Published Wednesday, June 24, 2026 at 03:17 PM PT BLUF: A magnitude 7.1 earthquake struck 21 km west of Morón, Venezuela at shallow depth (10 km). Population centers along Venezuela’s northern Caribbean coast face immediate risk of structural damage, casualties, and secondary hazards. Emergency services should activate. Tsunami assessment status is UNKNOWN at time of this alert — verify with PTWC/NOAA immediately. ...
Published Wednesday, June 24, 2026 at 12:48 PM PT BLUF: CISA has issued a warning that a critical vulnerability in the Lantronix EDS5000 device server is being actively exploited in the wild. Organizations operating Lantronix EDS5000 hardware should treat this as an immediate priority and apply mitigations now. DETAILS CISA has added the Lantronix EDS5000 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation is underway — not theoretical. The Lantronix EDS5000 is a network-attached device server commonly used in industrial, enterprise, and critical infrastructure environments to connect serial devices to IP networks. Specific CVE identifier, CVSS score, and technical exploitation mechanism are not confirmed in source material provided — treat severity as critical pending vendor advisory review. CISA’s KEV designation means federal civilian agencies are subject to mandatory remediation deadlines; private sector organizations should treat this with equivalent urgency. This alert follows a pattern of CISA warnings targeting network infrastructure and edge devices, including recent advisories on Ubiquiti, Fortinet, and Cisco Unified CM vulnerabilities. IMPACT Who is affected: Any organization deploying Lantronix EDS5000 device servers — particularly industrial operators, healthcare networks, and enterprise environments where serial-to-IP connectivity is in use. Scope: Active exploitation confirmed; attack surface includes any internet-exposed or network-accessible EDS5000 units. Risk: Successful exploitation of device servers can enable unauthorized network access, lateral movement, and potential pivot into connected OT/IT systems. Full impact scope not confirmed from available source material. RECOMMENDED ACTIONS Inventory immediately — identify all Lantronix EDS5000 devices in your environment. Check for vendor patch — visit Lantronix’s official security advisory page for available firmware updates; apply if available. Isolate if unpatched — restrict network access to EDS5000 units; remove internet exposure where possible. Monitor for indicators of compromise — review logs on and around affected devices for anomalous access or configuration changes. Apply CISA KEV remediation timeline — federal agencies must comply with mandatory deadlines; all others should treat as P1. ⚠️ UNCERTAINTY FLAGS Specific CVE number, CVSS score, and exploitation method are not confirmed in provided source material. Verify against CISA KEV catalog and Lantronix advisories directly before communicating internally. Threat actor attribution is unknown at this time. SOURCES The Hacker News — CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited CISA Known Exploited Vulnerabilities Catalog — cisa.gov/known-exploited-vulnerabilities-catalog (verify directly for full technical details)
Published Wednesday, June 24, 2026 at 12:47 PM PT BLUF: Threat actors have actively exploited an unpatched Cisco vulnerability to gain maximum-level access at a communications service provider. All organizations running affected Cisco infrastructure — particularly Cisco Catalyst SD-WAN Manager — should treat this as an active threat and apply mitigations immediately. DETAILS Mandiant documented active zero-day exploitation of CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, enabling root-level command execution on affected systems, per Google Threat Intelligence reporting. Attackers achieved the highest available access level on compromised systems at a confirmed communications service provider victim; the identity of the victim has not been publicly disclosed. Observed attacker behavior includes selective deletion and restoration of system configuration files, suggesting deliberate anti-forensic or persistence activity. Attribution is unconfirmed. Mandiant has not publicly identified the threat actor or linked the activity to a known group as of this alert. Whether attackers gained broad visibility into internal traffic — a critical concern given the victim’s role as a communications provider — remains unconfirmed. IMPACT Directly affected: Organizations running Cisco Catalyst SD-WAN Manager. Elevated risk: Communications service providers, whose infrastructure may carry third-party customer traffic, represent high-value targets with potential downstream exposure to the provider’s clients. Scope of broader campaign: Unknown. It is unclear whether this is an isolated incident or part of a wider targeting pattern. RECOMMENDED ACTIONS Patch immediately — Apply Cisco’s available patch for CVE-2026-20245. A proof-of-concept has been publicly available, increasing exploitation risk across the broader threat landscape. Audit SD-WAN Manager logs for unauthorized configuration changes, unexpected deletions, or anomalous privileged access events. Review network segmentation around SD-WAN management planes to limit lateral movement potential. Communications providers should assess whether customer traffic visibility may have been exposed and consider notification obligations accordingly. Monitor Mandiant and Cisco advisories for updated indicators of compromise (IOCs) — none have been confirmed publicly at this time. SOURCES Mandiant / Google Threat Intelligence: Zero-Day Exploitation of CVE-2026-20245 in Cisco Catalyst SD-WAN Manager CyberScoop: Malicious hackers exploit Cisco zero-day for highest access level at communications service provider SOC Prime: CVE-2026-20245 analysis ⚠️ UNCERTAINTY FLAG: Threat actor identity, full victim scope, and whether traffic interception occurred are all unconfirmed. This alert will require update as Mandiant releases additional findings. ...
Published Wednesday, June 24, 2026 at 12:47 PM PT BLUF: Threat actors are actively exploiting a zero-day vulnerability in Cisco Catalyst SD-WAN Manager. Organizations running affected SD-WAN Manager instances should treat this as an active incident. Patch or mitigate immediately. DETAILS CVE-2026-20245 is under active exploitation in Cisco Catalyst SD-WAN Manager, according to Google Threat Intelligence reporting. Specific CVSS score and affected version range are not confirmed in available source material — verify against Cisco’s advisory. Threat actors have demonstrated post-exploitation capability including selectively deleting and restoring system configuration files modified during their activity — a deliberate anti-forensic technique indicating a sophisticated, operationally aware actor. The file manipulation behavior suggests actors are actively attempting to conceal their presence and timeline of access, complicating incident response and forensic reconstruction. A prior related Cisco zero-day (CVE-2026-20230, Unified CM) had a public proof-of-concept available at time of disclosure — whether a PoC exists for CVE-2026-20245 is not confirmed at this time. Attribution of the threat actor has not been confirmed in available reporting. Sophistication of anti-forensic tradecraft is noted. IMPACT Directly affected: Organizations running Cisco Catalyst SD-WAN Manager in their network infrastructure. Scope concern: SD-WAN Manager serves as a centralized control plane for SD-WAN deployments. Compromise may provide adversary visibility into or control over wide-area network routing, policy, and configuration across multiple sites. Secondary risk: Anti-forensic file manipulation means dwell time and scope of access may be significantly underestimated without deep forensic investigation. RECOMMENDED ACTIONS Immediately audit Cisco Catalyst SD-WAN Manager instances for unauthorized access, anomalous configuration changes, or unexpected file deletions and restorations. Apply Cisco patches as soon as available — check Cisco’s Security Advisory portal now for CVE-2026-20245 guidance. Restrict management-plane access to SD-WAN Manager: enforce allowlisting, disable unnecessary external access, require MFA. Preserve forensic artifacts now — given confirmed anti-forensic activity, initiate log preservation and memory capture before further remediation steps. Assume breach posture if your SD-WAN Manager has been internet-exposed or inadequately segmented pending full investigation. SOURCES Google Threat Intelligence — CVE-2026-20245 zero-day exploitation reporting CyberScoop — prior Cisco zero-day exploitation context SecurityWeek — CVE-2026-20230 Cisco Unified CM related reporting ⚠️ NOTE: Specific affected version ranges, CVSS score, and threat actor attribution are not confirmed in available source material at time of publication. Monitor Cisco PSIRT and CISA KEV catalog for updates. ...
Published Wednesday, June 24, 2026 at 07:16 AM PT Organizations running Cisco Unified Communications Manager are under active attack via CVE-2026-20230, a critical flaw enabling root access. Patches have been available for weeks. Apply them now. DETAILS CVE-2026-20230 is a critical vulnerability in Cisco Unified Communications Manager (Unified CM) that, if exploited successfully, can allow an attacker to gain root-level access to affected systems. Active exploitation was reported by threat intelligence firm Defused on June 23, with observed activity occurring over the preceding weekend. A proof-of-concept (PoC) exploit was publicly available at the time Cisco issued its original patch advisory, per SecurityWeek reporting — significantly lowering the barrier to exploitation. The Hacker News reporting indicates the PoC revealed a file-write path to root, clarifying the likely exploitation mechanism. As of reporting, exploitation has been observed originating from a single source — broader threat actor attribution and full scope of targeting are not yet confirmed. IMPACT Directly affected: Organizations running unpatched Cisco Unified CM deployments, particularly those with internet-exposed management interfaces. Scope: Unified CM is widely deployed in enterprise voice and collaboration environments. Successful exploitation grants root access, enabling full system compromise, lateral movement, and potential interception of communications infrastructure. Exploitation window: Patches were available weeks prior to confirmed active exploitation — organizations that delayed remediation are at elevated risk. RECOMMENDED ACTIONS Apply Cisco’s patches for CVE-2026-20230 immediately if not already done. Treat this as emergency remediation. Restrict management interface access — ensure Unified CM administration portals are not exposed to the public internet; enforce network-level access controls. Hunt for indicators of compromise on Unified CM systems, including unexpected file modifications, new accounts, or anomalous process activity consistent with privilege escalation. Review logs for suspicious access attempts, particularly targeting administrative interfaces, over the past two weeks. Isolate any systems showing signs of compromise pending forensic review. SOURCES CSO Online — Attackers exploit Cisco Unified CM flaw weeks after patch release SecurityWeek — Hackers Exploiting Cisco Unified CM Vulnerability BleepingComputer — Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks The Hacker News — Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root Defused (threat intelligence firm) — exploitation activity reported June 23 ⚠️ Uncertainty flag: Full attacker attribution, total number of victims, and whether exploitation has expanded beyond the initially observed single source are not yet confirmed at time of publication. ...
Published Wednesday, June 24, 2026 at 07:15 AM PT BLUF: Tenable research identified 457 million AI-related security issues across more than 7,000 organizations over a single 30-day measurement period — averaging approximately 62,000 exposures per organization. Shadow AI adoption is confirmed as a primary driver. All organizations deploying or permitting AI tools should conduct immediate exposure assessments. ...
Published Wednesday, June 24, 2026 at 07:14 AM PT BLUF: Threat actor group ShinyHunters has successfully breached more than 100 organizations by exploiting an unpatched zero-day vulnerability in Oracle PeopleSoft. All organizations running Oracle PeopleSoft should treat this as an active threat requiring immediate action. DETAILS ShinyHunters, a prolific financially motivated threat actor group previously linked to high-profile data theft operations, is confirmed as the actor behind this campaign The attack vector is a zero-day vulnerability in Oracle PeopleSoft — meaning exploitation occurred before a patch was available; patch availability status at time of publication is not confirmed in source reporting Confirmed victim count stands at 100+ organizations; full scope of affected entities, sectors, and geographic distribution has not been publicly confirmed Nature of data accessed or exfiltrated across victim organizations has not been confirmed in available reporting — assume sensitive HR, financial, and identity data is at risk given PeopleSoft’s typical deployment profile ShinyHunters has a documented history of large-scale data exfiltration and sale on criminal marketplaces; downstream exposure risk is elevated IMPACT Directly affected: Any organization running Oracle PeopleSoft, particularly internet-facing deployments Scope: Enterprise-wide — PeopleSoft is widely deployed across higher education, government, healthcare, and large enterprises for HR, ERP, and financial management functions Data at risk: Likely includes employee PII, payroll data, benefits records, and authentication credentials — confirm based on your specific PeopleSoft configuration Secondary risk: Credential harvesting from PeopleSoft could enable lateral movement into connected enterprise systems RECOMMENDED ACTIONS Immediately audit Oracle PeopleSoft deployments — identify all internet-facing instances and restrict external access where operationally feasible Monitor Oracle’s security advisory portal for emergency patch or mitigation guidance; apply any available patches on an emergency basis Review PeopleSoft access logs for anomalous authentication attempts, privilege escalation, or unusual data exports — prioritize logs from the past 30–90 days Isolate PeopleSoft environments from broader network segments if compromise is suspected Alert identity and HR teams — credential and PII exposure should be assumed until ruled out; initiate incident response procedures accordingly Contact Oracle support directly for guidance if you have an active support contract SOURCES The Register Security — ShinyHunters hacked 100+ orgs by exploiting an Oracle PeopleSoft 0-day ⚠️ UNCERTAINTY FLAG: Source reporting at time of alert generation is limited to headline-level detail. Patch availability, full victim list, exploited CVE identifier, and confirmed data types exfiltrated are unconfirmed. Update response posture as Oracle and additional reporting provide clarification.
Published Tuesday, June 23, 2026 at 01:12 PM PT BLUF: A large-scale credential theft campaign is actively exploiting CVE-2025-54068 in Laravel Livewire applications. Imperva reports 6,000+ applications compromised. Organizations running Laravel Livewire should treat this as an active incident and apply mitigations immediately. DETAILS Imperva’s Cloud WAF began detecting exploitation attempts against Laravel Livewire applications on May 24, 2026, initially flagged as deserialization attack traffic before being attributed to a coordinated credential theft operation. The vulnerability is tracked as CVE-2025-54068 (note: source material also references CVE-2025-5406 — it is unclear whether these are the same CVE or a transcription error; treat as potentially the same until confirmed). The attack vector involves deserialization abuse within the Livewire component framework, a PHP-based full-stack framework built on Laravel. Imperva characterizes this as a large-scale, organized campaign — not opportunistic scanning — given the volume and consistency of exploitation patterns observed. 6,000+ applications are reported as compromised. The methodology used to arrive at this figure has not been independently confirmed at time of publication. IMPACT Directly affected: Any internet-facing application built on Laravel Livewire — particularly those without a WAF or unpatched against this CVE. Credential theft is the confirmed objective; downstream impacts may include account takeover, lateral movement, and data exfiltration depending on what credentials are exposed. Scope is global; Laravel is widely deployed across industries including SaaS, e-commerce, healthcare, and financial services. Organizations relying solely on perimeter defenses without application-layer controls are at elevated risk. RECOMMENDED ACTIONS Audit immediately — Identify all internal and customer-facing applications running Laravel Livewire. Apply patches — Check Laravel and Livewire official channels for CVE-2025-54068 patches or mitigations; apply without delay. Review WAF rules — Ensure deserialization attack signatures are active and up to date; Imperva Cloud WAF is confirmed blocking. Hunt for indicators — Review application logs for anomalous Livewire component requests, unexpected deserialization activity, or unusual authentication events from May 24, 2026 onward. Rotate credentials — If exploitation cannot be ruled out, treat exposed application credentials as compromised and rotate. Isolate if necessary — Consider taking vulnerable applications offline or behind additional access controls until patched. UNCERTAINTY FLAGS The CVE identifier discrepancy (CVE-2025-54068 vs. CVE-2025-5406) is unresolved — verify against NVD and Imperva’s full advisory before referencing in internal communications. The 6,000+ compromise figure is sourced solely from Imperva at this time; independent corroboration is pending. Full technical details of the exploit chain have not been confirmed in available source material. SOURCES Imperva Threat Research — CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised (May 2026)
Published Tuesday, June 23, 2026 at 01:12 PM PT BLUF: A disgruntled security researcher has publicly dropped an unpatched zero-day vulnerability affecting Microsoft Windows with no coordinated patch release. All Windows users and enterprise environments are potentially at risk. No official Microsoft patch is confirmed available at time of writing. Treat as active threat until patched. DETAILS A security researcher, reportedly in an ongoing dispute with Microsoft over vulnerability handling practices, has publicly released details and/or exploit code for a new Windows zero-day vulnerability without coordinating a patch release with Microsoft. This follows a documented pattern: at least one prior incident involved a separate researcher leaking Microsoft exploits in direct defiance of Microsoft’s disclosure process — suggesting a broader breakdown in researcher-vendor relations. Specific vulnerability class, affected Windows versions, and exploit reliability are NOT confirmed in available reporting at this time. Treat scope as potentially broad pending Microsoft advisory. Microsoft has not issued a patch or official CVE advisory as of this alert. The vulnerability is currently unmitigated by vendor fix. Public disclosure of exploit details significantly accelerates the timeline for threat actor weaponization — exploitation in the wild should be considered a near-term risk. IMPACT Who: All Windows users; enterprise environments running unpatched or standard Windows builds are primary concern. Scope: Unknown until Microsoft confirms affected versions. Assume all supported Windows releases are potentially in scope. Risk elevation: Public exploit availability dramatically lowers the bar for opportunistic attackers and ransomware operators. RECOMMENDED ACTIONS Monitor Microsoft Security Response Center (MSRC) for an emergency out-of-band patch or advisory — apply immediately upon release. Increase endpoint detection monitoring for anomalous Windows process behavior, privilege escalation attempts, and lateral movement indicators. Restrict unnecessary exposure of Windows systems to untrusted networks where feasible pending patch availability. Brief SOC/IR teams now — establish watch posture for exploitation attempts consistent with a new, uncharacterized Windows vulnerability. Do not rely on workarounds until Microsoft or a credible third party confirms effective mitigations for the specific vulnerability class. SOURCES The Register Security — “Angry bug hunter with Microsoft beef drops new Windows 0-day” CSO Online — “Microsoft feud escalates as researcher drops new Windows zero-day” The Register Security — “Another bug hunter leaks Microsoft exploits in defiance of company’s handling of vulnerability disclosures” ⚠️ UNCERTAINTY FLAG: Vulnerability class, CVE identifier, affected Windows versions, and exploit reliability are unconfirmed at time of publication. This alert will require update as Microsoft responds. Do not treat specific technical details as confirmed until official advisory is issued.
Published Tuesday, June 23, 2026 at 01:10 AM PT BLUF: Zero Day Initiative has published continued Day Two results from Pwn2Own Berlin 2026, confirming additional successful exploit demonstrations against enterprise targets. Organizations running affected products should monitor ZDI advisories immediately for patch availability and mitigation guidance. DETAILS ZDI has released updated Day Two results for Pwn2Own Berlin 2026, including a revised Master of Pwn leaderboard reflecting additional successful exploitation attempts. Specific targets and vulnerability classes from this session have not been confirmed in the source data provided — full technical details are pending ZDI’s official write-up. Pwn2Own Berlin 2026 follows the standard ZDI contest format: all demonstrated vulnerabilities are zero-days at time of exploitation, with details embargoed and vendors notified immediately following successful attempts. Affected vendors are notified by ZDI upon successful demonstration per responsible disclosure policy; vendors typically have 90 days to issue patches before public disclosure. Specific products successfully exploited in this session are not confirmed in available source material. Do not assume scope based on prior Pwn2Own events. Contest results indicate competitive participation with a populated leaderboard, suggesting multiple successful exploitation chains were demonstrated across Day Two. IMPACT Who is affected: Organizations running enterprise software, browsers, virtualization platforms, and operating systems historically targeted at Pwn2Own — scope for Berlin 2026 specifically is unconfirmed pending full ZDI disclosure. Severity: Zero-days demonstrated at Pwn2Own are confirmed exploitable by skilled researchers under controlled conditions. Real-world weaponization risk varies; no in-the-wild exploitation of these specific vulnerabilities has been reported at this time. Patch status: Patches are not expected to be immediately available. ZDI’s 90-day disclosure window applies. RECOMMENDED ACTIONS Monitor ZDI’s blog and advisory feed (zerodayinitiative.com) for full Day Two technical summaries and affected product identification as they are published. Identify your exposure to product categories historically targeted at Pwn2Own Berlin (browsers, hypervisors, OS kernels, enterprise applications) and review existing compensating controls. Do not wait for patches — apply defense-in-depth measures including network segmentation, privilege restriction, and endpoint detection tuning for affected product categories once confirmed. Track vendor security bulletins for any out-of-band emergency patches that may follow contest disclosure. SOURCES Zero Day Initiative — Pwn2Own Berlin 2026 Day Two Results (cont): zerodayinitiative.com ZDI Pwn2Own Berlin 2026 Announcement (Zero Day Initiative) ⚠️ UNCERTAINTY FLAG: Specific exploited products, vulnerability classes, prize amounts, and team names from Day Two (cont) are not confirmed in available source data. This alert will require update once ZDI publishes full technical results. Do not redistribute with assumed specifics. ...