Published Wednesday, June 24, 2026 at 09:01 AM PT
24 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE — LOS ANGELES
BLUF: Active exploitation of Oracle PeopleSoft 0-day (ShinyHunters, 100+ orgs confirmed) and Cisco Unified CM critical flaw running concurrently with elevated internal host anomalies — treat as potential active intrusion until ruled out.
CYBER
Oracle PeopleSoft 0-day exploited by ShinyHunters threat actor; 100+ organizations confirmed breached; scope and CVE identifier not yet fully disclosed; patch status unknown — assess as critical if PeopleSoft is in environment. [The Register Security] [HIGH CONFIDENCE]
Cisco Unified CM critical vulnerability (file-write path to root) under active exploitation weeks post-patch; PoC publicly available accelerated attacker adoption; CISA KEV catalog updated. [The Hacker News, CISA Current Activity] [HIGH CONFIDENCE] — IMMEDIATE ACTION: Verify patch status on all UCM nodes.
CISA issued hardening advisory for Fortinet devices following credential exposure reports; updated 22 JUN; PBKDF2 hash enforcement for admin accounts flagged as required mitigation. [CISA Current Activity] [HIGH CONFIDENCE] — IMMEDIATE ACTION: Audit FortiGate admin account hash configurations.
Cordyceps CI/CD vulnerability chain exposes 300+ GitHub repositories to supply-chain hijacking; unauthenticated attackers can take control of open-source pipelines; millions of downstream repositories at risk. [The Hacker News, SecurityWeek] [HIGH CONFIDENCE] — Review all GitHub Actions workflows and third-party CI/CD integrations.
Klue-Salesforce breach confirmed impacting BeyondTrust and LastPass customer data; 12+ Klue customers affected; scope of credential or secret exposure not yet quantified. [SecurityWeek] [MODERATE CONFIDENCE] — If either vendor is in your IAM or secrets management stack, treat as compromised until vendor confirms otherwise.
Mistic RAT (initial access broker Woodgnat/KongTuke) actively deployed as ransomware precursor; linked to Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta; JavaScript-driven PureLogs infostealer variant deployed via phishing in parallel campaign. [SecurityWeek, BleepingComputer, Fortinet FortiGuard] [HIGH CONFIDENCE]
Malicious AI agent skill bypassed marketplace security checks; reached 26,000 users via Instagram; redirected agents to attacker-controlled domain (stitch-design.ai vs. legitimate stitch.withgoogle.com); typosquatting vector now confirmed viable in agentic AI supply chain. [CSO Online] [HIGH CONFIDENCE]
netdna-ssl.com flagged in CSP violation reports appearing in WordPress environments where it should not; domain presence in Content Security Policy reports may indicate injected third-party script or compromised CDN reference. [Scott Helme / Report URI] [MODERATE CONFIDENCE] — Audit CSP reports if WordPress is in stack.
Microsoft with law enforcement disrupted 200+ C2 servers for Amadey and StealC in first simultaneous dual-tool court takedown; disruption is partial — variants and rebuilt infrastructure expected within days. [CyberScoop] [HIGH CONFIDENCE]
INTERNAL POSTURE ALERT
- Elevated internal security activity detected: multiple hosts showing promiscuous network mode activation and port changes; high-severity events logged; active incidents under investigation.
- Promiscuous mode activation is consistent with: (a) network sniffing/credential harvesting tool deployment, (b) lateral movement reconnaissance, (c) misconfigured monitoring agent — cannot distinguish without further forensics.
- Concurrent timing with active ShinyHunters PeopleSoft campaign and Mistic RAT deployment cycle elevates concern above routine noise threshold.
- PRIORITY ACTION: Isolate affected hosts pending forensic triage; capture full packet data from promiscuous interfaces; cross-reference process list against known Mistic/PureLogs/StealC IOCs; verify no Cisco UCM or Fortinet devices are unpatched in environment.
MILITARY / GEOPOLITICAL
Iran-US negotiations ongoing; contradictory statements issued by both sides as of this week; diplomatic channel remains open but fragile. [Just Security] [MODERATE CONFIDENCE] — No direct infrastructure threat vector at this time; monitor for retaliatory cyber posture shifts if talks collapse.
WTOP analysis characterizes current NATO transition as most dangerous since Cold War; specific triggers not detailed in available feed excerpt. [WTOP National Security] [LOW CONFIDENCE on specifics]
Exercise Valiant Shield 2026 underway; MQ-28 Ghost Bat (Australian loyal wingman UAS) integrated into flight operations for TTP development and force contribution evaluation — first operational exercise integration. [The Aviationist] [HIGH CONFIDENCE]
US Army awarded Lockheed Martin $8.4B PrSM production contract through 2032; signals long-range precision strike prioritization for Pacific theater. [Defence Blog] [HIGH CONFIDENCE]
Poland accelerating military procurement: V-BAT surveillance drones ($16M, Shield AI), 46,000 GROT A3 rifles ($160M), Revision Military assembly operations established in-country — NATO eastern flank buildup continues. [Defence Blog, Soldier Systems] [HIGH CONFIDENCE]
Sierra Nevada MAAWLR air defense launcher destroyed in Kharkiv region by Russian FPV drone; loss of US-supplied system on record. [Defence Blog] [HIGH CONFIDENCE]
SecDef visited NSA Bahrain; context of Yemen operations implied. [USCENTCOM] [HIGH CONFIDENCE]
PHYSICAL / LOCAL (SOUTHERN CALIFORNIA)
NOSIG — No significant physical security events in Southern California region identified in ingested feeds within the last 24 hours.
NUCLEAR / WMD
NOSIG — No IAEA reporting, test activity, or WMD-relevant developments in ingested feeds.
ASSESSMENT
The convergence of two actively-exploited critical vulnerabilities (Oracle PeopleSoft 0-day, Cisco UCM file-write-to-root) with a confirmed internal host anomaly pattern — specifically promiscuous mode activation across multiple systems — constitutes a credible active intrusion scenario that cannot be dismissed as coincidence without forensic evidence to the contrary. The Klue-Salesforce breach affecting BeyondTrust and LastPass introduces a secondary risk vector: if either product touches your secrets management or privileged access layer, assume credential exposure until vendor attestation is received. The Cordyceps CI/CD finding is the highest-severity supply chain risk of the week for any organization running GitHub-hosted pipelines; unauthenticated exploitation of build infrastructure is a force-multiplier for any threat actor already inside a network perimeter.
END OF BRIEF — 24 JUN 2026