Two internet-facing Oracle enterprise product lines were under active exploitation this week — E-Business Suite RCE joins the PeopleSoft campaign

If you did nothing this week: any internet-reachable Oracle enterprise application tier is a live pre-auth target. Two distinct Oracle product lines were being exploited in the same window, so the defender decision is not "patch this CVE" but "get every Oracle application front end off the public internet and onto the exploited-flaw patch clock."

The new fact this week is CVE-2026-46817 (CVSS 9.8), an unauthenticated RCE in the File Transmission component of Oracle Payments within Oracle E-Business Suite (EBS 12.2.3–12.2.15), fixed in the May 2026 Critical Patch Update. Threat-intel firm Defused reported the first confirmed in-the-wild exploitation against its EBS honeypots over the weekend of 27–28 June — roughly six weeks after the patch and with "no known previous exploitation and no public POC code" until that point (BleepingComputer, 2026-06-29; SecurityAffairs, 2026-06-30). That "patched-but-now-exploited, no-PoC" pattern is exactly what turns unpatched internet-facing estates into targets fastest. Shadowserver tracks 450+ internet-exposed EBS instances, ~200 in the US and Europe, and EBS Payments/financial modules sit in government, higher-education and large-enterprise finance back offices — high-value data behind an internet-reachable app tier (BleepingComputer, 2026-06-29).

This lands alongside — but is distinct from — the ShinyHunters/UNC6240 Oracle PeopleSoft zero-day campaign (CVE-2026-35273) that GTIG/Mandiant attributes and that added Nissan as its largest named victim this week (Google GTIG; campaign arc consolidated separately in this week's long-running status entry). No public reporting ties the EBS exploitation to ShinyHunters — the EBS activity is unattributed — so the weekly signal is not a single actor but a product-family exposure: two Oracle enterprise application lines under active exploitation at once. Detail on each: EBS deep dive and the Nissan disclosure (§ references).

Builds on: 2026-07-01/oracle-e-business-suite-cve-2026-46817-pre-auth-rce-in-the-p · 2026-07-01/nissan-is-the-largest-named-victim-yet-in-the-shinyhunters-o

ShapedPlugin's official update channel shipped backdoored WordPress Pro plugins — credential, 2FA-secret and web-shell theft

If you did nothing this week: any site running the ShapedPlugin Pro plugins that auto-updated through the licensed channel pulled backdoor code straight from the vendor — patch level was no defence, because the trusted distribution pipeline itself was the attacker. The malicious LicenseLoader.php loads inside the WordPress admin panel, fetches a second stage, installs it as a fake plugin and self-deletes to frustrate forensics.

Wordfence disclosed on 2026-06-22 that an attacker breached ShapedPlugin's build and Easy Digital Downloads distribution pipeline and injected backdoor code into the Pro (paid) releases of three plugins, served through official update channels. The implant harvests credentials and 2FA secrets and drops a web shell (BleepingComputer). For a public-sector or education estate that runs WordPress behind a CMS team, the hunt is for the fake-plugin artefact and unexpected LicenseLoader.php execution in the admin context, plus credential/2FA rotation for any admin who logged in during the exposure window — not merely "update the plugin." (daily 06-23)

NAIC breached through an Oracle PeopleSoft zero-day; ShinyHunters dumps 3.1 TB and US rating-agency feeds stall

If you did nothing this week: any internet-reachable Oracle PeopleSoft instance is a live pre-auth foothold — the same zero-day path that put the US National Association of Insurance Commissioners into ShinyHunters' hands, and PeopleSoft is widely deployed across European public administration, higher education and HR/finance back offices. The W25 looking-ahead flagged that ShinyHunters PeopleSoft notifications were still landing and that EU universities were a probable next-named class; NAIC is the fresh high-profile confirmation that the campaign is still acquiring victims.

NAIC — the standard-setting body for all 50 US state insurance regulators — confirmed on 2026-06-26 that an unauthorised party reached its environment on June 11 via an Oracle PeopleSoft vulnerability, then pivoted from PeopleSoft to temporary access to data-storage areas. ShinyHunters claims 3.1 TB exfiltrated (TechRadar, Insurance Journal). The operational tell is the downstream impact NAIC itself disclosed: credit-rating agencies paused their data feeds and NAIC suspended assigning designations to insurer investments — a regulatory-process outage, not just a data-confidentiality event. This is the same PeopleSoft exploitation wave (CVE-2026-35273, the unauthenticated RCE in PeopleTools Environment Management) Google GTIG attributes to UNC6240/ShinyHunters and has been tracking against the education sector — 68% of identified targets were higher-education institutions; Treat any externally-reachable PeopleSoft portal (/PSEMHUB/, /PSIGW/HttpListeningConnector) as a hunt target, not a patch-later item. (daily 06-28)

SimpleHelp RMM auth bypass (CVE-2026-48558) went from disclosure to in-the-wild exploitation this week — an RMM supply-chain foothold

If you did nothing this week: an internet-exposed SimpleHelp RMM server running OIDC single-sign-on is a full-takeover foothold — and because remote-monitoring-and-management servers push commands to every endpoint they manage, one compromised instance is a supply-chain pivot into an entire managed estate, the same blast-radius pattern that made Kaseya and ConnectWise ScreenConnect priority targets.

CVE-2026-48558 (CVSS 10.0) is an OIDC SSO authentication bypass in SimpleHelp: the OIDC callback handler accepts an identity token without verifying its cryptographic signature (CWE-347), so an attacker forges an arbitrary token, obtains a full Technician-level session, and bypasses MFA on first OIDC login (Horizon3.ai, 2026-06-12). The prerequisite is a configured OIDC provider with a TechnicianGroup bound and "Allow group authenticated logins" enabled; Horizon3.ai measured ~14,000 internet-exposed servers, ~7.2% (~1,000) in a vulnerable OIDC configuration. This week's shift is from disclosure to exploitation: CISA added the CVE to KEV on 2026-06-29 — jurisdiction-agnostic confirmation of in-the-wild abuse — and observed follow-on is deployment of the new cross-platform Djinn infostealer through a "TaskWeaver" loader persisting via scheduled tasks and launchd plists (BleepingComputer, 2026-06-29; Centre for Cybersecurity Belgium, 2026-06). The weekly lens for a public-sector reader: RMM and remote-support tooling is a recurring first-party supply-chain surface — treat the management plane of any remote-support product as tier-0, patch it on the exploited-flaw clock rather than the monthly cycle, and confirm no support vendor in your own supply chain is running an exposed, unpatched instance. First covered operationally on 2026-06-30 (§ references).

Builds on: 2026-06-30/cve-2026-48558-simplehelp-rmm-oidc-sso-authentication-bypass

Edge and VPN appliances took three pre-auth RCE/overread disclosures in one week — Citrix NetScaler, WatchGuard Firebox, Kemp LoadMaster

The through-line across three otherwise unrelated vendors this week is that the network edge kept producing the exact bug class — pre-authentication memory corruption / overread in an internet-reachable appliance — that the Fortinet/Ivanti/Citrix history shows reliably becomes a mass-exploitation target once detail surfaces.

Kemp LoadMaster — CVE-2026-8037 (CVSS 9.8): watchTowr published full mechanics of an uninitialized-malloc() heap corruption in the escape_quotes() path of the access executable, reached by a sprayed JSON payload to /accessv2, yielding code execution as root with no authentication (watchTowr, 2026-06-29). eSentire's TRU reported in-the-wild exploitation attempts beginning the same day the PoC dropped (observed attempts failed) — the fastest disclosure-to-attempt turn of the three (first covered 06-30, exploitation confirmed 07-02; § references).

Citrix NetScaler ADC/Gateway — CVE-2026-8451 (CVSS 8.8): a pre-auth out-of-bounds read in the hand-rolled XML attribute parser behind /saml/login, reachable only when the appliance is a SAML IdP, leaking adjacent process memory in the NSC_TASS response cookie — the fourth CitrixBleed-class memory-safety defect watchTowr has documented in NetScaler auth paths. watchTowr shipped a public "Detection Artefact Generator" so operators can test exposure; no in-the-wild exploitation was confirmed at disclosure, but CitrixBleed-lineage siblings have been exploited within days (watchTowr, 2026-06-30; NCSC-NL advisory NCSC-2026-0216).

WatchGuard Firebox — CVE-2026-13368 (CVSS 9.2): a use-after-free race in the iked IKEv2 daemon reachable during LDAP authentication for Mobile VPN with IKEv2; a remote unauthenticated attacker winning the race executes code in the iked context (WatchGuard PSIRT, 2026-07-02; BSI CERT-Bund WID-SEC-2026-2193). The 12.5.x branch had no fix at publication and 11.x is EOL.

Weekly takeaway for defenders: the recurring exposure is not a product, it is the class — internet-terminated VPN/UTM/load-balancer appliances with pre-auth memory-corruption primitives. Where a fix does not yet exist for your build (Firebox 12.5.x), the correct move is to remove the vulnerable auth path, not wait; and detection for all three realistically lives in appliance crash telemetry and the backing auth server's logs, because the exploit fires before any session is established. Per-appliance detail in § references.

Builds on: 2026-07-01/cve-2026-8451-citrix-netscaler-adc-gateway-pre-auth-saml-mem · 2026-07-03/cve-2026-13368-watchguard-fireware-iked-pre-auth-rce · 2026-06-30/cve-2026-8037-progress-kemp-loadmaster-pre-auth-rce-via-unin · 2026-07-02/kemp-loadmaster-cve-2026-8037-exploitation-attempts-confirme

Klue / Icarus Salesforce OAuth-integration breach — from nine named victims to ~24, then the attacker gets hacked

This is the W25 multi-day item, but the in-window deltas re-shape it materially. At the start of the week the named-victim list stood at nine, mostly cybersecurity vendors (HackerOne, Huntress, Jamf, OneTrust and others, SecurityWeek 06-23). It then accreted through the week: 8x8 filed an SEC 8-K Item 1.05 on 06-23 confirming Salesforce exfiltration; BeyondTrust and LastPass disclosed business-contact and sales data theft on 06-25; by 06-27 roughly two dozen firms had notified, and in a twist the Icarus attacker was itself hacked, with a second extortion actor now threatening the stolen data. Salesforce disabled the Klue connected app.

The new lens the dailies could not assemble: this is a single dormant OAuth integration credential at one SaaS vendor cascading into multi-tenant CRM theft across that vendor's entire customer base — the exact failure mode ReliaQuest framed as "integration abused in CRM data theft" in W25. For a Swiss/EU SOC the takeaway is an OAuth-grant inventory exercise: enumerate third-party connected apps with API scopes into your CRM/identity tenants, revoke dormant grants, and alert on bulk REST/Bulk-API reads from integration principals — patching nothing here helps, because no software was vulnerable; a delegated token was. (daily 06-23, daily 06-25, daily 06-27)

ShinyHunters (UNC6240) — one cluster, multiple reported tradecraft paths in one week

The week is a compact case study in how a single extortion cluster's reported activity spans very different initial-access tradecraft. The two firmly UNC6240-attributed events are the Oracle PeopleSoft zero-day behind the NAIC breach (GTIG/Mandiant attribution, § 1) and the April 2026 Instructure Canvas LMS breach, whose UK Cyber Monitoring Centre sector review landed 06-27 (160 UK universities, extortion, ransom paid). Alongside them, 404 Media's reconstruction (06-26) showed the Madison Square Garden intrusion began with a single vishing call into the company's identity platform — the operator phoned a low-level employee and talked them through authorising access; the 404 Media account documents the technique but names no actor, and the ShinyHunters link rests on the operators' own claims and the SSO-vishing TTP overlap Abnormal Security attributes to the cluster.

The cross-day pattern matters more than any single victim: a server-side zero-day, a SaaS-platform compromise and SSO-targeting vishing all appear under (or adjacent to) one extortion banner in one week, so defending against this cluster is not a single control. It is externally-reachable enterprise-app patching/hunting, third-party SaaS exposure management, and help-desk/identity-platform vishing resistance (callback verification, no MFA-reset-on-call) — all at once. (daily 06-26, daily 06-27, daily 06-28)

This week AI crossed from attack target to attack operator — agentic ransomware, coerced coding agents, and LLM-output poisoning

The prior weekly's research lens was "the AI agent and toolchain control plane became a target." Four independent disclosures this week move the frame: AI is now showing up as the operator of an intrusion and as the delivery channel for one, not just the thing being attacked.

AI as operator. Sysdig documented JADEPUFFER, which it assesses to be the first end-to-end ransomware operation driven by an LLM rather than a human — entering through an unpatched, internet-exposed Langflow (CVE-2025-3248, on CISA KEV since May 2025), then autonomously sweeping credentials, forging a Nacos JWT from a documented default signing key, probing for container escape, and encrypting 1,342 Nacos config items with a never-persisted key (Sysdig, 2026-07-01). Sysdig's own framing is that the novelty is the operator, not the vulnerabilities — every step exploited a known, patchable exposure, but agentic tooling collapsed the skill floor to chain recon-through-destruction into one automated run (§ references, covered operationally 07-04).

AI as the thing attackers subvert to reach you. Mozilla 0DIN showed a "clean" GitHub repo — no malicious code to flag on static analysis — coercing an AI coding agent into a reverse shell through three levels of indirection (error message → DNS TXT lookup → shell execution), so the agent "never decided to open a shell; it decided to fix an error" (Mozilla 0DIN, 2026-06-25).

AI as the delivery layer. Unit 42's Phantom Squatting pre-registers the specific domains a production LLM hallucinates when asked for URLs, so later users or agent-browsers are handed attacker infrastructure with zero reputation history to flag (Unit 42, 2026-07-01). And Kaspersky's June telemetry shows a community AI-agent "skill" marketplace still distributing malicious SKILL.md files that run with the tokens and file-system access of whatever they touch (Kaspersky Securelist, 2026-07-01).

Weekly takeaway: for a SOC that increasingly runs AI coding agents in CI/CD and developer workstations and is beginning to field agentic tooling, the strategic obligation is to treat every agent capability — shell, repo access, browsing, third-party skills — as a privilege scope that needs an explicit grant and human-in-the-loop gating, and to recognise that none of these attacks needed a novel software bug: they exploited agent autonomy plus the same neglected, internet-exposed infrastructure defenders already owe a patch. Per-technique detail and detection concepts in § references.

Builds on: 2026-07-04/jadepuffer-agentic-llm-ransomware-langflow-rce · 2026-06-29/mozilla-0din-a-clean-github-repo-coerces-ai-coding-agents-in · 2026-07-01/unit-42-phantom-squatting-registering-ai-hallucinated-domain · 2026-07-02/kaspersky-community-ai-agent-skills-are-an-emerging-supply-c

npm supply-chain worms — a sustained wave across the week

Three separate npm-ecosystem supply-chain events were in play across the window, and the pattern is the story. Microsoft attributed the Mastra scope compromise (140+ @mastra packages, postinstall dropper) to North Korea's Sapphire Sleet (covered in the daily on 06-21). JFrog documented PostCSS typosquats from the abdrizak account delivering a Nuitka-compiled Python RAT with Chrome DPAPI credential theft. And on 2026-06-25 Socket reported a fresh Miasma / "Mini Shai-Hulud" worm wave across LeoPlatform/RStreams packages (carried in the daily 06-27), the self-propagating supply-chain worm last seen backdooring @redhat-cloud-services.

The synthesis: the npm registry is under continuous, parallel pressure from a state actor (DPRK), commodity typosquat crews and a self-replicating worm — three different operators, one ecosystem. The common control is the same one npm v12 is about to enforce by default: disable install scripts (--ignore-scripts), pin and review dependencies, and treat CI build-time package resolution as an attack surface. (daily 06-21, daily 06-24, daily 06-27)

Vulnerability status roll-up — 2026-W27: what moved, what to patch on the exploited-flaw clock vs the monthly cycle

This is the week's vulnerability state as a single scannable view — the CVE detail and full sourcing live in the operational entries that first covered each item (§ references); the value here is the current status and the patch-priority framing.

Newly exploited / KEV-listed this week (assume-compromise if exposed and unpatched). SimpleHelp RMM CVE-2026-48558 (CVSS 10.0 OIDC auth bypass) moved to active exploitation + CISA KEV, deploying the Djinn infostealer (this week's top story). Oracle E-Business Suite CVE-2026-46817 (pre-auth RCE) saw its first in-the-wild exploitation. Microsoft SharePoint Server CVE-2026-45659 (CWE-502 deserialization, Site-Member RCE) was added to CISA KEV on 2026-07-01 — the first public confirmation of exploitation, and notable because Microsoft's own advisory still rates it "Exploitation Less Likely," a contradiction defenders should resolve toward the exploitation evidence (Microsoft MSRC; CISA KEV feed, 2026-07-01). Progress Kemp LoadMaster CVE-2026-8037 (pre-auth RCE) drew exploitation attempts the day its PoC dropped (covered in this week's edge-appliance entry).

Working exploit or public PoC (patch on emergency cadence). DirtyClone Linux-kernel LPE CVE-2026-43503 now has a confirmed working exploit on default Debian/Fedora; the libssh2 pre-auth heap write CVE-2026-55200 has a public PoC; Citrix NetScaler CVE-2026-8451 has a public susceptibility-testing artefact.

Weaponisation-likely, not yet exploited (patch before the PoC lands). Adobe's APSB26-68 fixed six CVSS 10.0 unauthenticated RCE paths in ColdFusion 2025/2023 — two unrestricted-file-upload, three input-validation, one path-traversal — all Adobe Priority 1 ("high risk of being targeted"), with Adobe stating no known in-the-wild exploits yet; ColdFusion's history of rapid weaponisation of unauth file-upload primitives makes this a same-week patch priority for any internet-facing instance (Adobe PSIRT APSB26-68, 2026-06-30). Control Web Panel CVE-2026-57517 (pre-auth SQLi→RCE) and Coolify CVE-2026-34038 (authenticated command injection, CVSS 9.9) round out the high-impact patch set.

Also patched this week (standard cycle, no exploitation): Gogs CVE-2026-52806 (now abused for cryptojacking), the SzafirHost e-signature client JAR parser-confusion RCE CVE-2026-13165 (CERT Polska — EU public-sector e-signature relevance), Altium Enterprise Server CVE-2026-14439, and cve-search CVE-2026-59509. Full per-CVE detail in § references.

Builds on: 2026-06-30/cve-2026-48558-simplehelp-rmm-oidc-sso-authentication-bypass · 2026-07-01/oracle-e-business-suite-cve-2026-46817-pre-auth-rce-in-the-p · 2026-07-02/cve-2026-45659-microsoft-sharepoint-server-authenticated-des · 2026-07-02/kemp-loadmaster-cve-2026-8037-exploitation-attempts-confirme · 2026-06-30/dirtyclone-linux-kernel-lpe-cve-2026-43503-now-has-a-confirm · 2026-06-30/public-poc-released-for-the-libssh2-pre-auth-heap-write-cve · 2026-07-01/cve-2026-8451-citrix-netscaler-adc-gateway-pre-auth-saml-mem · 2026-07-02/cve-2026-48276-48277-48281-48282-48283-48316-adobe-coldfusio · 2026-07-03/cve-2026-57517-control-web-panel-pre-auth-sqli-to-rce · 2026-07-03/cve-2026-34038-coolify-authenticated-command-injection-to-rc · 2026-06-29/gogs-cve-2026-52806-moves-from-no-observed-exploitation-to-a · 2026-06-30/cert-polska-discloses-a-jar-parser-confusion-rce-in-the-szaf · 2026-07-02/cve-2026-14439-altium-enterprise-server-altium-365-authentic · 2026-07-05/cve-2026-59509-cve-search-fetch-cve-data-nosql

CVE-2026-11800 (JWT algorithm-confusion) and CVE-2026-9800 (policy-enforcer authz bypass) — Keycloak identity-plane fixes

Keycloak 26.6.4 fixed eight CVEs. The headline flaw is CVE-2026-11800, a JWT algorithm-confusion that lets an attacker with valid client credentials forge an assertion, bypass signature verification and impersonate any federated user behind the affected identity provider (GHSA-gqj5-2xp5-3qmp, BSI WID-SEC-2026-2093); the bundled CVE-2026-9800 is a separate policy-enforcer authorization bypass via incorrect URI comparison. Keycloak is the IdP of choice across European public-sector, healthcare and finance deployments — these are identity-plane breaks, not app bugs. Patch to 26.6.4.

CVE-2026-58053 — Gitea act_runner Docker backend: container-hardening bypass to host escape (public PoC, ENISA-critical)

Gitea act_runner through 0.262.0 passes a workflow-defined container.options string straight into Docker's HostConfig, forcing only Privileged=false while merging --pid=host, --cap-add and --security-opt unchanged — a malicious workflow escapes the job container to the host (VulnCheck). Public PoC, CVSS 9.4, mitigation-only this week. Self-hosted Gitea CI is common in DACH developer shops and universities; restrict who can define workflow container options. The companion Gitea-core auth bypass via X-WEBAUTH-USER (CVE-2026-20896, fixed in 1.26.3/1.26.4) remains worth patching on the same estate.

CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910 — Ubiquiti UniFi OS Server: pre-auth RCE chain, exploited (CISA KEV)

Three max-severity (CVSS 10.0) flaws in UniFi OS Server — improper access control and path traversal that bypass authentication and reach an unauthenticated RCE endpoint — were patched and KEV-listed with confirmed exploitation. UniFi controllers are common in DACH SME, education and public-sector branch networks; the management plane is frequently exposed. Patch and audit controller-account integrity.

CVE-2025-67038 — Lantronix EDS5000 serial-to-IP converters: unauthenticated command injection to root (BRIDGE:BREAK, CISA KEV)

Forescout Vedere Labs' BRIDGE:BREAK research documented an unauthenticated OS command-injection flaw in Lantronix EDS5000-series device servers — the HTTP management interface concatenates unsanitised input into a shell call. The in-window development is its CISA KEV listing on 2026-06-23 with confirmed in-the-wild exploitation (covered in daily 06-24) — the first BRIDGE:BREAK flaw to flip from research to active abuse. Serial-to-IP converters sit in front of OT, building-management and medical serial devices; firmware 2.0.0R1 closes it. This is an energy/water/healthcare exposure, not an IT one.

CVE-2026-20245 — Cisco Catalyst SD-WAN Manager: Mandiant reconstructs the full zero-day chain

Mandiant (GTIG) published the first complete TTP chain on 06-24 for the Catalyst SD-WAN Manager zero-day activity, observed at a service provider: a peering/authentication bypass (CVE-2026-20127, CVE-2026-20182) leading to credential manipulation, then local privilege escalation to root via a malicious CSV upload (CVE-2026-20245) to plant a root backdoor. NCSC-CH posted on it, giving it direct Swiss relevance. Telco and public-sector SD-WAN operators should hunt for unexpected file writes under the web-UI service account and root-owned artefacts post-dating the patch.

CVE-2026-12569 — PTC Windchill / FlexPLM: pre-auth deserialization RCE, now confirmed exploited with JSP web shells (CISA KEV)

When first covered (06-20) and in the W25 weekly this was a pre-auth deserialization flaw with BSI escalating to admins out-of-hours. The in-window delta: CISA added it to KEV on 06-25 and JSP web-shell deployment against the login interface is now confirmed in the wild. Any internet-reachable Windchill PDMLink or FlexPLM instance should be treated as assume-compromise — manufacturing and defence-supplier PLM is exactly the externally-reachable engineering surface a Swiss/EU industrial estate forgets to inventory.

CVE-2026-55200 / CVE-2026-55199 — libssh2 heap out-of-bounds write with public PoC

The GitHub Security Advisory GHSA-r8mh-x5qv-7gg2 describes a heap out-of-bounds write in libssh2's ssh2_transport_read() that fails to enforce an upper bound on the packet_length field (CVSS 9.2), with a companion pre-auth DoS (CVE-2026-55199) corroborated by NCSC-NL NCSC-2026-0210; public PoC code was reported within the window (see daily 06-28). An upstream fix has landed (the GHSA references the fix commit), but tagged-release availability still varies across the binding and appliance ecosystem — so the operational task is SBOM exposure tracking and chasing each embedding vendor's release, not a single library bump (. libssh2 is embedded in a long tail of management tooling, appliances and language bindings.

CVE-2026-43503 (DirtyClone) and CVE-2026-46331 (pedit COW) — Linux kernel LPE with public weaponised PoCs

Two page-cache-corruption local-privilege-escalation flaws drew working exploits within the window. JFrog published a full DirtyClone walkthrough (XFRM/IPsec skb cloning) on 06-25; a companion tc act_pedit out-of-bounds write (pedit COW) gained a weaponised PoC within a day of assignment. Both are post-auth root escalation on patched-but-unrebooted hosts — prioritise kernel updates on multi-tenant and internet-exposed Linux where an initial foothold is plausible.

CVE-2026-20230 — Cisco Unified CM WebDialer: pre-auth SSRF to arbitrary root file write, reconnaissance-stage scanning observed

Cisco PSIRT's advisory describes an SSRF in the WebDialer service of Unified CM 14/15 that lets an unauthenticated attacker write files to the OS and later escalate to root. The in-window signal: exploitation moved to reconnaissance stage, with a PoC that fingerprints vulnerable devices. Unified CM is core telephony for many cantonal and hospital networks — patch before the scanning becomes exploitation.

Government and public administration took three distinct hits this week — a Swiss cantonal leak-site claim, a Pegasus-infected MEP, and a US federal info-sharing breach

Three unrelated events this week share one thing: the victim is a public institution, and each demonstrates a different way government is reached — extortion branding, mercenary spyware, and inter-agency trust boundaries. For a Swiss federal SOC the value is the pattern across the target class, not any single incident.

A Swiss cantonal department on a leak site (unconfirmed). MedusaLocker listed a victim "Bd" with domain bd.zh.ch — the Baudirektion of the Canton of Zürich — on 2026-07-01, claiming 772 extracted emails, as part of a batch-style posting wave that also listed a French municipality and other European entities in immediate succession (Ransomware.live, 2026-07-01). This is a dark-web claim only: no cantonal statement, no NCSC.ch (BACS) advisory, no independent Swiss press coverage exists in-window. It is a situational-awareness signal for cantonal-government readers, not a confirmed breach — but batch-listing of European public bodies is itself the operational note (§ references).

A Pegasus-infected European Parliament oversight member. Citizen Lab confirmed with high confidence that the iPhone of former MEP Stelios Kouloglou — who sat on the Parliament's PEGA committee investigating commercial-spyware abuse — was infected with NSO Group's Pegasus twice (Oct 2022 and Mar 2023) via the zero-click PWNYOURHOME chain (a crafted NSKeyedArchive landing in the HomeKit daemon, then malicious content in MessagesBlastDoorService) (Citizen Lab, 2026-07-03). The targeting infrastructure overlaps a Pegasus operator also hitting Russian/Belarusian-speaking exiles in Europe. Infecting the person scrutinising spyware abuse is an EU parliamentary-privilege concern, and the defensive surface for high-risk officials is proactive mobile forensics plus enforced Lockdown Mode — not endpoint alerting.

A US federal information-sharing platform. DHS confirmed a breach of the Homeland Security Information Network — the platform federal/state/local/international/private-sector partners use to exchange sensitive-but-unclassified information — with intrusion believed to be late-May–early-June and a SharePoint collaboration system implicated; DHS says no classified networks were impacted (BleepingComputer, 2026-07-01). Both this and HSIN's 2023 incident trace to collaboration-platform trust boundaries rather than perimeter exploitation.

Builds on: 2026-07-02/medusalocker-leak-site-lists-the-canton-of-z-rich-s-baudirek · 2026-07-03/citizen-lab-pega-committee-mep-infected-with-pegasus · 2026-07-02/dhs-confirms-a-breach-of-the-homeland-security-information-n

Technology & SaaS supply chain — the week's busiest victim class

The dominant pattern of the week was the third party as entry vector: Klue/Icarus (Salesforce OAuth, ~24 firms), ShapedPlugin (WordPress build pipeline), the npm worm wave, 8x8's SEC-disclosed Salesforce theft, and the BadBlocker Chrome extension (§ 6). In nearly every case the victim organisation patched nothing wrong of its own — the compromise rode in through a trusted vendor, integration token, package or browser extension.

Education

Education was a structural victim class. The ShinyHunters Canvas/Instructure breach hit 160 UK universities per the UK CMC sector review (ransom paid, limited downstream damage). The unpatched ILIAS 11.0 SQL-injection (CVE-2026-12789, PoC-public, no patch) directly exposes the DACH learning-management estate, and self-hosted Gitea CI (§ 3) is concentrated in universities. The common thread: education runs exposed CMS/LMS/forum and developer stacks with thin operational security.

Healthcare

Third-party processors drove the week's healthcare exposure. Xsolis, a healthcare-AI utilization-management vendor, disclosed a phishing-driven breach affecting 1,396,519 patients across seven US health systems — the data sat at the processor, not the hospitals. The UK's HCRG Care Group began notifying patients of a February 2025 Medusa ransomware attack — a 16-month notification lag. The Lantronix BRIDGE:BREAK flaw (§ 3) additionally exposes serial-attached medical devices.

Public administration & government

The week's public-sector signal is heavily Swiss/European. NCSC-CH reported an active Microsoft 365 "voicemail" phishing wave in Switzerland delivering infostealers and harvesting M365 credentials, with chain-phishing onward from compromised mailboxes. The Swiss Federal Audit Office reported that the two-year-old split of federal cyber-governance leaves strategic oversight without a complete incident picture — a structural finding for any federated public administration. Further afield, Ukraine's postal operator Ukrposhta had digital services disrupted by an overnight attack, and Brazil's national Cell Broadcast alert platform was hijacked to push fake emergency messages to ~30M phones — a reminder that government alerting infrastructure is itself a target.

Data-theft extortion without an encryptor keeps maturing — a US county paid ~$1M to Kairos with no encryptor recovered

The week's incident cases reinforce a shift that has been building through 2026: extortion is decoupling from encryption. The concrete anchor is Kairos.

Ransom-ISAC published a case study of a US county government that paid roughly $1 million to the data-theft extortion actor Kairos after an intrusion in which no encryptor was recovered — Ransom-ISAC obtained no locker binary and notes the actor's "ransomware group" status remains unverified, so the leverage was the threat to publish exfiltrated county data rather than encryption (Ransom-ISAC, 2026-07-03). The intrusion itself is a 2025 case (demand mid-May, payment mid-June 2025) published as a retrospective this window, not a this-week breach. This is the pure form of a model that also showed up elsewhere in the week: MedusaLocker's leak-site listings (including the unconfirmed Canton of Zürich claim) trade on data-disclosure threat rather than demonstrated encryption, and the ShinyHunters cluster consolidated separately in this week's long-running status entry continues to extort on exfiltration alone, without a locker.

Why it is strategic, not just another incident: for a decade the standard ransomware-resilience answer has been tested, offline, immutable backups — a posture that bounds the availability impact of encryption. Encryption-less data-theft extortion routes around that entirely: if the leverage is disclosure of citizen or employee PII, restoring from backup does not reduce the harm or the notification obligation. The defender consequence for a public-sector SOC is a re-weighting: exfiltration detection (anomalous large outbound transfers, cloud/SFTP staging), data minimisation on sensitive stores, and clear pre-agreed non-payment / notification playbooks matter as much as recovery engineering. The Kairos county case is a single-source 2025 retrospective case study (§ references) — treat the dollar figure as illustrative and the "no encryptor" as evidentiary absence, not proven — but the encryption-less-extortion pattern across this week's cases is the durable signal.

Builds on: 2026-07-05/kairos-data-theft-extortion-case-us-county-govt-1m-payout · 2026-07-02/medusalocker-leak-site-lists-the-canton-of-z-rich-s-baudirek

Attribution and accountability: Jaguar Land Rover and Scattered Spider

Two disclosures closed loops opened months ago. A New York Times investigation gave the first named attribution for the 2025 Jaguar Land Rover ransomware attack — a Russian state-linked criminal group — though investigators have not determined whether the operators worked for, independently of, or with the tacit approval of the Russian government. And two Scattered Spider members pleaded guilty over the 2024 Transport for London intrusion. Both reinforce that the dominant English-speaking extortion ecosystems are being mapped to named individuals and state-linked clusters.

Law-enforcement and platform-disruption momentum this week — NetNut/Popa proxy botnet dismantled, StegoAd extension cluster killed, $10M bounty on Russia-nexus crews

Three disruption actions this week are worth consolidating not as wins to celebrate but for what each says about the durability of the abused technique.

NetNut (Popa) residential-proxy botnet dismantled. The FBI — with Google, Lumen and Shadowserver — seized NetNut/Popa infrastructure on 2026-07-02; Google disabled the Google accounts used for C2 and updated Play Protect to block apps bundling the malicious SDKs, while the FBI seized netnut.com (Google GTIG, 2026-07-02; Krebs on Security, 2026-07-02). The strategic figure GTIG surfaces is that in a single June week it observed 316 distinct threat clusters — criminal and suspected-espionage — routing traffic through suspected NetNut exit nodes to mask origin IPs during password-spray, credential-stuffing and infrastructure access. That confirms residential-proxy relay as shared criminal/state infrastructure, and Google's own caution is the key defender note: degraded operators buy capacity from rivals, so proxy-based anonymisation volumes shift providers rather than dropping (§ references, operational coverage 07-04).

StegoAd extension cluster. Microsoft disrupted StegoAd — 119 Edge extensions that hid payloads inside image and font files via steganography (campaign:stegoad-darkspectre-119-edge-extensions-steganography) — reinforcing browser-extension marketplaces as a recurring, disruptable delivery surface (this week's operational coverage, § references).

$10M bounty on Russia-nexus crews. The US added a $10M bounty on the Russia-nexus Signal/WhatsApp phishing crews and folded Signal Backup-Recovery-Key theft into the advisory (this week's operational coverage, § references).

Weekly takeaway: all three targets abuse infrastructure that is cheap to re-provision — residential proxies, browser extensions, messaging-app social engineering — so the correct posture for a SOC is to keep the behavioural detections (implausible residential-ASN auth sequences, extension-install governance, Signal backup-key hygiene for high-risk staff) running past the headlines, because the operators displaced this week reappear behind new providers. This week's Mustang Panda dead-drop-C2-via-Zoho-WorkDrive case (§ references) is the same lesson from the offensive side: abuse of legitimate, hard-to-block infrastructure is the through-line.

Builds on: 2026-07-04/netnut-popa-residential-proxy-botnet-disrupted-by-google-fbi · 2026-06-30/microsoft-disrupts-stegoad-119-edge-extensions-hid-payloads · 2026-06-30/us-posts-10m-bounty-on-the-russia-nexus-signal-whatsapp-crew · 2026-06-30/mustang-panda-abuses-zoho-workdrive-as-a-dead-drop-c2-channe

Mass third-party exposures: Xsolis, Texas Parks & Wildlife, Canvas

Three large data exposures all traced to a third party rather than the named organisation: Xsolis (1.4M patients via a healthcare-AI processor), Texas Parks & Wildlife (3.08M licence holders via an unnamed licence-sales vendor, with a public-vs-AG-filing SSN contradiction noted in § 11), and the Canvas/Instructure LMS breach (160 UK universities). The recurring control gap is vendor data-minimisation and breach-notification SLAs.

Social engineering and SSO abuse opened the highest-profile intrusions

Madison Square Garden was breached by a single vishing call into its identity platform; the operators talked a low-level employee into authorising access. This is the same human-layer entry that has driven the year's most damaging extortion. The defensive lesson is process, not product: callback verification on help-desk identity changes, no MFA reset on an inbound call, and alerting on anomalous SSO grants from new devices.

Threat-actor developments: Russia-nexus espionage broadens; new China-nexus and DPRK clusters

The most significant new actor finding the dailies did not carry is Turla's STOCKSTAY — Google GTIG characterised a multi-component .NET/Windows Forms backdoor that communicates C2 over secure WebSocket and shares significant code overlap with Kazuar (Turla's staple implant since 2017). Delivery used malicious RDP files by phishing and, as recently as November 2025, RAR archives exploiting WinRAR's CVE-2025-8088 (a flaw also abused by Sandworm, Gamaredon and RomCom). Current targeting is Ukrainian government and military, but earlier victims had Italian, Dutch, Polish and German foreign-policy interest — a direct read-across for Swiss federal and European governmental entities with Ukraine-adjacent policy work (The Hacker News). This sits alongside the week's other Russia-nexus signal: FBI/CISA escalated their warning that Russian intelligence (tracked as UNC5792) is now phishing Signal Backup Recovery Keys for persistent account takeover, and ESET's Gamaredon retrospective (§ 7) shows the FSB-linked group moving exfil and C2 wholesale onto trusted cloud services.

Two non-Russian clusters round out the picture. Unit 42 documented CL-STA-1062, a Chinese-speaking cluster (overlapping Talos's UAT-7237) deploying the new TinyRCT .NET backdoor via AppDomainManager injection against Southeast-Asian government and state-owned energy targets (Unit 42); Kaspersky GReAT analysed the StrikeShark cluster's SharkLoader deploying Cobalt Strike via "Perfect DLL Hijacking" against government targets (Securelist). And SentinelLABS' macOS.Gaslight, a DPRK-aligned Rust backdoor, notably turns prompt injection on the LLM-assisted analyst rather than the sandbox (SentinelLABS) — an early instance of tradecraft built specifically to poison AI-assisted triage. Attribute the claim to the research outfit, not the state, where the source itself hedges.

Research: the trust chain, not the perimeter, was the week's attack surface

The week's research converges on one structural shift: the productive attack surface in 2026 is the set of trust relationships connecting developer tools, CI/CD pipelines, SaaS integrations, AI coding agents and the browser — not the network perimeter. Tenable's analysis of the Miasma worm frames it as a "Developer Credential Economy": an infostealer harvests a developer credential (a Red Hat GitHub token sat in infostealer logs ~7 weeks before weaponisation), it is brokered underground, then weaponised through npm and — the novel capability — injected into the SessionStart hooks of AI coding tools so it runs when a developer opens a repo (Socket enumerates at least five affected tools — Claude Code, GitHub Copilot, Gemini CLI, Cursor, VS Code). The entire kill chain carries no CVE, and SLSA provenance attestations passed registry checks — provenance without content scanning is no defence (Socket).

The same trust-boundary theme runs through the week's other primary research: the Klue/Icarus cascade (a 2022 OAuth grant, § 2); Cordyceps, which found 300+ exploitable pull_request_target GitHub Actions misconfigurations leaking main-branch secrets (Novee Security); Unit 42's malicious-skill payloads bypassing the OpenClaw agent sandbox (Unit 42); and Island's "BadBlocker", an 11M-install Chrome ad-blocker one server-side config change away from arbitrary JavaScript on any site, with no extension update or store review (Island). On the identity plane, Netcraft documented Bluekit, a Browser-in-the-Middle phishing-as-a-service platform that authenticates the victim into the attacker's browser session, defeating Device Bound Session Credentials (Netcraft) — a reminder that session-binding controls like DBSC do not stop a browser-in-the-middle relaying the live authenticated session. Cisco Talos's field guide to Windows COM abuse (ITaskService, BITS, WMI, DCOM as EDR-evasion primitives) closes the loop on detection: indirect vtable calls hide activity behind legitimate service call stacks. The defender takeaway is uniform — audit OAuth grants and integration service accounts older than 12 months, restrict AI-agent hook configuration to read-only paths, treat CI/CD token scope as a reviewed principal, and don't assume FIDO2 closes the phishing path.

The week's tradecraft converged on abusing trusted primitives — OAuth tokens, signed binaries, native auth APIs and legitimate SaaS

Five otherwise-unrelated research disclosures this week point the same direction: capable actors — from a Chinese APT to commodity BEC and ransomware crews — are increasingly operating through trusted, native mechanisms rather than dropping signatureable custom malware. For a detection-engineering audience, that is the strategic note, because it tells you where the hunt surface is moving.

OAuth tokens as the target. Kaspersky GReAT documented Umbrij, a .NET tool the ToddyCat APT uses to automate theft of Google Workspace OAuth tokens via a technique GReAT calls Shadow Token via Remote Debug (STRD) — driving Chromium's remote-debugging interface to lift live tokens (Kaspersky Securelist, 2026-06-30). Cisco Talos exposed ARToken, an EvilTokens-lineage BEC-as-a-service panel (80+ API endpoints) automating Microsoft 365 device-code phishing, Primary-Refresh-Token persistence that survives password resets, and mailbox/SharePoint exfiltration (Cisco Talos). Both defeat password-centric defences: the credential is no longer the secret worth stealing, the token is.

Signed binaries and native APIs as the execution and validation layer. Blackpoint's Avalon framework chains a signed-binary MSBuild loader with ETW/AMSI patching (in-process telemetry tampering) and the CrownX ransomware payload (Blackpoint Cyber); Jamf's PamStealer impersonates the Maccy clipboard app and confirms a stolen macOS password through the native pam_authenticate API before exfiltrating it (Jamf Threat Labs) — using the OS's own auth path to guarantee the loot is valid.

Legitimate SaaS as C2. Mustang Panda (TA416 / HIVE0154) used Zoho WorkDrive as a dead-drop C2 channel (ZOHOMURK) against government and energy targets (Acronis TRU, 2026-06-29) — command traffic riding a trusted, hard-to-block SaaS host.

Weekly takeaway: the common defensive failure mode across all five is reliance on signatures and on the password as the crown jewel. The hunt has to move to anomalous use of the trusted mechanism — remote-debugging flags on browser processes, token issuance/reuse surviving resets, signed LOLBins loading unexpected code, ETW/AMSI tampering, native auth-API calls from non-auth processes, and server egress to consumer SaaS storage. Per-tool detail and detection concepts in § references.

Builds on: 2026-07-01/kaspersky-great-toddycat-s-umbrij-automates-gmail-workspace · 2026-07-02/cisco-talos-artoken-exposes-a-full-bec-as-a-service-toolkit · 2026-07-04/avalon-framework-msbuild-etw-loader-crownx-ransomware · 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · 2026-06-30/mustang-panda-abuses-zoho-workdrive-as-a-dead-drop-c2-channe

ESET Gamaredon 2025 — annual actor retrospective

Background. Gamaredon (FSB-linked, Russia-nexus) has been ESET's most-tracked Ukraine-focused operator for years; its prior annual papers documented a high-tempo, PowerShell-heavy toolset and aggressive infrastructure churn.

ESET's 2025 Gamaredon paper (covered 06-26) documents six new PowerShell tools and the wholesale migration of exfiltration and C2 onto trusted cloud services, tunnels and "workers" — the horizon implication for European public-sector defenders is detection-oriented: Gamaredon-class C2 increasingly hides inside legitimate cloud-service traffic (Cloudflare workers, Telegram, dead-drop resolvers), so network-indicator blocking degrades and behavioural detection on the endpoint and on anomalous cloud-service egress becomes the durable control.

ESET "Killing me gently" — a de-facto mid-year RaaS-tooling report

Background. The Gentlemen emerged in late 2025 as a RaaS operation founded by "hastalamuerte" (a former Qilin affiliate per Group-IB, previously affiliated with Embargo, LockBit, Medusa and BlackLock per PRODAFT). ESET first hypothesised an in-house EDR-killer in February 2026; Group-IB and Check Point independently corroborated before the gang's own internal data leaked. By April 2026 the group accounted for ~10% of global ransomware activity, and Krebs (06-10) linked the alias to a named individual in Izhevsk, Russia.

ESET's 06-26 deep-dive into the leaked internal data is the most substantive published-in-window documentation of RaaS tooling structure, and reads as a mid-year complement to the W25 Check Point State of Ransomware Q1 2026. Three structural findings a detection engineer should register: (1) GentleKiller is a modular in-house framework with at least eight BYOVD variants, each impersonating a different vendor and abusing a different kernel driver — driver allow-listing alone is insufficient without process-injection-chain detection; (2) the group integrates rival gangs' EDR killers (HexKiller from Warlock, ThrottleBlood shared with MedusaLocker/DragonForce, HavocKiller), so tooling overlap no longer implies operational overlap; (3) victims are selected centrally on FortiGate misconfiguration rather than geography, tying the Gentlemen victim pipeline directly to FortiBleed-style reconnaissance (§ 8). New BYOVD PoCs are operationalised within days of public release. (daily 06-27)

Swiss Post Cybersecurity — inaugural Swiss Threat Landscape Report

Swiss Post Cybersecurity published its first Swiss Threat Landscape Report at its Hack'Events conference (06-23), drawing on its own SOC, IR and offensive-security practice. For a Swiss public-sector SOC this is the most locally-grounded threat baseline of the week; the synthesis worth carrying beyond the daily's recap is that the report's emphasis on phishing, identity compromise and AI-abuse maps precisely onto the week's operational signal — the NCSC-CH M365 voicemail-phishing wave (§ 4), the Bluekit BitM and Klue OAuth identity attacks (§§ 2, 6), and AI-agent supply-chain abuse (§ 6). The local-vendor view and the week's incidents agree on where Swiss defenders should spend marginal effort: identity and the human layer, not perimeter CVEs alone.

The Gentlemen

The W25 multi-day item now has primary-evidence depth (the ESET deep-dive, § 7) and a sharp Swiss angle: Check Point data, reported by Swiss tech press, makes Switzerland the second-most-targeted European country for the operation, which now claims 478 victims and has added worm propagation. The operationally important link is that victim selection runs on FortiGate misconfiguration scanning — so a Swiss organisation's FortiBleed exposure (above) is also its Gentlemen-victim-selection exposure. Outstanding for defenders: the same FortiGate hardening that closes FortiBleed reduces Gentlemen targeting, and EDR-tamper-protection plus driver-blocklist enforcement is the GentleKiller counter.

FortiBleed

The W25 top story continued without a scale revision — the device count holds at the 86,644 figure the dailies reported — but the in-window development is the clearest state-interest signal yet: CISA updated its hardening alert on 06-22 to link Fortinet's revised guidance, and reporting now confirms that on in mid-June the Russian-speaking operator completed offline Kerberos-hash cracking from captured FortiGate configs and immediately exfiltrated DFS backup data from a NATO-aligned defence contractor — a full AD domain takeover (Security Affairs). Outstanding for defenders: treat any FortiGate admin/VPN credential active May–June 2026 as compromised, rotate, then hunt AD for pass-the-hash, DCSync and DFS-backup exfiltration (Kerberos ticket anomalies, LSASS access, ntdsutil/impacket artefacts). Patch level is irrelevant — this is credential reuse, not a new CVE.

FortiBleed status update — the FortiGate credential-theft campaign is now attributed to INC Ransom / Lynx, with a scaled-up victim count and an unconfirmed Nextcloud zero-day claim

UPDATE · originally covered FortiBleed (2026-06-29)

FortiBleed — the FortiGate credential-exposure campaign the prior two weeklies tracked from disclosure (86,644+ then 73,932+ exposed credentials) through the Golang "FortigateSniffer" tool (abusing FortiOS's native diagnose sniffer packet) and an AD-domain-takeover at a NATO-aligned defence contractor — gained a ransomware attribution and a scale revision this week.

Attribution to INC Ransom / Lynx. SOCRadar's Threat Research Unit published evidence tying FortiBleed's infrastructure directly to two active ransomware operations: an operator with access to FortiBleed infrastructure was found logged into the negotiation panels of both INC Ransom and Lynx (which SOCRadar assesses, per other researchers, to be an INC rebrand rather than a distinct group), and FortiBleed victim data overlaps victims on INC Ransom's leak site — the first direct evidence linking the mass FortiGate credential theft to a specific ransomware-deployment pipeline (SOCRadar STRU, 2026-07-01; BleepingComputer, 2026-07-01). STRU characterises the operation as an ~20-person Initial Access Broker business with a tiered internal structure exposed via an opsec lapse.

Scale revision. STRU reports scanning against ~11,250 FortiGate portals across 150+ countries, admin-level access confirmed on 409 targets, full domain compromise on 354, and at least 12 confirmed ransomware deployments to date — sharpening the risk picture from "credential exposure" to "credential exposure feeding an active RaaS deployment pipeline."

Unconfirmed Nextcloud zero-day (track, do not action). STRU further states the group possesses at least one undisclosed Nextcloud zero-day, with SOCRadar coordinating responsible disclosure. This is a single-source claim pending vendor confirmation and carries no CVE — but given Nextcloud's data-sovereignty-driven prevalence in Swiss and German public-sector and SME estates, it belongs on the watch list for an immediate patch once Nextcloud publishes. The durable defender action is unchanged: treat any FortiGate exposed in the May–June window as having leaked credentials, rotate, and hunt the sniffer technique. New registry entity this run: actor:inc-ransom (aliases INC Ransomware, Lynx).

ShinyHunters / UNC6240 Oracle campaign — status update: Nissan is the largest named victim, notifications keep landing, and a separate Medtronic claim surfaces

UPDATE · originally covered ShinyHunters / UNC6240 Oracle PeopleSoft campaign (2026-06-29)

the ShinyHunters/UNC6240 Oracle PeopleSoft campaign (CVE-2026-35273, unauthenticated RCE in PeopleTools Environment Management) kept acquiring named victims this week — the delta since the prior weekly's status.

Nissan is the largest named victim yet. SecurityWeek reported Nissan disclosed a breach tied to the Oracle PeopleSoft attacks, exposing current and former employee HR/payroll PII across four countries — a different exposure profile than the NAIC breach the W26 weekly led with (SecurityWeek, 2026-06-30; § references). It confirms the "still acquiring victims" throughline the W26 looking-ahead flagged, and that named victims now span beyond the education sector GTIG originally emphasised.

A separate Medtronic claim — attribution precision matters. Medtronic is notifying ~9 million people of a ShinyHunters-claimed breach of corporate IT systems from April 2026 (names, DOB, SSNs, health data), with medical devices reported unaffected (BleepingComputer, 2026-07-02; § references). This is a distinct incident from the PeopleSoft campaign — a corporate-IT breach the brand claimed, not tied to the Oracle zero-day path — and the weekly notes it to keep the ShinyHunters cluster's several concurrent operations from being conflated: the PeopleSoft ERP zero-day campaign is one line of effort; opportunistic corporate-IT data extortion under the same brand is another.

Status: GTIG's ~100-organisation notification set (68% higher education) is still landing, so more European education and public-finance victims are likely in the un-notified tail (Google GTIG). The separate, unattributed Oracle E-Business Suite RCE now exploited in the wild (this week's Oracle top story) compounds the message: internet-facing Oracle application tiers are a priority patch-and-isolate class regardless of which actor is behind any single CVE.

Builds on: 2026-07-01/nissan-is-the-largest-named-victim-yet-in-the-shinyhunters-o · 2026-07-03/medtronic-notifies-9-million-people-of-a-shinyhunters-claime

Operation Endgame

Europol's law-enforcement campaign extended its reach this week: the 06-24/25 Amadey and StealC takedown actioned 326 servers and 142 domains and recovered approximately 27 million stolen credentials from over 385,000 compromised systems (BleepingComputer), with Microsoft providing the Amadey/StealC infrastructure analysis (Microsoft). Combined with the W25 SocGholish/TA569 seizure (106 servers), Endgame has now dismantled three commodity delivery-and-theft networks in quick succession. The defender gap: no arrests were announced for this phase, so infrastructure can reconstitute — cross-reference the recovered 27M credentials against your identity-store canaries and hunt Amadey persistence (HKCU run-key, rundll32/regsvr32 side-loads, short-lived child processes under %AppData%\Roaming).

ShinyHunters / UNC6240 Oracle PeopleSoft campaign

The campaign behind the § 1 NAIC breach. GTIG/Mandiant attributes to UNC6240 an active zero-day exploitation of Oracle PeopleSoft (CVE-2026-35273) between May 27 and June 9, predating Oracle's advisory; staging environments deployed customised MeshCentral agents masquerading as cloud endpoints, then ran a per-victim [victim]_fanout.sh lateral-movement-and-defacement script (Google GTIG). ~300 PeopleSoft instances compromised, ~100 organisations notified, 68% higher education, with the University of Nottingham among the first named public victims (SecurityWeek). The status this week: NAIC confirmed (§ 1), and notifications are still landing, so more European education and public-finance victims are likely. The weekly lens: this is ShinyHunters operating as a zero-day-capable ERP attacker — a capability shift from the brand's 2021–2024 credential-stuffing persona. Outstanding question: which EU universities running PeopleSoft are in the un-notified tail.

Netherlands NIS2 (Cyberbeveiligingswet) clears the lower house — entry into force targeted for 1 July 2026

The Dutch transposition is in its final step: the Tweede Kamer (lower house) approved the Cyberbeveiligingswet on 15 April 2026 (Rijksoverheid), with the Eerste Kamer (upper-house) ratification vote still pending in late June and the government targeting 1 July 2026 for entry into force. NCSC-NL is the designated supervisor; the regime runs a three-step 24h / 72h / one-month incident-notification protocol, essential-entity penalties up to €10M or 2% of turnover, and personal board liability for security-measure oversight (NL Digital Government). This is the fresh delta on the W25 NIS2-transposition item, which listed the Netherlands as pending; France, Ireland, Luxembourg and Spain remain non-transposed. What changes for defenders: any essential/important entity with Dutch operations or Dutch counterparties is about to face an enforceable notification clock and a named supervisor — wire NCSC-NL's 24/72-hour flow into the incident-response runbook now, and re-check which group entities fall in scope.

Netherlands NIS2 transposition slips past its 1 July target — Senate vote set for 7 July, entry into force now 15 August 2026

UPDATE · originally covered Netherlands NIS2 (Cyberbeveiligingswet) clears the lower house — entry into force targeted for 1 July 2026 (2026-06-29)

the Dutch NIS2 transposition — the Cyberbeveiligingswet (Cbw) plus the companion Wet weerbaarheid kritieke entiteiten — has missed the 1 July 2026 entry-into-force target the prior weekly reported as the government's goal.

The Eerste Kamer (Senate) tabled its government response to the second committee report ("nota naar aanleiding van het tweede verslag") on 29 June 2026 — the last written-preparation step before plenary debate — and the Senate's own bill-tracking page now states the floor vote will take place on 7 July 2026, noting the bill was adopted by the Tweede Kamer on 15 April 2026 (Eerste Kamer, bill 36764). iBestuur reports the government's revised entry-into-force target is now 15 August 2026, roughly six weeks later than previously communicated (iBestuur, 2026-07-01).

The substantive scope is unchanged from prior coverage: NCSC-NL as designated supervisor, a three-step 24h/72h/one-month incident-notification protocol, essential-entity fines up to EUR 10M or 2% of global turnover, personal board liability for security-measure oversight, and an expansion of in-scope Dutch entities from roughly 1,000 to roughly 8,000. This is the fourth documented slip in the Dutch NIS2 timetable (originally targeted Q3 2025).

EU Cyber Resilience Act — 75 days to the 11 September vulnerability/incident-reporting obligation

CRA Article 28 (conformity-body notification) entered force on 11 June 2026; the next binding milestone — mandatory vulnerability/incident reporting by manufacturers to ENISA's Single Reporting Platform — activates 11 September 2026, now ~75 days out (ENISA SRP). ENISA has not yet published a dry-run schedule, stating guidance is due June–August (Crowell & Moring). For Swiss readers the practical action is procurement-side: Swiss manufacturers selling digital products into the EU fall in scope, and Swiss public-sector procurement teams should add CRA compliance attestations to vendor specs and confirm in-scope suppliers can meet the 24/72-hour SRP reporting flow before it binds.

EU Commission proposes a major Europol / Eurojust mandate expansion

On 24 June the Commission tabled COM(2026) 580 proposing to expand Europol and Eurojust: automated, near-real-time national-police-to-Europol data upload via a new "Police Shared Data Space" cloud, Europol Support Offices embedded in Member-State agencies, an explicit Eurojust cybercrime mandate, and a roughly doubled (~€3bn) budget, with cybercrime and AI-accelerated threats cited as primary drivers (European Commission). The Protect Not Surveil coalition warns of systematic data ingestion without categorisation safeguards. This is co-decision and unlikely to bind before 2027+, but public-sector CISOs in EU Member States should track it now: it reshapes how incident and victim data may flow to Europol, with data-protection and onward-sharing implications for breach reporting.

Looking ahead — 2026-W27

Items already in motion — sourced developments a defender should expect to act on in the coming weeks, not forecasts:

• Adobe ColdFusion — six CVSS 10.0 unauth RCEs awaiting weaponisation. APSB26-68 fixed six maximum-severity RCE paths (file-upload, input-validation, path-traversal), all Adobe Priority 1, with no known exploitation yet (Adobe PSIRT, 2026-06-30). ColdFusion's history is rapid weaponisation of unauth file-upload primitives — patch internet-facing instances before a PoC lands (§ references).
• Citrix NetScaler CVE-2026-8451 — public test artefact, siblings exploited within days. A "Detection Artefact Generator" is public and CitrixBleed-lineage siblings have been exploited within days of disclosure; treat exploitation as a matter of time (§ references).
• WatchGuard Firebox 12.5.x — fix still pending. The pre-auth iked RCE (CVE-2026-13368) has no fix for the 12.5.x branch and 11.x is EOL; a build is expected — until it ships, the LDAP-backed IKEv2 path must be removed, not waited on (WatchGuard PSIRT, 2026-07-02).
• Dutch NIS2 — Senate vote 7 July, entry into force 15 August 2026. The Eerste Kamer floor vote is scheduled for 7 July with a revised entry-into-force target of 15 August (Eerste Kamer, bill 36764); organisations with Dutch nexus should re-anchor readiness milestones (this week's policy entry).
• ShinyHunters Oracle PeopleSoft — un-notified victim tail. GTIG's ~100-organisation notification set is still landing (68% higher education); more European education and public-finance named victims are likely (this week's long-running status; § references).
• FortiBleed-actor Nextcloud zero-day — pending vendor disclosure. SOCRadar states the INC/Lynx-linked FortiBleed operator holds an undisclosed Nextcloud zero-day, coordination in progress. Single-source and unconfirmed — but given Nextcloud's Swiss/German public-sector prevalence, be ready to prioritise a patch the moment Nextcloud publishes (this week's FortiBleed status entry).

Builds on: 2026-07-02/cve-2026-48276-48277-48281-48282-48283-48316-adobe-coldfusio · 2026-07-01/cve-2026-8451-citrix-netscaler-adc-gateway-pre-auth-saml-mem · 2026-07-03/cve-2026-13368-watchguard-fireware-iked-pre-auth-rce · 2026-07-01/nissan-is-the-largest-named-victim-yet-in-the-shinyhunters-o

Looking ahead — 2026-W26

A focused, justified list — items already in motion, not predictions.

• ShinyHunters PeopleSoft notifications are still landing — expect more named European education and public-finance victims. GTIG has notified ~100 organisations (68% higher education) and NAIC is the fresh high-profile case; patch internet-reachable PeopleSoft and hunt /PSEMHUB/ and /PSIGW/HttpListeningConnector. (Google GTIG; daily 06-28)
• FortiBleed is not a one-and-done credential reset — full AD domain takeover is now confirmed at a NATO-aligned contractor. Finish session termination and credential rotation, then hunt for post-compromise AD persistence (Kerberos abuse, DCSync, DFS-backup exfiltration) rather than assuming the reset closed it. (CISA; daily 06-24)
• The Klue/Icarus extortion surface is multiplying after the "resolution" — a second group is now extorting ~195 listed organisations. Any firm with a Klue/Salesforce integration should expect renewed extortion contact regardless of Icarus's stated data deletion; complete OAuth-grant revocation and CRM-egress monitoring. (SecurityWeek; daily 06-27)
• CRA Single Reporting Platform go-live is ~75 days out (11 September); ENISA's dry-run schedule is due now. In-scope manufacturers — including Swiss exporters to the EU — should register and wire the 24/72-hour reporting flow into their PSIRT process before the obligation binds. (ENISA SRP)
• EDPB Article 33 harmonised breach-notification template consultation closes 5 August. Still open with no in-window change; multi-jurisdiction breach-response owners have a closing window to comment before the EDPB sets a mandatory-adoption timeline. (EDPB)
• npm v12 will disable install scripts by default — the week's Miasma worm wave is the reminder to audit CI now. Miasma's postinstall-and-SessionStart-hook propagation is exactly the kill chain --ignore-scripts / npm v12 defaults neutralise; inventory pipelines and AI-coding-tool hook configs that rely on build scripts. (Socket; daily 06-27)
• libssh2 CVE-2026-55200 has a public PoC and an upstream fix commit, but tagged releases lag across the binding ecosystem — track the embedded-dependency fix pipeline. Inventory appliances, tooling and language bindings that ship libssh2 and chase each vendor's release rather than assuming a single library bump closes it. (NCSC-NL; daily 06-28)
• Scattered Spider TfL sentencing is set for 16 July. First UK court outcome on the campaign; the vishing/social-engineering TTP precedent is directly relevant to European transport and public-sector identity-desk hardening. (UK NCA; daily 06-23)