Alert

BLUF: Microsoft has released its June 2026 monthly security update. All Windows enterprise environments should begin emergency patch assessment now, with immediate priority on Windows kernel, Exchange Server, Active Directory, and .NET vulnerabilities. Full CVE details are available at the Microsoft Security Response Center. DETAILS Microsoft’s June 2026 Patch Tuesday update package is now live at https://msrc.microsoft.com/update-guide/. Specific CVE counts, severity ratings, and exploitation status for this cycle have not yet been independently confirmed at time of publication — consult the MSRC guide directly for authoritative detail. Priority vulnerability classes identified by Microsoft for this cycle include: Windows kernel, Exchange Server, Active Directory, and .NET Framework/Runtime components. These categories historically carry the highest exploitation risk in enterprise environments. The 2026 Verizon DBIR (based on one billion records) confirms that vulnerability remediation timelines remain a critical failure point for organizations — unpatched systems in these exact product categories are among the most frequently exploited in confirmed breaches. May 2026 Patch Tuesday (previous cycle) addressed significant Windows and Adobe vulnerabilities; organizations still remediating May patches should not delay June assessment — stacked unpatched cycles compound exposure. NOTE: Specific CVE identifiers, CVSS scores, and confirmed in-the-wild exploitation status for June 2026 are not confirmed in available sources at this time. Do not assume exploitation status until MSRC or trusted threat intelligence sources confirm. IMPACT Scope: All organizations running Windows Server, Exchange Server, Active Directory Domain Services, and .NET-dependent applications — effectively the majority of enterprise IT environments globally. Elevated risk sectors: Financial services, healthcare, critical infrastructure, and government — consistent with 2026 DBIR findings on high-value targeting. Concurrent threat environment: Active exploitation of Cisco Catalyst SD-WAN Manager CVE-2026-20245 (no patch available) and FIFA World Cup 2026-themed phishing and banking malware campaigns are running in parallel — threat actor activity is elevated this cycle. RECOMMENDED ACTIONS Access MSRC immediately — https://msrc.microsoft.com/update-guide/ — and pull the full June 2026 CVE list. Filter by Critical severity and “Exploitation Detected” status first. Prioritize patching in this order: Windows kernel → Active Directory → Exchange Server → .NET. Treat any Critical/RCE or privilege escalation CVEs in these categories as P1. Verify May 2026 patches are fully deployed before layering June updates — confirm no remediation gaps remain. Monitor threat intel feeds (Qualys TRU, Krebs on Security, BleepingComputer, The Hacker News) for confirmed exploitation reports against June CVEs — expect reporting within 24–72 hours of release. Do not deprioritize due to concurrent Cisco or Android patch activity — treat all active patch cycles independently. SOURCES Microsoft Security Response Center (MSRC): https://msrc.microsoft.com/update-guide/ Qualys Threat Research — Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review Krebs on Security — Patch Tuesday, May 2026 Edition; April 2026 Edition Qualys Threat Research / BleepingComputer — 2026 Verizon DBIR coverage The Hacker News — Cisco CVE-2026-20245 active exploitation reporting Specific June 2026 CVE details unconfirmed at publication. Update this alert as MSRC and third-party analysis becomes available.

BLUF: A zero-day vulnerability in Check Point VPN products is being actively exploited in the wild. CISA has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and is mandating all federal civilian agencies patch within 3 days. Enterprise and government network defenders using Check Point VPN should treat this as priority-one remediation. DETAILS CISA has issued a binding directive requiring Federal Civilian Executive Branch (FCEB) agencies to apply patches within 3 days of the KEV listing — an accelerated timeline indicating confirmed, active exploitation The vulnerability affects Check Point VPN products; specific CVE identifier and full technical details were not confirmed in source material at time of publication — treat scope as pending vendor confirmation The flaw is classified as a zero-day, meaning exploitation was occurring before a patch was publicly available Check Point has issued a fix; patch availability is confirmed, though version specifics should be verified directly against Check Point’s official security advisory Active exploitation in the wild has been confirmed by CISA; threat actor attribution and exploitation scale are not confirmed at this time IMPACT Directly affected: U.S. federal agencies running Check Point VPN infrastructure — mandatory patch deadline applies Broader risk: Any enterprise, government, or critical infrastructure organization deploying Check Point VPN products should assume exposure until patched Attack surface: VPN gateways are high-value targets — successful exploitation may enable unauthorized network access, credential theft, or lateral movement Scope of exploitation beyond federal targets is unconfirmed but cannot be ruled out RECOMMENDED ACTIONS Patch immediately — Apply Check Point’s official fix without delay; do not wait for change windows Verify affected versions — Cross-reference your deployment against Check Point’s security advisory to confirm exposure Audit VPN logs — Review authentication and access logs for anomalous activity, particularly failed or unusual login patterns predating patch availability Isolate if unpatched — If immediate patching is not possible, consider restricting VPN gateway exposure at the network perimeter Monitor CISA KEV — Check cisa.gov/known-exploited-vulnerabilities-catalog for updated CVE details and deadlines SOURCES BleepingComputer — “CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day” CISA Known Exploited Vulnerabilities Catalog (cross-reference for CVE and deadline confirmation) Check Point official security advisory (verify directly for affected product versions) ⚠️ NOTE: CVE identifier, specific affected product versions, and threat actor details were not confirmed in available source material. Organizations should consult Check Point’s advisory directly before scoping remediation efforts.

BLUF: A zero-day authentication bypass vulnerability in Check Point VPN products is being actively exploited by the Qilin ransomware group, allowing attackers to establish VPN connections without valid credentials. All organizations running affected Check Point VPN infrastructure should treat this as an emergency and apply available mitigations immediately. DETAILS Vulnerability type: Authentication bypass in Check Point VPN; confirmed to allow unauthenticated actors to establish VPN sessions without a valid password Threat actor: Qilin ransomware group — a known ransomware-as-a-service (RaaS) operation with a history of double-extortion tactics (data theft + encryption) Exploitation status: Actively exploited in the wild; this is not a theoretical or proof-of-concept threat Patch/fix status: Not fully confirmed in available reporting — organizations should consult Check Point’s official security advisories immediately for current remediation guidance Attribution confidence: Attributed to Qilin per SecurityWeek reporting; independent verification of full attack chain details is pending IMPACT Who is affected: Any organization using Check Point VPN products for remote access or network perimeter security Scope: Successful exploitation grants attackers authenticated VPN access to internal networks — effectively bypassing the perimeter entirely Downstream risk: Once inside, Qilin actors are known to conduct lateral movement, data exfiltration, and ransomware deployment; dwell time before encryption can be significant Sector targeting: No specific sector targeting confirmed at this time — assume broad opportunistic exploitation is underway RECOMMENDED ACTIONS Audit immediately — Review VPN authentication logs for anomalous or unexpected connection attempts, particularly from unfamiliar IPs or geolocations Apply patches/mitigations — Check Point’s official advisory should be treated as the authoritative source; apply any available hotfix or workaround without delay Consider temporary access restrictions — If patching is not immediately possible, evaluate restricting VPN access to known IP ranges or implementing additional authentication layers Hunt for indicators — Engage threat hunting for Qilin TTPs including lateral movement, credential harvesting, and staging activity consistent with pre-ransomware behavior Isolate suspicious sessions — Terminate and investigate any active VPN sessions that cannot be positively attributed to known users ⚠️ UNCERTAINTY FLAGS Full list of affected Check Point product versions not confirmed in available reporting Patch availability and CVE identifier not confirmed — verify directly with Check Point Scope of confirmed victim organizations unknown at this time SOURCES SecurityWeek: Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks Additional context: Check Point official security portal (check.point.com/support) — consult directly for authoritative technical guidance

BLUF: Google has released an emergency patch for a zero-day vulnerability in the Chrome browser that is confirmed to be actively exploited in the wild. All Chrome users on desktop platforms are affected. Apply the update now. DETAILS Google has issued an out-of-band security update for Chrome addressing a zero-day vulnerability confirmed as actively exploited at time of patch release. The vulnerability has been reported by BleepingComputer as exploited in the wild — meaning threat actors have weaponized this flaw against real targets prior to the patch being available. Specific CVE identifier, vulnerability type (e.g., use-after-free, type confusion), and affected component details are not confirmed in the information provided — treat technical specifics from secondary sources with caution until Google’s official advisory is verified. Google’s standard practice in such cases is to restrict detailed technical disclosure until a majority of users have updated, to limit further exploitation. This follows a pattern of recent zero-day activity across major platforms, including a separately patched Android zero-day and ongoing exploitation of other enterprise software. IMPACT Who: All users running unpatched versions of Google Chrome on Windows, macOS, and Linux. Chromium-based browser users (Edge, Brave, Opera, etc.) may also be at risk — patch status for those products is unconfirmed at this time. Scope: Broad consumer and enterprise exposure. Chrome holds the majority of global browser market share, making the attack surface significant. Exploitation context: Active exploitation confirmed; scale, attribution, and targeting profile (opportunistic vs. targeted) are not yet confirmed. RECOMMENDED ACTIONS Update Chrome immediately: Navigate to chrome://settings/help — Chrome will check for and apply the latest update. Restart the browser to complete installation. Verify version: Confirm you are running the patched version as specified in Google’s official security bulletin once published. Chromium-based browser users: Check your browser vendor’s advisory for patch availability — do not assume coverage. Enterprise teams: Push the update via policy/MDM without waiting for user-initiated updates. Prioritize internet-facing and privileged workstations. Monitor: Watch Google’s official Chrome Releases blog and your threat intel feeds for CVE details and IOCs as they are released. SOURCES BleepingComputer — Google patches new Chrome zero-day flaw exploited in the wild Google Chrome Releases blog (consult directly for authoritative patch version and CVE details) ⚠️ NOTE: Technical details of this vulnerability are limited in current reporting. This alert will require update as CVE specifics, affected version ranges, and exploitation context are confirmed. Do not delay patching pending those details.

Google has patched a fifth actively exploited Chrome zero-day vulnerability in 2026 — CVE-2026-11645. All Chrome users and enterprise administrators should update to the latest stable release immediately. DETAILS CVE-2026-11645 is a zero-day vulnerability in Google Chrome confirmed to have been exploited in the wild prior to patching. Google released a fix following a report submitted in late April 2026 by an anonymous researcher; attribution of active exploitation to a specific threat actor is not yet confirmed in available reporting. This marks the fifth Chrome zero-day exploited in 2026, indicating a sustained and elevated targeting tempo against the Chrome browser this year. Technical details of the vulnerability type (e.g., memory corruption, use-after-free, type confusion) have not been confirmed in available source material at this time — Google typically withholds specifics until a majority of users have patched. The vulnerability was reported to Google in late April 2026; the patch timeline between report and public release is not specified in current reporting. IMPACT Scope: All users and organizations running unpatched versions of Google Chrome across desktop platforms (Windows, macOS, Linux). Mobile impact is unconfirmed at this time. Context: The 2026 Verizon DBIR and concurrent BleepingComputer analysis confirm browser-based attacks are a dominant intrusion vector this year, elevating the risk profile of this vulnerability. Enterprise environments with managed Chrome deployments or Chromium-based browsers (Edge, Brave, Opera) should assess exposure — patch applicability to Chromium derivatives is not yet confirmed in available reporting. Given active exploitation prior to patch release, some organizations may already be compromised. RECOMMENDED ACTIONS Update Chrome immediately — navigate to chrome://settings/help or deploy via enterprise management tooling. Verify version reflects the patched release once Google publishes the specific version number. Prioritize patch deployment in environments where Chrome is used for sensitive workflows, financial systems, or privileged access. Review browser-based endpoint telemetry for anomalous activity, particularly given confirmed pre-patch exploitation window. Monitor Chromium-based browser vendor advisories (Microsoft Edge, Brave, etc.) for downstream patch releases. Do not wait for scheduled patch cycles — active exploitation is confirmed. SOURCES SecurityWeek: Google Patches 5th Chrome Zero-Day Exploited in 2026 (primary) BleepingComputer: What 2026 DBIR Confirms: Attacks Are Living in the Browser (contextual) Qualys / Verizon DBIR 2026 (contextual threat landscape) ⚠ NOTE: Vulnerability type, affected Chrome version range, and threat actor attribution remain unconfirmed pending full Google advisory publication. This alert will require update as additional technical details are released.

BLUF: CISA has added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on confirmed active exploitation. One is a Command Injection flaw in BerriAI LiteLLM (CVE-2026-42271). Organizations using affected products must treat patching as urgent priority. DETAILS CISA confirmed active exploitation of at least two vulnerabilities and added them to the KEV Catalog; federal agencies are legally required to remediate KEV-listed vulnerabilities within mandated timeframes under BOD 22-01. CVE-2026-42271 is identified as a Command Injection vulnerability in BerriAI LiteLLM, an open-source LLM proxy/gateway widely used to route requests across multiple AI model providers. Command injection flaws can allow unauthenticated or authenticated attackers to execute arbitrary system commands on the host. The second vulnerability has not been fully identified in available source data. Its CVE identifier, affected product, and exploitation details are unconfirmed at this time — this alert will be updated when additional information is available. LiteLLM is commonly deployed in enterprise AI infrastructure, developer environments, and cloud-native pipelines — increasing the potential blast radius of exploitation. No specific threat actor attribution for active exploitation has been confirmed in available reporting. IMPACT Directly affected: Organizations running BerriAI LiteLLM in any environment — particularly those exposing the proxy to external networks or shared infrastructure. Broader risk context: Active exploitation of AI infrastructure tooling aligns with a documented trend of threat actors targeting AI/ML pipeline components. Related reporting indicates AI-adjacent platforms are increasingly being leveraged for cryptojacking, credential theft, and lateral movement. Scope of second vulnerability: Unknown pending full CISA disclosure — treat as potentially high severity until confirmed otherwise. RECOMMENDED ACTIONS Immediately audit all deployments of BerriAI LiteLLM across your environment, including containerized and cloud-hosted instances. Apply available patches or mitigations per vendor guidance; check BerriAI’s GitHub and security advisories for CVE-2026-42271 remediation steps. Restrict network exposure of LiteLLM proxy endpoints — do not expose admin interfaces to the public internet. Federal agencies: Remediate per BOD 22-01 mandated timelines. Verify second KEV entry via CISA catalog directly. Monitor for anomalous command execution, unexpected outbound connections, or privilege escalation activity on hosts running LiteLLM. Check CISA KEV Catalog directly at cisa.gov/known-exploited-vulnerabilities-catalog for the confirmed second CVE entry. SOURCES CISA Known Exploited Vulnerabilities Catalog — cisa.gov/known-exploited-vulnerabilities-catalog CVE Record: CVE-2026-42271 — cve.org CISA Current Activity Advisory (direct trigger) ⚠️ UNCERTAINTY FLAG: The second KEV entry was truncated in source data. Details on that CVE — including affected vendor, product, and severity — are unconfirmed. Do not assume low risk. Verify immediately via CISA’s official catalog. ...

BLUF: CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation in the wild. All organizations should treat these as priority remediation targets immediately. Federal Civilian Executive Branch (FCEB) agencies are under binding remediation deadlines per BOD 22-01. DETAILS CISA has officially cataloged two newly confirmed exploited vulnerabilities; specific CVE identifiers and affected products were not included in the source data provided — treat as unconfirmed pending full CISA advisory review Active exploitation has been confirmed by CISA, meeting the threshold required for KEV Catalog inclusion BOD 22-01 mandates FCEB agencies remediate KEV-listed vulnerabilities within defined timeframes; non-compliance carries regulatory risk CISA explicitly extends its remediation urgency recommendation to all organizations, not only federal entities The broader threat landscape at time of publication includes active exploitation of FortiClient EMS, WP Maps Pro, Everest Forms Pro, and SolarWinds Serv-U — organizations should assess exposure across all active KEV entries concurrently IMPACT Directly bound: All U.S. Federal Civilian Executive Branch agencies (BOD 22-01 compliance required) At risk: All organizations running unpatched software matching the newly cataloged CVEs — specific vendor/product scope cannot be confirmed from available data Scope: Exploitation is confirmed active; unpatched systems should be considered at elevated and immediate risk RECOMMENDED ACTIONS Immediately cross-reference the full CISA KEV Catalog at cisa.gov/known-exploited-vulnerabilities-catalog to identify the two newly added CVEs and confirm affected products Initiate emergency patch assessment for any systems matching newly listed vulnerabilities FCEB agencies: confirm BOD 22-01 remediation timelines and begin tracking compliance All organizations: incorporate KEV Catalog into routine vulnerability management cycles — do not treat this as a federal-only concern Review exposure to concurrently active exploitation campaigns (FortiClient EMS, SolarWinds Serv-U, WordPress plugin flaws) given elevated threat tempo ⚠️ UNCERTAINTY FLAGS Specific CVE numbers and affected vendor products not confirmed in available source material — verify directly via CISA before scoping remediation Threat actor attribution for the two newly added CVEs is unknown at this time SOURCES CISA Current Activity: CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA Binding Operational Directive 22-01 Fact Sheet Supporting context: The Hacker News, CISA KEV Catalog (cisa.gov)

BLUF: Gogs, the self-hosted Git service, has patched a critical zero-day vulnerability enabling remote code execution. All organizations running Gogs instances should apply the patch immediately. DETAILS Gogs has released a patch addressing a critical zero-day vulnerability that allows remote code execution (RCE) on affected installations. The vulnerability is classified as a zero-day, meaning it was either exploited in the wild or disclosed without a prior patch window — the specific exploitation status has not been confirmed in available source material and should be verified directly with Gogs advisories. Gogs is a widely deployed, open-source, self-hosted Git platform used by development teams and organizations to manage source code repositories. Full technical details, CVE assignment, and affected version ranges are not confirmed in the information provided — consult the official Gogs release notes and BleepingComputer’s full reporting for specifics. RCE vulnerabilities in source code management platforms carry elevated risk due to direct access to codebases, CI/CD pipelines, and stored credentials. IMPACT Who is affected: Any organization or individual running a self-hosted Gogs instance, particularly those exposed to the internet or accessible from untrusted networks. Scope: Successful exploitation could allow an unauthenticated or authenticated attacker (status unconfirmed) to execute arbitrary code on the host server, potentially compromising the underlying system, stored repositories, secrets, and connected infrastructure. Downstream risk: Compromise of a source code host can enable supply chain attacks, credential theft, and lateral movement into development or production environments. RECOMMENDED ACTIONS Patch immediately — Update all Gogs instances to the latest patched version as soon as possible. Do not delay pending testing if instances are internet-facing. Restrict access — If patching cannot occur immediately, restrict network access to Gogs instances to trusted IP ranges or place behind a VPN. Audit logs — Review Gogs access and server logs for anomalous activity, unexpected process execution, or unauthorized repository access. Rotate secrets — If exposure cannot be ruled out, rotate credentials, SSH keys, API tokens, and any secrets stored within repositories. Verify CVE details — Monitor the official Gogs GitHub repository and BleepingComputer for confirmed CVE identifiers and full technical scope. SOURCES BleepingComputer: Gogs patches critical zero-day enabling remote code execution (primary trigger) Official Gogs project advisories — verify directly for confirmed version and CVE details ⚠️ UNCERTAINTY FLAG: CVE identifier, affected version range, authentication requirements for exploitation, and confirmed in-the-wild exploitation status are not verified in available source material. Treat as critical until confirmed otherwise. ...

BLUF: Check Point has linked active zero-day exploitation of its VPN products to the Qilin ransomware group. Organizations running Check Point VPN solutions should treat this as an active threat requiring immediate action. DETAILS Check Point has publicly attributed zero-day attacks targeting its VPN infrastructure to the Qilin ransomware gang, per BleepingComputer reporting. The vulnerability is being actively exploited in the wild — this is not a theoretical or proof-of-concept threat. Qilin is an established ransomware-as-a-service (RaaS) operation known for double-extortion tactics (data theft + encryption). NOTE: Specific CVE identifier, affected product versions, and technical exploitation details have not been confirmed in the source material provided. Treat version scope as uncertain until Check Point publishes full advisory details. This follows a broader pattern of threat actors targeting VPN edge devices as initial access vectors — consistent with recent SonicWall and Cisco SD-WAN zero-day exploitation observed in parallel reporting. IMPACT Who is affected: Organizations using Check Point VPN products — scope of affected versions unconfirmed at this time. Threat: Successful exploitation likely enables initial network access, with Qilin’s established TTPs suggesting follow-on lateral movement, data exfiltration, and ransomware deployment. Severity: Critical — active exploitation by a ransomware group with a track record of high-impact attacks. VPN edge devices represent high-value targets; compromise may bypass perimeter defenses entirely. RECOMMENDED ACTIONS Monitor Check Point’s official security advisory portal immediately for patch availability and affected version confirmation. Audit VPN access logs for anomalous authentication attempts, unusual session origins, or unexpected privileged access. Restrict VPN exposure where operationally feasible — limit internet-facing attack surface pending patch guidance. Apply any available patches or mitigations from Check Point without delay once published. Alert SOC/IR teams to elevate monitoring posture for Qilin-associated indicators of compromise (IOCs). Do not assume MFA alone is sufficient protection — recent VPN zero-days have demonstrated MFA bypass capability. SOURCES BleepingComputer: Check Point links VPN zero-day attacks to Qilin ransomware gang Supporting context: Huntress active exploitation reporting (SonicWall VPNs); Cisco SD-WAN zero-day advisory (BleepingComputer) ⚠ UNCERTAINTY FLAG: CVE details, specific affected product versions, and full technical indicators have not been confirmed in available source material. This alert will require update as Check Point’s official advisory is published. Do not delay defensive action pending full details.

BLUF: Apple has released iOS 26.5 and iPadOS 26.5 addressing security vulnerabilities. All users of affected iPhone and iPad devices should update immediately. Specific CVE details are not confirmed at time of publication — consult Apple’s official advisory for full vulnerability disclosure. DETAILS Apple released iOS 26.5 and iPadOS 26.5; the update contains security fixes, though the number, severity, and nature of patched vulnerabilities are not confirmed in available source data at this time Apple’s official security content page (https://support.apple.com/en-us/100100) is the authoritative source for CVE identifiers, CVSS scores, and affected components — readers should consult this directly It is unknown at this time whether any patched vulnerabilities are actively exploited in the wild (zero-day status unconfirmed) Apple typically patches vulnerabilities spanning kernel, WebKit, and core system components in iOS/iPadOS releases — no specific component confirmed for this release Update is available via Settings → General → Software Update on compatible devices IMPACT Who: All iPhone and iPad users running iOS/iPadOS versions prior to 26.5 Scope: Potentially broad — iOS/iPadOS devices represent a significant global attack surface across consumer and enterprise environments Severity: Unknown pending full CVE disclosure — treat as high-priority until confirmed otherwise, consistent with standard Apple patch cadence practice Enterprise note: Organizations with managed Apple device fleets should assess MDM-pushed update timelines and prioritize deployment RECOMMENDED ACTIONS Update immediately — navigate to Settings → General → Software Update on all iPhone and iPad devices Review Apple’s official advisory at https://support.apple.com/en-us/100100 for confirmed CVE details as they become available Enterprise/MDM administrators: Initiate forced update policy for managed iOS/iPadOS devices; verify compliance reporting Monitor threat intelligence feeds for any reporting of active exploitation tied to this release Do not delay pending full CVE disclosure — patch first, assess second SOURCES Apple Security Releases (official): https://support.apple.com/en-us/100100 CVE-specific details: Pending Apple publication — not confirmed at alert time ⚠️ UNCERTAINTY FLAG: Vulnerability count, severity ratings, affected components, and exploitation status are unconfirmed. This alert will require update once Apple’s full security content is published. Do not assume low severity in the absence of details. ...