2026-06-02-8af85d01

• Items dropped (out of window, window_hours = 36):
  • PHANTOMPULSE blockchain-C2 RAT (Elastic Security Labs) — primary dated 2026-05-22, well outside window; single-source. Strong analysis but stale for a daily.
  • Check Point AI Threat Landscape Digest (Mar–Apr 2026) — primary dated 2026-05-26, out of window; overlaps the W22 weekly's AI-tooling coverage; also carried several unverifiable forward-looking model/CVE claims that could not be corroborated.
  • CIFSwitch — Linux kernel CIFS LPE (CVE-2026-46243) — freshest source 2026-05-30 (out of window) and a local-privilege-escalation that does not clear a §2 inclusion gate (no active exploitation, not pre-auth RCE). Notable item; may resurface if exploitation emerges.
  • Vodafone source-code leak (Lapsus$) — the underlying leak occurred 2026-05-12 (out of window); the 1 June heise re-reporting carries no fresh delta, and the technical corroboration (OpsecInsider) is reduced-confidence. Reduced confidence on the hardcoded-credential detail.
• CVEs referenced but not given a §2 entry:
  • CVE-2024-21182 (Oracle WebLogic T3/IIOP, CVSS 7.5) — added to the CISA KEV catalog on 2026-06-01 (active-exploitation signal noted). Dropped from §2 because the only in-window source is the CISA KEV catalog (a blocked listing URL) and Oracle's July-2024 CPU advisory is out of window — no citable in-window primary for the listing. Per PD-13 the US FCEB BOD 22-01 due date (2026-06-04) is not the operational driver in any case.
• Single-source items dropped:
  • Dashlane brute-force / credential-stuffing lockouts (BleepingComputer, single-source) — routine credential-stuffing with no confirmed backend compromise; below the daily relevance bar. Defender note retained here: ensure password-manager accounts require a second factor for new-device enrolment.
• Deferred to the weekly horizon view: Anthropic "Mythos" / Project Glasswing — ENISA access (Bloomberg, 2026-06-01). In-window and EU-public-sector-relevant, but it is a policy/horizon development rather than a 1–7-day operational item and is framed around vendor performance metrics this brief excludes. Better suited to the weekly § Policy & regulatory horizon. Standing defender takeaway: vulnerabilities in widely-used software may become known to EU bodies before they are shared with non-EU jurisdictions (including Switzerland) — keep independent vulnerability-management cadence high on internet-facing systems.
• Contradiction — CVE-2026-41089 network vector: sub-agent returns disagreed on the exact trigger. One framed it as the Netlogon RPC interface (MS-NRPC); another, citing heise, described an oversized field in a CLDAP (LDAP locator) request over UDP/389. BleepingComputer's coverage specifies only "a specially crafted network request to a domain controller" and Microsoft's advisory states the component (Netlogon) without a port/protocol. The brief therefore describes the affected component and the unauthenticated-network nature precisely and does not assert a specific port. Detection guidance was kept at the component/behaviour level accordingly.
• Exploitation-attribution nuance — CVE-2026-41089: active exploitation is asserted by CCB Belgium (national CSIRT) and corroborated by BleepingComputer, Help Net Security and SecurityWeek; Microsoft had not updated its advisory to mark the CVE exploited as of 2026-06-01. The Immediate Action and §4 update both attribute the exploitation signal to CCB rather than the vendor.
• Candidate source added this run (one max): seqrite-labs (Seqrite Labs / Quick Heal research arm) — provided the original Operation Dragon Weave research underpinning today's deep dive; fills an India/APAC-plus-EU gap in the source list. Added as candidate. Separately, the existing candidate ccb-belgium contributed corroborating content again this run (CVE-2026-41089 exploitation confirmation) and had its successful-fetch timestamp advanced — progressing toward promotion, not a new addition.
• Sourcing notes (reduced-confidence / journalistic-only primaries): CVE-2026-8732 (WP Maps Pro) — no public vendor PSIRT advisory exists for the plugin; the strongest available primaries are BleepingComputer and The Hacker News carrying Wordfence's exploitation data. Meta AI support-bot Instagram takeover — Meta issued no detailed technical advisory; reporting rests on Krebs on Security and TechCrunch. Both items are corroborated across two independent outlets and are reported with that limitation noted.
• Coverage gaps: sec-edgar (EDGAR full-text search returned HTTP 500 for both date windows; no 8-K Item 1.05 filings retrievable); sophos-xops (HTTP 503, rotation-priority, unrecovered); therecord (feed HTTP 404; partially recovered via BleepingComputer/WebSearch); inside-it-ch (rotation-priority, not attempted in window); databreaches-net (rotation-priority, not attempted); cert-fr-actualite (feed stalled at Oct 2025); anssi-fr (most recent CERT-FR avis dated 2026-05-22, out of window).

Unmatched action items (migrated)

• Update WP Maps Pro to 6.1.1 on any WordPress estate, then audit for rogue administrator accounts created during the exposure window — exploitation is live (see §2).
• Remediate Apache Solr template credentials now (no patch released): delete the superadmin/admin/search/index template users from security.json or rotate their passwords, and confirm Solr's API is not internet-exposed (see §2).
• Update Disig Web Signer to 2.5.5 on government and regulated-sector workstations that perform eIDAS qualified-signing workflows; inventory for older 2.0.3–2.5.3 builds (see §2).
• Inventory @redhat-cloud-services/* npm versions across build agents and developer endpoints; rotate any CI/CD cloud-identity tokens (AWS/GCP/Azure/Vault/Kubernetes) reachable from affected pipelines and alert on obfuscated preinstall node -e chains (see §1).
• Verify KS-SOMED auto-update integrity in any environment running KAMSOFT healthcare software, and hunt for FTP connections to vendor update servers from non-vendor source IPs (see §1).
• Hunt for the Gamaredon GammaWorm pattern and the WordPress/Steam C2 pattern — mshta.exe→wscript.exe chains, NTFS-ADS-hidden scripts and Telegra.ph/Supabase/Workers dead-drops; web-server processes reaching steamcommunity.com profile pages and @eval(base64_decode(...)) PHP under wp-content/uploads (see §3).
• Review any AI helpdesk/account-recovery agent's authority to change credentials or recovery linkages — require out-of-band challenge to the currently registered second factor before any such change (see §1).
• Baseline legitimate Azure Blob Storage egress and alert on blob.core.windows.net traffic from non-Azure-native host processes to catch Dragon Weave-style dead-drop C2 (see §5).

Migrated from briefs/2026-06-02.md (v2).