Osint

Published Tuesday, June 30, 2026 at 09:01 AM PT 30 JUN 2026 | PREPARED FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER, LOS ANGELES BLUF: Windows BlueHammer flaw now ransomware-weaponized per CISA KEV; SimpleHelp CVE-2026-48558 actively exploited for credential theft; Oracle E-Business Suite and Kemp LoadMaster flaws entering exploitation phase — patch windows are closing. CYBER Windows BlueHammer vulnerability added to CISA Known Exploited Vulnerabilities catalog; ransomware gangs confirmed active exploitation as of 30 JUN. [CISA/BleepingComputer] [HIGH CONFIDENCE] Treat as zero-day posture until patched. SimpleHelp CVE-2026-48558 (critical, pre-auth) exploited in the wild; threat actor deploying TaskWeaver and Djinn Stealer to harvest credentials, SSH keys, cryptocurrency wallets, and dev tooling. [SecurityWeek/The Hacker News] [HIGH CONFIDENCE] Any SimpleHelp RMM instance exposed to internet is a priority target. Oracle E-Business Suite critical flaw (unauthenticated takeover of Payments module) entering active exploitation. Oracle PeopleSoft separately confirmed breached across 100+ organizations; Nissan employee data confirmed exfiltrated. [SecurityWeek] [HIGH CONFIDENCE] Audit Oracle footprint immediately if EBS or PeopleSoft in environment. Progress Kemp LoadMaster pre-auth flaw allows root command execution. No patch-confirmed exploitation reported yet but vulnerability class and exposure profile make weaponization imminent. [The Hacker News] [MODERATE CONFIDENCE] Malicious Chromium extension spoofing Perplexity AI confirmed intercepting browser searches; Google removed it post-Microsoft disclosure. [CSO Online] Check browser extension inventories on engineering workstations — developer environments are the target profile. BioShocking attack technique disclosed: AI-integrated browsers can be manipulated into leaking user credentials via crafted prompts. [The Hacker News] [MODERATE CONFIDENCE] Relevant if Copilot, Gemini, or similar AI browser integrations are in use. Ransomware syndicates operating with corporate org structures: tiered pricing, outsourced labor, affiliate models. Blackfield ransomware demanding $2M from Nidec Corporation. [CyberScoop/BleepingComputer] Operational context, not immediate action item. SUPPLY CHAIN / DEPENDENCY ...

Published Monday, June 29, 2026 at 09:01 AM PT 29 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA BLUF: Oracle PeopleSoft zero-day exploitation is active and widening; patch or isolate all PeopleSoft and Oracle E-Business Suite instances immediately. CYBER Oracle PeopleSoft zero-day actively exploited. NAIC (National Association of Insurance Commissioners) confirmed breach; ShinyHunters claims 3.1 TB exfiltrated. Nissan separately confirmed payroll records and SSNs exposed via same attack vector. Two confirmed victims in 24h window suggests broad scanning campaign underway. [SecurityWeek, The Register] [HIGH CONFIDENCE] ...

Published Sunday, June 28, 2026 at 09:01 AM PT LOS ANGELES, CA | 28 JUN 2026 | CLASSIFICATION: UNCLASSIFIED//FOR OFFICIAL USE BLUF: CISA added 10+ KEVs to catalog this week across multiple batches; Mirai variant Nexcorium actively exploiting IoT vulnerabilities at scale; China-to-Iran missile transfers confirmed by US intelligence — regional escalation risk elevated. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ CYBER • CISA added 10 vulnerabilities to KEV catalog across three separate advisories this week (one, two, and seven CVE batches). Full CVE list not yet parsed from feed truncation — cross-reference cisa.gov/known-exploited-vulnerabilities-catalog immediately. BOD 26-04 now establishes mandatory timelines for FCEB agencies; private sector should treat as floor, not ceiling. [CISA] [HIGH CONFIDENCE] ...

Published Saturday, June 27, 2026 at 09:04 AM PT 27 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE — LOS ANGELES BLUF: Three concurrent actively-exploited vulnerabilities (Cisco Unified Communications, Cisco Catalyst SD-WAN, PTC Windchill) demand immediate patch action; supply chain compromise of Nx Console and npm ecosystem is ongoing; promiscuous mode detection on a core internal system requires immediate investigation. CYBER Cisco Unified Communications — CISA KEV, patch deadline 29 JUN (Sunday). Vulnerability under active exploitation. Federal agencies mandated; all orgs should treat deadline as binding. CVE details in KEV catalog. [CISA] [HIGH CONFIDENCE] ...

Published Thursday, June 25, 2026 at 09:01 AM PT 25 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA ───────────────────────────────────────────────────────────────────────────── BLUF: Patch Chrome 149 and GitLab now; Akira ransomware affiliate active via novel exfiltration channel; device code phishing ecosystem (Kali365) at scale; Cal Water incident warrants Southern California water infrastructure awareness; internal host anomalies require immediate triage. ───────────────────────────────────────────────────────────────────────────── CYBER • Chrome 149 released with 18 vulnerability patches; majority are use-after-free defects with RCE potential. No confirmed in-the-wild exploitation reported as of 25 JUN, but use-after-free class historically weaponized within days of disclosure. Patch priority: HIGH. [SecurityWeek] [HIGH CONFIDENCE] ...

Published Wednesday, June 24, 2026 at 09:01 AM PT 24 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE — LOS ANGELES BLUF: Active exploitation of Oracle PeopleSoft 0-day (ShinyHunters, 100+ orgs confirmed) and Cisco Unified CM critical flaw running concurrently with elevated internal host anomalies — treat as potential active intrusion until ruled out. CYBER Oracle PeopleSoft 0-day exploited by ShinyHunters threat actor; 100+ organizations confirmed breached; scope and CVE identifier not yet fully disclosed; patch status unknown — assess as critical if PeopleSoft is in environment. [The Register Security] [HIGH CONFIDENCE] ...

Published Tuesday, June 23, 2026 at 09:01 AM PT 23 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA BLUF: Russian IAB “FortiBleed” campaign has captured 110M+ credentials via active Fortinet exploitation since Feb 2026; simultaneously, Miasma supply chain campaign now targets AI coding assistant session tokens — both represent direct risk to production credential stores and developer pipelines. CYBER ...

Published Monday, June 22, 2026 at 09:01 AM PT 22 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER, LOS ANGELES BLUF: Microsoft Defender zero-day (RoguePlanet) enables full system compromise on patched Windows 10/11 with no available fix; simultaneous Fortinet credential dump (86K+ accounts), Apple boot bypass, and DPRK NPM supply chain attack create compounding exposure across enterprise and developer toolchains. CYBER RoguePlanet (Microsoft Defender zero-day): Unpatched vulnerability in Defender grants full system access on current Windows 10/11. No patch available as of 0600Z 22 JUN. Actively exploited in the wild per reporting. [SecurityWeek, Live Feed] [HIGH CONFIDENCE] — Prioritize isolation of Windows endpoints; monitor for Defender process anomalies. ...

Published Sunday, June 21, 2026 at 09:01 AM PT 21 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER, LOS ANGELES BLUF: Iranian-affiliated actors actively exploiting Rockwell PLCs across US critical infrastructure; North Korean supply chain attack (144 npm packages, 88 min execution) confirmed; Boyle Heights cold-storage fire producing caustic smoke requiring air quality precautions; three open incidents on local infrastructure including a possible kernel rootkit on pi require immediate attention. ...

Published Saturday, June 20, 2026 at 12:02 PM PT 20 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA BLUF: North Korean supply chain compromise of Mastra AI framework and unpatchable Apple A12/A13 BootROM exploit headline a high-tempo threat day; local infrastructure shows critical service outages and a possible kernel rootkit on pi requiring immediate attention. CYBER Mastra AI supply chain attack attributed to DPRK. Microsoft links North Korean threat actors to compromise of Mastra AI npm framework. Scope of downstream exposure unconfirmed. Any org using Mastra in production pipelines should treat dependencies as suspect. [Microsoft/BleepingComputer] [HIGH CONFIDENCE] ...