Table of Contents
Security Weekly: 2026 Week 24
Coverage Period: June 8 – June 14, 2026
This was arguably the most intense week in cybersecurity for 2026. Microsoft shipped its largest Patch Tuesday in history with 206 CVEs; a Check Point VPN zero-day was exploited by a Qilin ransomware affiliate; an Oracle PeopleSoft zero-day impacted over 100 organizations globally; Ivanti Sentry received a CVSS 10.0 score triggering a CISA 3-day emergency patch mandate; Microsoft’s GitHub suffered a Miasma worm supply chain attack across 73 repositories; and the adversarial researcher Nightmare Eclipse dropped two more Windows zero-days. Below is a comprehensive roundup.
Key Security Highlights
- Microsoft ships largest Patch Tuesday ever — 206 CVEs, 3 actively exploited, multiple publicly disclosed zero-days
- Check Point VPN CVE-2026-50751 (CVSS 9.3) zero-day exploited by Qilin ransomware affiliate since early May
- Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) zero-day impacts 100+ organizations, 68% in higher education
- Ivanti Sentry CVE-2026-10520 (CVSS 10.0) triggers CISA emergency directive — federal agencies ordered to patch within 3 days
- Adversarial researcher Nightmare Eclipse drops two Windows zero-days (Defender EoP + BitLocker bypass)
- Microsoft GitHub 73 repos disabled after Miasma worm supply chain attack targeting AI coding tools
- Google Chrome patches 72 vulnerabilities, including 5th actively exploited V8 zero-day CVE-2026-11645
- Solana FakeFix campaign: 20+ malicious npm/PyPI packages impersonating Solana developer tooling
- HarborWatch Agent phishing campaign uses fake Amazon security alerts to deploy custom RAT
Major Vulnerabilities
Microsoft’s Record-Breaking Patch Tuesday: 206 CVEs
On June 9, Microsoft released its largest security update in history, addressing 206 vulnerabilities — shattering the previous record of 177. Microsoft acknowledged that AI-assisted vulnerability discovery (fuzzing, static analysis, variant hunting) is the primary driver of the surge and warned that large Patch Tuesdays are “the new normal.”
Actively Exploited and Publicly Disclosed Zero-Days
| CVE | Vulnerability | CVSS | Status |
|---|---|---|---|
| CVE-2026-45657 | Windows TCP/IP Stack UaF | 9.8 | Unauthenticated, no-user-interaction RCE; self-propagating potential |
| CVE-2026-45586 | CTFMON EoP (GreenPlasma) | 7.8 | Local EoP to SYSTEM; disclosed earlier by Nightmare Eclipse; now patched |
| CVE-2026-42897 | Exchange Server OWA XSS | High | Actively exploited; now patched |
| CVE-2026-49160 | HTTP.sys DoS (HTTP/2 Bomb) | High | Denial of service via HTTP/2 |
| CVE-2026-47291 | HTTP.sys RCE | 9.8 | “Exploitation more likely” per Microsoft |
Additional notable fixes include CVE-2026-44815 (DHCP Client buffer overflow, CVSS 9.8) and CVE-2026-42985 (Remote Desktop Client RCE).
Note: While 6 earlier Nightmare Eclipse zero-days were patched in this release, the newly disclosed RoguePlanet and GreatXML (June 10–11) remain unpatched.
Check Point VPN Zero-Day (CVE-2026-50751) Exploited by Qilin Ransomware
On June 8, Check Point disclosed CVE-2026-50751 (CVSS 9.3), an authentication bypass affecting Remote Access VPN and Mobile Access deployments using the deprecated IKEv1 protocol.
Key Details:
- Logic flaw in IKEv1 certificate validation allows unauthenticated VPN session establishment
- Exploitation traced back to May 7 — attackers had a full month head start before the patch
- At least one incident linked to a Qilin ransomware affiliate
- Attackers used VPS infrastructure (Kaupo Cloud HK, Shock Hosting, Vultr) geolocated near victims
- Second related flaw CVE-2026-50752 (CVSS 7.4, MITM risk) also disclosed
- CISA added to KEV catalog; federal agencies ordered to patch by June 11
Mitigation: Apply hotfix immediately, or disable IKEv1 in favor of IKEv2 with mandatory machine certificate authentication.
Oracle PeopleSoft Zero-Day (CVE-2026-35273) Impacts 100+ Organizations
On June 10, Oracle released an out-of-band emergency advisory for CVE-2026-35273 (CVSS 9.8), an unauthenticated RCE via SSRF affecting PeopleSoft Enterprise PeopleTools 8.61/8.62 Environment Management Hub (PSEMHUB).
| Detail | Value |
|---|---|
| Threat Actor | ShinyHunters (UNC6240) |
| Exploitation Window | May 27 – June 9 |
| Victim Count | ~100 organizations, 300+ endpoints |
| Education Sector | 68% |
| Largest Data Theft | 48 GB from a single victim |
| Confirmed Victim | University of Nottingham (~455K records, including passport numbers) |
Attackers deployed MeshCentral remote management agents masquerading as Microsoft Azure services (C2 domain azurenetfiles.net) and left ransom notes (README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT) on compromised systems. Google Mandiant and GTIG confirmed in-the-wild exploitation on June 11.
Ivanti Sentry CVSS 10.0 (CVE-2026-10520) Triggers CISA 3-Day Emergency Directive
On June 10–12, Ivanti disclosed CVE-2026-10520 — an OS command injection in Ivanti Sentry security gateways rated at the maximum CVSS 10.0 severity. It allows unauthenticated, remote root-level code execution.
| Detail | Value |
|---|---|
| Severity | Critical (CVSS 10.0) |
| Affected | Sentry ≤ 10.5.1, ≤ 10.6.1, ≤ 10.7.0 |
| CISA Response | KEV addition June 12; federal agencies must patch by June 14 |
| Exploitation | Shadowserver confirmed at least 2 exposed instances already backdoored |
A companion flaw, CVE-2026-10523 (CVSS 9.9), allows unauthenticated creation of arbitrary admin accounts. watchTowr Labs released a PoC exploit on June 11. Patch immediately to 10.5.2 / 10.6.2 / 10.7.1 and never expose the management interface to the internet.
Nightmare Eclipse Drops Two More Windows Zero-Days
The adversarial researcher operating as “Nightmare Eclipse” (aka Chaotic Eclipse / MSNightmare) released two more Windows zero-days this week — their 7th and 8th since April 2026:
| Exploit | Date | Impact | Status |
|---|---|---|---|
| RoguePlanet | June 10 | Exploits Microsoft Defender race condition (TOCTOU) for SYSTEM-level arbitrary code execution | Unpatched — confirmed working on fully-patched Win10/11 with June updates |
| GreatXML | June 11 | Claimed BitLocker bypass (including TPM devices) via malicious XML files on WinRE partition | Disputed — independent researcher Will Dormann was unable to reproduce across multiple tests |
The researcher claims to be a former Microsoft employee in a public standoff over deleted accounts and unpaid bounties. RoguePlanet demands urgent attention; GreatXML’s effectiveness remains unproven but is taken seriously given the researcher’s track record.
Google Chrome Patches 72 Vulnerabilities, Including 5th Active Zero-Day
On June 8, Google released Chrome v149.0.7827.102/.103, fixing 72 security flaws (17 rated critical), including:
- CVE-2026-11645 (CVSS 8.8): Out-of-bounds read/write in the V8 JavaScript engine, RCE within the browser sandbox via a crafted HTML page
- Reported April 27 by anonymous researcher
303f06e3; $55,000 bug bounty awarded - 5th actively exploited Chrome zero-day of 2026
- CISA added to KEV on June 9; federal remediation deadline: June 23
HP Poly Conference Phones RCE (CVE-2026-0826)
In early June, Rapid7 disclosed CVE-2026-0826 (CVSS 9.2) affecting HP Poly VVX 150/250/350/450 and Trio 8300/8500/8800 conference phones:
- Unauthenticated stack-based buffer overflow in SIP INVITE parsing (ICE/SDP)
- Root-level RCE via UDP port 5060
- Immediate firmware upgrade recommended
Arista EOS CVE-2026-7473: KEV Listed, No Patch Planned
On June 9, CISA added CVE-2026-7473 (CVSS 6.9) to its KEV catalog, affecting Arista 7020R/7280R/7500R series switches. The incomplete tunnel protocol verification flaw enables unauthorized traffic decapsulation.
Notably, Arista announced no patch is planned, citing risk of breaking existing configurations. Only ACL-based mitigations are offered — a rare “no-fix” stance for a KEV-listed vulnerability.
Threat Intelligence
Microsoft GitHub Miasma Worm Supply Chain Attack: 73 Repos Disabled
On June 5 (widely reported June 8), GitHub disabled 73 repositories across 4 Microsoft organizations (Azure, Azure-Samples, Microsoft, MicrosoftDocs) within 105 seconds. The attack was carried out by cybercrime group TeamPCP using Miasma, a Shai-Hulud worm variant.
New Attack Vector — AI Coding Tools: When developers opened an infected repository in any of the following tools, malicious configuration files automatically executed and harvested credentials:
| Tool | Exploitation Mechanism |
|---|---|
| Claude Code | SessionStart hook in .claude/settings.json |
| Gemini CLI | SessionStart hook in .gemini/settings.json |
| Cursor | Prompt injection in .cursor/rules/setup.mdc |
| VS Code | runOn: folderOpen in .vscode/tasks.json |
Entry Point: A previously compromised contributor account pushed a malicious commit to Azure/durabletask — the same repository that had been breached via PyPI on May 19. Credentials from the first breach were never fully rotated.
Affected projects include Azure tools and AI coding tool integrations. Microsoft notified a “small number” of customers who may have downloaded affected code.
HarborWatch Agent: Fake Amazon Security Alerts Deploy Custom RAT
On June 8, Cofense disclosed the HarborWatch Agent phishing campaign:
- Fake Amazon security alert emails direct victims to typosquatted domains
- Uses ClickFix technique (fake CAPTCHA verification page) to trick users into executing PowerShell commands
- Deploys HarborWatch Agent, a custom remote access trojan
- Chinese-language admin panel branded “Harbor Sentinel”
C0XMO: IoT Botnet with “Competitor-Killing” Capability
On June 8–9, FortiGuard Labs published detailed analysis of C0XMO, a new Gafgyt/BASHLITE variant:
- Initial access via DD-WRT router CVE-2021-27137 (CVSS 9.8)
- Targets 6 architectures (ARM, MIPS, PowerPC, SuperH, x86, x86_64)
- “Competitor-Killing”: Actively terminates rival botnet processes and removes their persistence mechanisms
- Multi-vector propagation exploiting 7+ CVEs plus Telnet/SSH brute-force and ADB
- 19 DDoS attack methods
Supply Chain & Ecosystem Security
This week saw a sharp escalation in supply chain threats across three fronts:
1. Microsoft GitHub Miasma Worm
Attackers systematically weaponized AI coding tools’ auto-configuration execution features (Claude Code, Gemini CLI, Cursor, VS Code) as malware delivery vectors. Supply chain attacks have expanded from “dependency poisoning” to “developer environment compromise.”
2. Solana FakeFix: Targeted Developer Tooling Poisoning
On June 11, JFrog disclosed a campaign targeting the Solana ecosystem:
- 20+ malicious npm/PyPI packages impersonating official Solana tools (
@solana-labs/web3.js,solana-web3-stable, etc.) - Promoted via GitHub issue spam
- Stole wallet private keys, cloud credentials, SSH keys, and tokens
- Later iterations evolved to include full Telegram-controlled backdoors
3. Oracle PeopleSoft — Education Sector Soft Target
ShinyHunters’ systematic targeting of educational institutions (68% of victims) highlights the vulnerability of university IT infrastructure to enterprise software supply chain attacks.
Cybercrime & Data Breaches
University of Nottingham (Confirmed This Week)
Through the Oracle PeopleSoft zero-day, approximately 455,000 records from the University of Nottingham were exfiltrated and published on ShinyHunters’ data leak site. Exposed data includes student and alumni email addresses, passport numbers, and other highly sensitive personal information. The email addresses have been added to Have I Been Pwned.
ShinyHunters Extortion Wave Continues
While the Carnival (~6 million customers) and Charter Communications (~5 million customers) breaches were disclosed in late May/early June, ShinyHunters remained the dominant threat actor this week due to the Oracle PeopleSoft zero-day campaign. The group’s pattern of combining social engineering (vishing) for initial access with zero-day exploitation for scaling is a significant concern for enterprise defenders.
Weekly Threat Trends
1. AI-Driven Vulnerability Discovery Is Reshaping Security
Microsoft acknowledged AI-assisted vulnerability hunting as the primary driver of the record Patch Tuesday volume. Both defenders and attackers are leveraging AI to accelerate vulnerability discovery and weaponization.
2. VPN and Perimeter Devices Are Prime Targets
Check Point VPN (IKEv1), Ivanti Sentry (OS command injection) — perimeter security devices remain the focal point of zero-day attacks. VPN appliances in particular offer high-value access to internal networks once compromised.
3. Ransomware and Zero-Days Are Deeply Converged
Qilin exploiting Check Point, ShinyHunters exploiting Oracle — ransomware groups now have the capability to rapidly weaponize zero-days. The patching window has compressed from “weeks” to “hours.”
4. Supply Chain Attacks Enter the “AI Tools” Era
The Miasma worm represents the first large-scale exploitation of AI coding tools’ auto-configuration features as an attack vector. The supply chain security perimeter has expanded from “dependency packages” to “every developer’s local toolchain.”
5. Adversarial Disclosure Challenges Traditional CVD
Nightmare Eclipse’s 7th and 8th zero-day releases signal a growing adversarial posture between independent researchers and vendors, challenging traditional Coordinated Vulnerability Disclosure mechanisms.
Security Recommendations
Organizations should immediately:
- Deploy Microsoft June patches, prioritizing CVE-2026-45657 (TCP/IP stack RCE, CVSS 9.8) and CVE-2026-45586 (CTFMON EoP)
- Patch Check Point VPN or disable IKEv1; enforce IKEv2 with mandatory machine certificates
- Update Ivanti Sentry to 10.5.2 / 10.6.2 / 10.7.1; never expose the management interface to the internet
- Patch Oracle PeopleSoft or temporarily disable EMHub service
- Update Google Chrome to v149.0.7827.102 or later
- Audit AI coding tool configurations (
.claude/settings.json,.gemini/settings.json,.cursor/rules/,.vscode/tasks.json) for unauthorized auto-execution hooks - Audit GitHub project dependencies for any reliance on compromised Microsoft open-source repos
- Enhance VPN and perimeter device monitoring, focusing on anomalous authentication and off-hours connections
- Review and rotate cloud API keys, CI/CD tokens, and developer credentials
- Deploy EDR / XDR to detect privilege escalation and anomalous process activity
- Establish emergency patching procedures to remediate critical vulnerabilities within 24–72 hours
- Monitor for RoguePlanet exploitation: watch for anomalous SYSTEM-level processes related to Microsoft Defender until an official patch is released
Conclusion
Week 24 of 2026 was the most threat-dense week of the year. Microsoft’s record 206 CVE Patch Tuesday, simultaneous in-the-wild zero-days across Check Point, Oracle, and Ivanti, and the first large-scale supply chain attack weaponizing AI coding tools collectively paint a new threat landscape: attackers are leveraging AI to accelerate weaponization, the patching window has shrunk from weeks to hours, and the supply chain attack surface has expanded from code dependencies to every developer’s local toolchain. Organizations must build more agile vulnerability management and defense-in-depth architectures to maintain security posture in this “new normal.”