Cyber

Published Sunday, June 28, 2026 at 09:01 AM PT LOS ANGELES, CA | 28 JUN 2026 | CLASSIFICATION: UNCLASSIFIED//FOR OFFICIAL USE BLUF: CISA added 10+ KEVs to catalog this week across multiple batches; Mirai variant Nexcorium actively exploiting IoT vulnerabilities at scale; China-to-Iran missile transfers confirmed by US intelligence — regional escalation risk elevated. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ CYBER • CISA added 10 vulnerabilities to KEV catalog across three separate advisories this week (one, two, and seven CVE batches). Full CVE list not yet parsed from feed truncation — cross-reference cisa.gov/known-exploited-vulnerabilities-catalog immediately. BOD 26-04 now establishes mandatory timelines for FCEB agencies; private sector should treat as floor, not ceiling. [CISA] [HIGH CONFIDENCE] ...

Published Saturday, June 27, 2026 at 09:04 AM PT 27 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE — LOS ANGELES BLUF: Three concurrent actively-exploited vulnerabilities (Cisco Unified Communications, Cisco Catalyst SD-WAN, PTC Windchill) demand immediate patch action; supply chain compromise of Nx Console and npm ecosystem is ongoing; promiscuous mode detection on a core internal system requires immediate investigation. CYBER Cisco Unified Communications — CISA KEV, patch deadline 29 JUN (Sunday). Vulnerability under active exploitation. Federal agencies mandated; all orgs should treat deadline as binding. CVE details in KEV catalog. [CISA] [HIGH CONFIDENCE] ...

Published Thursday, June 25, 2026 at 09:01 AM PT 25 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA ───────────────────────────────────────────────────────────────────────────── BLUF: Patch Chrome 149 and GitLab now; Akira ransomware affiliate active via novel exfiltration channel; device code phishing ecosystem (Kali365) at scale; Cal Water incident warrants Southern California water infrastructure awareness; internal host anomalies require immediate triage. ───────────────────────────────────────────────────────────────────────────── CYBER • Chrome 149 released with 18 vulnerability patches; majority are use-after-free defects with RCE potential. No confirmed in-the-wild exploitation reported as of 25 JUN, but use-after-free class historically weaponized within days of disclosure. Patch priority: HIGH. [SecurityWeek] [HIGH CONFIDENCE] ...

Published Wednesday, June 24, 2026 at 09:01 AM PT 24 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE — LOS ANGELES BLUF: Active exploitation of Oracle PeopleSoft 0-day (ShinyHunters, 100+ orgs confirmed) and Cisco Unified CM critical flaw running concurrently with elevated internal host anomalies — treat as potential active intrusion until ruled out. CYBER Oracle PeopleSoft 0-day exploited by ShinyHunters threat actor; 100+ organizations confirmed breached; scope and CVE identifier not yet fully disclosed; patch status unknown — assess as critical if PeopleSoft is in environment. [The Register Security] [HIGH CONFIDENCE] ...

Published Tuesday, June 23, 2026 at 09:01 AM PT 23 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA BLUF: Russian IAB “FortiBleed” campaign has captured 110M+ credentials via active Fortinet exploitation since Feb 2026; simultaneously, Miasma supply chain campaign now targets AI coding assistant session tokens — both represent direct risk to production credential stores and developer pipelines. CYBER ...

Published Monday, June 22, 2026 at 09:01 AM PT 22 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER, LOS ANGELES BLUF: Microsoft Defender zero-day (RoguePlanet) enables full system compromise on patched Windows 10/11 with no available fix; simultaneous Fortinet credential dump (86K+ accounts), Apple boot bypass, and DPRK NPM supply chain attack create compounding exposure across enterprise and developer toolchains. CYBER RoguePlanet (Microsoft Defender zero-day): Unpatched vulnerability in Defender grants full system access on current Windows 10/11. No patch available as of 0600Z 22 JUN. Actively exploited in the wild per reporting. [SecurityWeek, Live Feed] [HIGH CONFIDENCE] — Prioritize isolation of Windows endpoints; monitor for Defender process anomalies. ...

Published Sunday, June 21, 2026 at 09:01 AM PT 21 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER, LOS ANGELES BLUF: Iranian-affiliated actors actively exploiting Rockwell PLCs across US critical infrastructure; North Korean supply chain attack (144 npm packages, 88 min execution) confirmed; Boyle Heights cold-storage fire producing caustic smoke requiring air quality precautions; three open incidents on local infrastructure including a possible kernel rootkit on pi require immediate attention. ...

Published Saturday, June 20, 2026 at 12:02 PM PT 20 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA BLUF: North Korean supply chain compromise of Mastra AI framework and unpatchable Apple A12/A13 BootROM exploit headline a high-tempo threat day; local infrastructure shows critical service outages and a possible kernel rootkit on pi requiring immediate attention. CYBER Mastra AI supply chain attack attributed to DPRK. Microsoft links North Korean threat actors to compromise of Mastra AI npm framework. Scope of downstream exposure unconfirmed. Any org using Mastra in production pipelines should treat dependencies as suspect. [Microsoft/BleepingComputer] [HIGH CONFIDENCE] ...

Published Friday, June 19, 2026 at 09:01 AM PT 19 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE LEAD | LOS ANGELES, CA BLUF: Three concurrent critical-priority items demand immediate action today — CVE-2026-42530 (NGINX HTTP/3 RCE), CVE-2026-20253 (Splunk unauthenticated RCE, actively exploited, CISA patch deadline THIS SUNDAY), and FortiBleed (86,000 Fortinet devices compromised globally); simultaneously, host “pi” is showing possible kernel-level rootkit indicators requiring immediate triage. ...

Published Thursday, June 18, 2026 at 09:01 AM PT 18 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA BLUF: Critical services down on local infrastructure coincide with a possible kernel rootkit on pi; externally, FortiBleed campaign has compromised 75,000 Fortinet devices and Oracle/F5/Cisco/Atlassian/Splunk all dropped critical patches in the last 24 hours — patch window is urgent. CYBER — EXTERNAL THREAT LANDSCAPE ...