files first and leaves no ransom note

Malwarebytes ThreatDown published a technical deep dive into Prinz Eugen, a Go-based ransomware operation active since at least April 2026 and operating as a standalone crew rather than a ransomware-as-a-service affiliate (Malwarebytes ThreatDown, 2026-06-17). A confirmed European victim — Transitions Pro Centre Val de Loire, a French state-funded workforce-transition agency — puts it squarely in scope for a Swiss/EU public-sector SOC, alongside victims reported in finance and US automotive services. Two design choices make it worth a defender's attention: it leaves no ransom note on disk, and it encrypts the most-recently-modified files first (BleepingComputer, 2026-06-20).

Kill chain. Initial access is via stolen RDP credentials (T1133 External Remote Services, T1021.001 Remote Desktop Protocol). Post-access is hands-on-keyboard: the operator creates a backdoor local admin account (the documented command line is net user admin germania /add, T1136.001 Create Account: Local Account), stages the encryptor as servertool.exe (downloaded via Chrome into the user's Music folder, T1105 Ingress Tool Transfer), and abuses the legitimate RemotePC (IDrive) RMM tool plus enterprise platforms (SharePoint, OneDrive, Citrix) for lateral movement and to blend with normal activity. Encryption is T1486 Data Encrypted for Impact; extortion is conducted entirely out-of-band (no on-host note), defeating the common detection heuristic of alerting on dropped ransom-note files.

Encryption internals. The Go binary encrypts with ChaCha20-Poly1305 (AEAD) using a 32-byte master key and per-file random IVs, with a three-stage key-derivation chain — Argon2id → SHA-256 → HKDF-SHA256. Encrypted files carry a CHV1 magic header and the .prinzeugen extension. After encryption the binary zeroes its hardcoded key material and forces garbage collection before self-deleting, frustrating post-incident key recovery from memory. The "recent files first" ordering is the operationally significant detail: it maximises impact on active business data while shortening the encryption window before detection.

Hunt and detection concepts (no IOCs). The highest-fidelity signal is the access-to-persistence transition: an RDP logon from an unusual ASN or geography followed within minutes by local-admin-account creation (Windows Security Event ID 4624 logon → 4720 account created → 4732 added to Administrators). Watch for net user … /add on command lines (Event ID 4688 process creation with command-line auditing), servertool.exe executing with directory-path arguments, and RemotePC installed on endpoints outside the managed-software inventory — a standalone high-signal hunt. Finally, monitor for .prinzeugen extension fan-out across file shares.

Hardening / recovery. Restrict RDP to VPN or jump-host access and enforce MFA on all remote-access sessions — this closes the documented initial-access vector. Inventory and revoke dormant RMM licences and add network detection for RemotePC traffic originating from endpoints that should never be remote-administered. The "recent files first" behaviour has a recovery corollary worth planning around: file-share snapshots taken within the last 24–48 h before an encryption event will have the highest recovery fidelity, so frequent short-interval, access-controlled backups or snapshots are disproportionately valuable against this family.

CVE-2026-52806 — Gogs self-hosted Git server: argument injection to OS command execution (BSI critical batch)

BSI advisory WID-SEC-2026-2013 (rated kritisch, 2026-06-19) consolidates a batch of more than 20 CVEs in the Gogs self-hosted Git server (BSI CERT-Bund, 2026-06-19). The most severe, CVE-2026-52806 (CWE-77 command injection; CVSS 4.0 9.4 per BSI, CVSS 3.1 9.9 per the GitHub advisory), lets a user craft a branch name containing a --exec Git flag that Gogs passes unsanitised to git rebase, yielding arbitrary OS command execution as the Gogs process owner when a rebase is triggered. Because Gogs ships with open self-registration enabled and no repository-count limit by default, the "authenticated" prerequisite is effectively eliminated on default-configured internet-exposed instances (GitHub Security Advisory GHSA-qf6p-p7ww-cwr9). All issues are fixed in Gogs 0.14.3 (released 2026-06-07; the BSI consolidation followed a May 2026 disclosure that the bugs were then unpatched). Gogs is common in EU research institutions, universities and smaller public-sector IT teams as a lightweight Git host. Upgrade to 0.14.3, set [service] DISABLE_REGISTRATION = true if registration is not required, run the Gogs process under a minimal-privilege shell-less user, and hunt for git child processes carrying --exec arguments.

CVE Summary Table

CVE-2026-40624 — AVer PTC-series conference cameras: unauthenticated RCE via the management web interface

CVE-2026-40624 (CVSS 3.1 9.8; CISA classes it CWE-552, files or directories accessible to external parties) lets a remote, unauthenticated attacker execute arbitrary code on AVer PTC500S, PTC115, PTC500+ and PTC115+ PTZ cameras by sending a crafted request to the web-based management interface (CISA ICS advisory ICSA-26-169-01, 2026-06-18). NCSC-CH echoed the advisory the following day and lists exploitation status as unknown (NCSC-CH, 2026-06-19). These cameras are common in government meeting rooms, lecture halls and legislative-chamber hybrid-meeting setups — placed adjacent to meeting infrastructure on frequently flat networks, they offer device takeover plus a lateral-movement foothold. AVer has shipped firmware fixes; interim mitigation is to put cameras on an isolated VLAN with no internet egress and restrict the management interface to trusted admin hosts. Hunt for unexpected HTTP requests to the camera management interface from non-admin subnets and any outbound connections initiated by camera IP ranges (cameras should never initiate arbitrary egress).

Cisco ISE CVE-2026-20181 + CVE-2026-20190: an unauthenticated credential-harvest primitive feeding authenticated root code execution on the identity plane

Cisco Identity Services Engine is not just another exposed appliance — it is the policy brain of network access control in most large Swiss and European public-sector estates: the RADIUS/TACACS+ server behind 802.1X port authentication, the posture/profiling engine, and frequently the AD/identity-policy enforcement point for both wired and wireless. A root shell on an ISE node is therefore not an endpoint compromise; it is control of the authentication plane that decides which devices and users get onto the network. That is what makes the pair Cisco patched on 2026-06-17 worth a deep read even with no in-the-wild exploitation yet reported (Cisco PSIRT, 2026-06-17).

The two primitives. CVE-2026-20190 (CVSS 7.5, improper authorization) is the entry primitive: specific ISE/ISE-PIC APIs fail to enforce authorization, so an unauthenticated remote attacker who can reach the management interface over HTTP can read sensitive data — explicitly including hashed administrator credentials — with crafted requests (T1190 Exploit Public-Facing Application → T1212 Exploitation for Credential Access). CVE-2026-20181 (CVSS 9.1, path traversal / CWE-22) is the impact primitive: an authenticated administrator can submit a crafted request that escapes the intended directory and executes arbitrary operating-system commands, escalating to root; on single-node deployments the same flaw can also be driven to a denial-of-service (SecurityWeek, 2026-06-18).

Why the chain matters more than either CVE. On its own, CVE-2026-20181 requires administrator authentication — a meaningful barrier. CVE-2026-20190 removes that barrier: it hands an unauthenticated attacker the hashed admin credentials, which can then be cracked offline (T1110.002 Password Cracking) or, depending on the credential material and authentication scheme, replayed (T1550 Use Alternate Authentication Material). With administrator authentication in hand (T1078 Valid Accounts), the attacker pivots to CVE-2026-20181 for command execution as root (T1059 Command and Scripting Interpreter → T1068 Exploitation for Privilege Escalation). The net effect is a network-reachable, no-interactive-credential path from "can talk to the ISE management plane" to "root on the identity controller." From root on ISE, an adversary is positioned to tamper with authentication and authorization policy itself (T1556 Modify Authentication Process) — issuing or trusting RADIUS responses, weakening 802.1X enforcement, or harvesting credentials traversing the policy engine.

Exposure and prerequisites. The only hard prerequisite for the entry primitive is network reachability of the ISE management/API interface; everything after that is consequence. Cisco states there is no workaround. Affected trains are fixed in ISE 3.3 Patch 11 and 3.4 Patch 6 (both available now). ISE 3.5 is the gap: Patch 3 closes only the unauthenticated read (CVE-2026-20190), and the full fix (Patch 4) is not scheduled until August 2026 — so 3.5 operators carry the authenticated-RCE half for roughly two months and must compensate with exposure reduction.

Hunt and detection concepts. Because there is no public exploit detail yet, detection here is behavioural and access-surface-oriented, not signature-based:

• Management-plane reachability is the first control: alert on any source outside your defined administration subnets reaching the ISE management/API interface at all. The unauthenticated read only works if the attacker can reach those APIs.
• API-access anomalies: review ISE application/admin logs for unauthenticated or unexpected requests to the credential-adjacent API endpoints, and for ERS/API request patterns from newly-seen source addresses.
• Administrator-session anomalies: correlate any administrator CLI/command activity with the set of source addresses and accounts you expect to perform it; a successful chain shows up as admin-context command execution from an unusual origin shortly after anomalous unauthenticated API reads.
• Identity-plane integrity: baseline expected RADIUS/TACACS+ behaviour and alert on policy or device-admin changes that did not originate from your change process — post-compromise tampering is the high-impact outcome to catch even if the intrusion itself was missed.

Hardening / mitigation (cite Cisco's own guidance). Apply the fixed patches as the only complete remediation: ISE 3.3 Patch 11 or 3.4 Patch 6 now; for 3.5, apply Patch 3 immediately to remove the unauthenticated credential read and plan the August Patch 4 upgrade. Independently of patch state, restrict the ISE management and API interfaces to dedicated, tightly-firewalled administration subnets (out-of-band management VLAN), enforce strong administrator credentials and MFA on admin logon to blunt the offline-cracking step, and monitor the management plane as a tier-0 asset. Treat ISE, like AD and the PKI, as identity infrastructure whose compromise is a full-network event — segment and instrument it accordingly.

CVE-2026-55803 / CVE-2026-55804 — Drupal core: PHP object-injection chain in JSON:API, BSI-rated critical

The Drupal Security Team published six advisories on 2026-06-17, fixed in 10.5.12, 10.6.11, 11.2.14 and 11.3.12; BSI escalated the aggregate to kritisch (Drupal SA-CORE-2026-005; BSI CERT-Bund WID-SEC-2026-2002). CVE-2026-55803 (SA-CORE-2026-005, Critical) is a PHP object-injection flaw in the JSON:API module: an attacker with JSON:API write permission against an entity that uses a serialized custom field type can inject a malicious serialized payload. No core-shipped field type meets the prerequisite, so exploitation requires JSON:API write access (off by default) plus a contributed/custom entity-reference field that serializes its property; CVE-2026-55804 (SA-CORE-2026-006, Moderately critical) supplies the deserialization gadget chain that turns that injection into execution. The remaining advisories cover a rebuild.php trusted-host bypass (CVE-2026-55806), Media-module oEmbed SSRF (CVE-2026-55807) and a JSON:API/REST image-upload MIME-validation gap (CVE-2026-55808). No exploitation reported. The relevance here is footprint, not exploitation maturity: Drupal underpins a large share of Swiss federal/cantonal and EU-institution web estates.

CVE Summary Table

CVE-2026-12046 / CVE-2026-12045 / CVE-2026-12048 — pgAdmin 4: unauthenticated pickle deserialization RCE, AI-Assistant read-only-transaction bypass, stored XSS

pgAdmin 4 v9.16 (2026-06-18) patches seven CVEs across v6.0–9.15 in the project's own coordinated-disclosure release notes (pgAdmin, 2026-06-18). CVE-2026-12046 (CVSS v4 9.5): two SQL-Editor endpoints (DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/...) are missing the @pga_login_required decorator in server mode, making them reachable unauthenticated; both reach a pickle.loads() sink on session gridData[trans_id]['command_obj']. Full RCE additionally requires knowledge of the Flask SECRET_KEY and write access to the session store — preconditions that can exist on shared hosting or after partial compromise. CVE-2026-12045 (CVSS v4 9.4): the AI Assistant wraps LLM-generated SQL in BEGIN TRANSACTION READ ONLY, but a COMMIT/ROLLBACK-prefixed multi-statement payload escapes the read-only guard, enabling DML and — on a superuser role via COPY ... TO PROGRAM — OS command execution, delivered through prompt injection into any database object the Assistant reads. CVE-2026-12048 (CVSS v4 9.3): stored XSS via unsanitised PostgreSQL error text and EXPLAIN-plan content rendered through html-react-parser. The pgAdmin release notes do not publish CVSS scores; the CVSS v4 figures here are ENISA EUVD's (EUVD-2026-37966 = 9.5, EUVD-2026-37965 = 9.4, EUVD-2026-37968 = 9.3) (ENISA EUVD, 2026-06-18). No exploitation reported.

CVE-2026-20181 / CVE-2026-20190 — Cisco Identity Services Engine: unauthenticated credential read chaining to authenticated root command execution

Cisco's advisory cisco-sa-ise-multi-G5WP8vv (2026-06-17) covers two flaws in ISE and ISE Passive Identity Connector (Cisco PSIRT, 2026-06-17; SecurityWeek, 2026-06-18). CVE-2026-20190 (improper authorization, CVSS 7.5) lets an unauthenticated remote attacker read sensitive data — including hashed administrator credentials — via crafted HTTP requests to specific APIs. CVE-2026-20181 (path traversal, CWE-22, CVSS 9.1) lets an authenticated administrator execute arbitrary OS commands and escalate to root; on single-node deployments it also causes a DoS. Cisco states there is no workaround and reports no known exploitation. Fixed in ISE 3.3 Patch 11 and 3.4 Patch 6 (available now); ISE 3.5 Patch 4 is scheduled for August 2026, with 3.5 Patch 3 closing only CVE-2026-20190 in the interim. The combined two-stage chain — and the detection/hardening for the identity plane it controls — is this brief's § 5 deep dive.

PAN-OS GlobalProtect CVE-2026-0257 — exploitation wave with Impacket post-compromise, NCSC-CH refreshes advisory

UPDATE · originally covered CVE-2026-0257 — Palo Alto PAN-OS GlobalProtect: Pre-Auth Authentication Bypass via Certificate Reuse (2026-05-30)

Palo Alto's Unit 42 confirms an active exploitation campaign against the GlobalProtect cookie authentication-bypass (CVE-2026-0257) running since approximately late May (Unit 42, 2026-06-09). The flaw (CWE-565) decrypts an authentication-override cookie without any signature verification, letting an attacker forge a session and establish a VPN tunnel without credentials when the override feature is enabled (Palo Alto Networks PSIRT).

Arctic Wolf's telemetry documents post-exploitation consistent with Impacket tooling — SMB lateral movement, anonymous NTLM logon, share enumeration and domain-user discovery — across insurance, finance, manufacturing, education, engineering and healthcare targets in North America and Europe (Arctic Wolf, 2026-06-11). NCSC-CH refreshed its Security Hub advisory on 2026-06-16 to flag the Unit 42 confirmation (NCSC-CH Security Hub, 2026-06-16). Defenders: disable "Authentication Override" if not required, patch to fixed PAN-OS builds, and audit sessions since late May for Impacket-pattern lateral movement (EID 4624 Type 3 from unexpected IPs, SMB enumeration EID 5140/5145).

Sekoia: ErrTraffic — a ClickFix Malware-as-a-Service framework resolving C2 through the Polygon blockchain

ClickFix — fake browser/update dialogues that trick users into pasting attacker PowerShell — is maturing into a productised delivery channel, as this and the next item show. Sekoia's TDR team analysed ErrTraffic, a ClickFix distribution framework sold as MaaS by an actor using the handle "LenAI" on the Exploit.IN forum since at least December 2025 (Sekoia TDR, 2026-06-16). Affiliates compromise WordPress sites by credential-stuffing wp-login.php (one victim saw seven residential IPs in an 80-second window) or via WP File Manager CVE-2020-25213, then deploy a PHP backdoor as a must-use plugin (session-manager.php) that injects the ErrTraffic JavaScript. The JavaScript uses the EtherHiding technique — querying Polygon smart contracts via public RPC endpoints — to resolve C2 domains dynamically, defeating takedowns; it then serves ClickFix lures that drop Vidar, Stealc, SmokeLoader and others. ErrTraffic explicitly targets European and APAC visitors, putting public-sector WordPress portals in scope.

Why it matters to us: A reliable hunt artefact is the distinctive PowerShell comment block <# Code Verification: NNNNNNNNNNNN #> Sekoia found at the start of ErrTraffic command strings. Also watch for new PHP files under wp-content/mu-plugins/ (auto-loaded, no activation needed), credential-stuffing bursts on wp-login.php, and outbound requests from the web-server process to blockchain RPC endpoints.

CVE-2026-48907 — Widget Factory Joomla Content Editor (JCE) before version 2.9.99.5: unauthenticated profile-import → PHP RCE (CVSS v4 10.0)

CVE-2026-48907 is an improper-access-control flaw (CWE-284) in the JCE extension — one of the most widely installed third-party Joomla editors — that chains three weaknesses in the profile-import workflow: a missing authentication check on index.php?option=com_jce&task=profiles.import, absent file-extension validation, and disabled upload-safety controls (YesWeHack, 2026-06-16). An unauthenticated attacker imports a crafted editor profile that permits .php (or other executable) extensions for the Image Manager / File Browser plugin, then uploads a web shell that lands in images/ by default — yielding OS-level code execution as the web-server user. The vendor states the attacks are fully automated and that a site without a public registration form is not safe; any site that ran a JCE version before 2.9.99.5 should assume compromise and restore from a pre-breach backup after confirming the timeline from web logs (Widget Factory / JCE, 2026-06-03). CISA added it to the KEV catalog on 2026-06-16. Patched in JCE version 2.9.99.5 (2026-06-03), further hardened in 2.9.99.6 (2026-06-06). Detection: unauthenticated POSTs to profiles.import in web logs; unfamiliar auto-named profiles at the top of the JCE profile list with PHP uploads enabled; unexpected PHP files in images/, media/ or tmp/.

CVE Summary Table

Compact view of the actively-exploited / weaponised CVEs across this brief (full context in § 2 above and the § 4 updates).

Munich: ~120,000 student records suspected on the darknet — terminated employee under investigation

LHM-Services GmbH, the municipal IT subsidiary of the City of Munich that runs school-administration systems for Bavarian schools, is investigating a suspected data-protection incident involving roughly 120,000 students — names, addresses, dates of birth, nationalities and school assignments (the 120,000 figure originates in press reporting; LHM-Services says it learned of the incident from the press and questioned whether the data was actually publicly available) (Heise Security, 2026-06-16). The investigation, led by Munich's cybercrime unit and the Bamberg prosecutor, centres on a former employee suspected of having mass-downloaded and retained the dataset shortly before leaving — i.e. a suspected insider data-theft, not an external intrusion. A darknet-research firm engaged by LHM-Services found no evidence the data was publicly listed for sale at the time of writing, so the actual circulation scope is uncertain. LHM-Services notified the Bavarian State Data Protection Authority under GDPR Article 33 and filed a criminal complaint (LHM-Services GmbH press release, 2026-06-15).

CVE-2026-48611 / CVE-2026-48612 — phpBB: unauthenticated authentication bypass to admin, one HTTP request

Pentest-Tools.com disclosed two authentication flaws in phpBB, the open-source forum software common across European universities, municipalities and community portals (Pentest-Tools.com, 2026-06-08). CVE-2026-48611 (NVD CVSS 9.8) is an improper-authentication flaw in the OAuth implementation that allows account hijacking — including admin accounts — even when OAuth is not configured, reachable by a single unauthenticated request given only a target username (publicly visible via the member list) (NVD). CVE-2026-48612 (CVSS 8.0) chains improper OAuth state verification with CSRF to hijack a logged-in session on OAuth-enabled boards. Both affect phpBB 3.1.0 through 3.3.16 (a 10-year release span) and 4.0.0-alpha, and are fixed in phpBB 3.3.17 (phpBB, 2026-06-06). The disclosing source does not publish exploit code, and no in-the-wild exploitation is reported yet. Upgrade immediately for any internet-reachable instance; if upgrade is delayed, disable the OAuth integration even if unused.

CVE Summary Table

DPRK UNK_DeadDrop weaponises VS Code / Cursor auto-run to hit developers, including EU targets

Proofpoint details UNK_DeadDrop, a North-Korea-aligned cluster (related to but distinct from Contagious Interview / Famous Chollima) that sent 250+ recruitment-themed phishing emails to ~100 finance, crypto, education and technology organisations over April–May 2026 (Proofpoint, 2026-06-15); the targeted geographies are a US majority followed by the UK, Australia, France, Germany and the Netherlands, among others (The Hacker News, 2026-06-16). The lure links to attacker-controlled GitHub/GitLab repositories carrying a .vscode/tasks.json with runOn: folderOpen; VS Code shows a workspace-trust prompt, but Cursor IDE executes the task silently with no prompt, dropping the open-source Overlord Go C2 that steals browser credentials and crypto wallets (The Hacker News, 2026-06-16). Mapped to T1566.002, T1195.001, T1059.004 and T1555.003.

Why it matters to us: public-sector and fintech development teams that have adopted Cursor are exposed to silent execution on repository open. Hunt for editor processes (code, cursor) spawning shell/script interpreters outside build directories (Sysmon EID 1 parent-image filter); enforce workspace-trust policy and restrict VSIX installation to an approved-publisher allowlist via enterprise policy.

PRC UNC6508 ran year-plus espionage through internet-facing REDCap servers and a Google Workspace BCC rule

Google's Threat Intelligence Group attributes a September 2023 – November 2025 espionage campaign to UNC6508, a PRC-nexus cluster that compromised North American academic, medical and military-health organisations by exploiting externally-facing REDCap (Research Electronic Data Capture) servers, then dropping a bespoke PHP implant tracked as INFINITERED (Google GTIG, 2026-06-15). INFINITERED trojanises REDCap's own upgrade mechanism to survive platform updates, harvests credentials from the REDCap login page, and exposes a cookie-gated backdoor for shell, file, SQL and credential operations (Help Net Security, 2026-06-15). The exfiltration tradecraft is the notable part: after pivoting to a Workspace admin account, the actor created a Google Workspace content-compliance rule named "Patroit" that silently BCC-forwarded any message matching ~150 research/defence keywords to an attacker-controlled Gmail address — abusing a legitimate administrative feature rather than dropping exfiltration malware (T1114.003 Email Forwarding Rule), which evades most DLP that watches for new tooling (SecurityWeek, 2026-06-15). Initial access mapped to T1190; web-shell persistence to T1505.003; admin credential reuse to T1078.

Why it matters to us: REDCap is deployed across Swiss and EU university hospitals, cantonal research bodies and clinical-trial coordinators, and the Workspace BCC-rule technique is tenant-agnostic. Hunt now: Google Workspace admin audit logs for content-compliance/BCC rule creation by non-IT-admin accounts (especially rules with external Gmail recipients), and file-integrity-monitor the REDCap upgrade-staging directory and login handlers — standard web-root scanning misses the upgrade-path implant.

Education — ShinyHunters' PeopleSoft campaign lands disproportionately on universities

The week's clearest sectoral concentration. Mandiant/GTIG's attribution of the Oracle PeopleSoft zero-day campaign (§ 1) explicitly noted that the education sector was hit hardest, with the University of Nottingham confirming ~455,000 affected records (Google GTIG; daily 06-13). It rhymes with the earlier Oxford University CareerConnect breach, where third-party provider Group GTI's compromise exposed students across multiple UK universities (Oxford; daily 06-09). European higher-education ICT teams running PeopleSoft or relying on shared careers/HR SaaS should treat both as direct warnings.