06 JUN 2026 | CLASSIFICATION: UNCLASSIFIED//FOR INTERNAL USE
BLUF: Simultaneous supply chain worm campaigns against GitHub and npm, an unpatched Cisco SD-WAN RCE under active exploitation, and a PAN-OS zero-day in active exploitation collectively represent the highest-density threat window for production infrastructure observed this quarter.
CYBER
CRITICAL — NO PATCH: Cisco Catalyst SD-WAN Manager CVE-2026-20245 confirmed under active exploitation; no patch available as of 06 JUN. Attack surface includes any internet-reachable SD-WAN Manager instance. Isolate management plane from public internet immediately. [The Hacker News] [HIGH CONFIDENCE]
CRITICAL — ACTIVE EXPLOITATION: PAN-OS CVE-2026-0257 under active exploitation per Unit42 threat brief published 06 JUN. IOCs and mitigations published. Patch or apply workaround per vendor guidance; treat any unpatched perimeter PAN-OS device as potentially compromised. [Unit42] [HIGH CONFIDENCE]
SUPPLY CHAIN — ACTIVE: “Miasma” worm confirmed hitting 73 Microsoft GitHub repositories. Variant also identified in npm ecosystem alongside separate “IronWorm” campaign. Both propagate via repository/package poisoning. Audit all CI/CD pipelines pulling from affected namespaces; treat any GitHub Actions workflow secrets as potentially exposed. [The Hacker News] [HIGH CONFIDENCE]
SUPPLY CHAIN — ACTIVE: Microsoft Threat Intelligence identified a prompt injection pathway in the Claude Code GitHub Action allowing access to workflow secrets. Agentic CI/CD pipelines using this action should be treated as compromised pending audit. [Microsoft Security] [HIGH CONFIDENCE]
KEV ADDITION: CISA added SolarWinds Serv-U DoS flaw to Known Exploited Vulnerabilities catalog 06 JUN. Exploitation confirmed in the wild; attackers using it to crash managed file transfer servers. Federal deadline applies; treat as priority-1 patch for any Serv-U deployment. [CISA, BleepingComputer] [HIGH CONFIDENCE]
ZERO-DAYS — PATCH NOW: AI-assisted research uncovered 21 zero-days in FFmpeg. If your stack ingests user-supplied media through FFmpeg (transcoding pipelines, streaming infrastructure, video processing), treat as unpatched attack surface until vendor advisories confirm remediation status. Chrome patched 429 bugs in same cycle — force-update all browser fleet. [The Hacker News] [MODERATE CONFIDENCE on FFmpeg patch timeline]
AWS: CVE-2026-11400 and CVE-2026-11401 flagged “Important” by AWS Security Bulletins (Bulletin 2026-039-AWS, published 06 JUN). Full description truncated in feed; review AWS Security Bulletins directly for scope and affected services. [AWS Security Bulletins] [HIGH CONFIDENCE — details pending]
IIS TARGETING: New threat cluster OP-512 deploying custom web shell framework against Microsoft IIS servers. If you operate IIS-fronted services, audit for anomalous ASPX files and outbound connections from w3wp.exe. [The Hacker News] [MODERATE CONFIDENCE]
POLYFILL RESURFACES: Suspicious login prompts attributed to Polyfill infrastructure appearing on Toshiba and Muji web properties. Polyfill supply chain compromise (2024) still generating downstream incidents. Audit any third-party JS dependencies for polyfill.io references. [BleepingComputer] [HIGH CONFIDENCE]
BROWSER AS ATTACK SURFACE: 2026 Verizon DBIR confirms browser-based attacks now primary initial access vector. Session hijacking, malicious extensions, and credential theft via browser dominate incident patterns. Enforce browser isolation or at minimum MV3 extension policy across engineering fleet. [BleepingComputer] [HIGH CONFIDENCE]
OPEN SOURCE RCE: Rapid7/Metasploit modules landed this week for Apache RCE and Gogs RCE (branch naming injection via
--exec <command>on rebase). If running self-hosted Gogs for internal git, patch or disable rebase operations. [Rapid7] [HIGH CONFIDENCE]
MILITARY / GEOPOLITICAL
APT PERSISTENCE: Chinese APT deploying new malware family specifically designed to maintain persistent access to previously compromised networks post-detection. Suggests adversary anticipates eviction and is pre-positioning for re-entry. Relevant to any org that disclosed a Chinese intrusion in the past 18 months. [BleepingComputer] [HIGH CONFIDENCE]
LINKEDIN THREAT: FBI and MI5 issued joint warning: Chinese intelligence operatives actively using LinkedIn recruiter personas to target US/UK nationals with access to sensitive systems or IP. Relevant to engineering staff with public infrastructure roles. Do not accept unsolicited connection requests from unverified recruiters claiming defense/tech sector roles. [Graham Cluley, FBI, MI5] [HIGH CONFIDENCE]
LAW FIRM TARGETING: Mandiant tracking ongoing campaign (UNC3753 possibly linked) against US law firms. Threat actors exfiltrating M&A agreements, PII, and financial records for extortion. If your org uses outside counsel for M&A or IP matters, assess whether those firms are adequately segmented from your data. [Mandiant] [HIGH CONFIDENCE]
SMART TV PROXY NETWORK: Free TV apps converting consumer smart TVs into web-scraping proxy nodes for AI data collection operations. Relevant to any corporate environment where personal devices share network segments with production systems. [The Hacker News] [MODERATE CONFIDENCE on attribution/intent]
PHYSICAL / LOCAL (SOUTHERN CALIFORNIA)
CRITICAL INFRASTRUCTURE EXPOSURE: 900+ US gas station automatic tank gauge (ATG) systems confirmed internet-exposed and vulnerable to attack. ATGs control fuel inventory and leak detection; compromise could enable physical damage or supply disruption. Concentration in Southern California unknown but national exposure is significant. [BleepingComputer] [HIGH CONFIDENCE]
NOSIG on direct Southern California physical security events in the 24-hour window.
NUCLEAR / WMD
- NOSIG.
ASSESSMENT
The 06 JUN threat picture is dominated by three converging vectors: an unpatched Cisco SD-WAN RCE with no remediation path, simultaneous worm campaigns actively poisoning GitHub and npm supply chains, and a PAN-OS zero-day under exploitation — any one of which would constitute a high-priority week in isolation. The Miasma/IronWorm supply chain activity is particularly acute for SRE environments given the direct pipeline from compromised repositories to production deployments via CI/CD automation; the Microsoft Threat Intelligence finding on Claude Code GitHub Action prompt injection suggests agentic CI/CD tooling is now an explicit targeting surface, not a theoretical one. Chinese APT persistence tooling and the LinkedIn recruitment vector indicate sustained, patient collection operations against US technical infrastructure that will not resolve on a patch cycle — personnel security hygiene is as operationally relevant as patch cadence this week.
Feed gaps noted: AWS CVE-2026-11400/11401 descriptions truncated; full scope unconfirmed. Military history corpus entries in feed are non-actionable and excluded. No live news search results supplemented this brief.