Pdb

Published Friday, June 19, 2026 at 09:01 AM PT 19 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE LEAD | LOS ANGELES, CA BLUF: Three concurrent critical-priority items demand immediate action today — CVE-2026-42530 (NGINX HTTP/3 RCE), CVE-2026-20253 (Splunk unauthenticated RCE, actively exploited, CISA patch deadline THIS SUNDAY), and FortiBleed (86,000 Fortinet devices compromised globally); simultaneously, host “pi” is showing possible kernel-level rootkit indicators requiring immediate triage. ...

Published Thursday, June 18, 2026 at 09:01 AM PT 18 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA BLUF: Critical services down on local infrastructure coincide with a possible kernel rootkit on pi; externally, FortiBleed campaign has compromised 75,000 Fortinet devices and Oracle/F5/Cisco/Atlassian/Splunk all dropped critical patches in the last 24 hours — patch window is urgent. CYBER — EXTERNAL THREAT LANDSCAPE ...

Published Wednesday, June 17, 2026 at 09:02 AM PT 17 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER, LOS ANGELES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ BLUF: Raspberry Pi host (“pi”) showing kernel-level rootkit indicators alongside SCA failure and FIM hits — treat as compromised until cleared; simultaneously, four AI/chat services are down and lateral movement signals are present on the network. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ LOCAL INFRASTRUCTURE — PRIORITY ONE ...

Published Tuesday, June 16, 2026 at 09:01 AM PT 16 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER, LOS ANGELES BLUF: Iran-linked Handala group has directly targeted California water infrastructure (Cal Water); simultaneously, four actively-exploited CVEs across Cisco SD-WAN, Fortinet FortiSandbox, cPanel/LiteSpeed, and a major AUR supply chain compromise demand immediate patch prioritization — your own network shows anomalous user/group creation and crontab modification on host “nuk” requiring same-day investigation. ...

Published Monday, June 15, 2026 at 09:00 AM PT 15 JUN 2026 | PREPARED FOR: SENIOR SRE/INFRASTRUCTURE — LOS ANGELES BLUF: PAN-OS GlobalProtect VPN under active exploitation; simultaneously, critical internal services (mlx_chat, openwebui, searxng, tinychat) are down and Wazuh event queue overflow on Office-M4-2.local is creating a monitoring blind spot. CYBER Palo Alto Networks confirmed active in-the-wild exploitation of a PAN-OS GlobalProtect VPN flaw. CVE details not yet fully disclosed in available feeds; patch or mitigate immediately if GlobalProtect is in your perimeter. [The Hacker News / Palo Alto PSIRT] [HIGH CONFIDENCE] FBI + Google jointly dismantled “Outsider Enterprise” phishing-as-a-service platform: 9,000+ phishing sites, ~4M credit cards stolen, ~$1.9B in losses attributed. Takedown does not eliminate downstream operators who purchased access — credential reuse risk persists. [SecurityWeek / FBI] [HIGH CONFIDENCE] ShinyHunters claims breach of Council of Europe: 297 GB allegedly exfiltrated including employee PII. Unverified; ShinyHunters has a credible track record. If your org has any Council of Europe vendor or SSO relationships, treat as potential supply-chain exposure. [SecurityWeek] [MODERATE CONFIDENCE] Maine AG disabled state data breach notification portal after fraudulent submissions (fake VRChat, Discord breach reports). Signals active manipulation of regulatory reporting infrastructure — relevant if your compliance workflows depend on state AG portals for breach notification. [SecurityWeek] Non-human identity sprawl flagged as systemic risk: bots, service accounts, API keys, OAuth tokens now outnumber human identities in most large enterprises. Governance gap is the primary attack surface. [CSO Online] AI agent prompt injection and runtime compromise remain unpatched threat class. Six runtime signals identified for detection: anomalous API calls to CRMs, refund APIs, ticketing systems; unexpected outbound email; calendar access outside business logic. Relevant if you are running any LLM agents with tool access. [CSO Online / Simon Willison] PHYSICAL / LOCAL (Southern California) ...

Published Sunday, June 14, 2026 at 09:00 AM PT 14 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER, LOS ANGELES BLUF: Microsoft’s record 206-CVE Patch Tuesday and an unpatched Oracle flaw under active exploitation by ShinyHunters demand immediate triage; local host “pi” shows degraded security posture and elevated threat score requiring same-day review. CYBER Microsoft released 206 CVEs on 10 JUN Patch Tuesday — largest single-cycle disclosure on record. Volume indicates systemic code quality degradation across the Windows/Azure/M365 stack. Prioritize RCE and privilege escalation classes first. [CyberScoop] [HIGH CONFIDENCE] ...

Published Saturday, June 13, 2026 at 09:01 AM PT 13 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ BLUF: Iranian group Handala claims breach of California Water Service with 5GB exfiltrated including RTKBase OT credentials — direct threat to Southern California water infrastructure; simultaneously, 400+ Arch Linux AUR packages compromised with eBPF rootkit and infostealer active in the wild. ...

Published Friday, June 12, 2026 at 09:01 AM PT 12 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER, LOS ANGELES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ BLUF: Oracle PeopleSoft zero-day (CVE-2026-35273) actively exploited by ShinyHunters against US universities; Ivanti Sentry command injection hitting honeypots with CISA-mandated federal patch deadline this Sunday; local infrastructure shows service outages and hardening deficits requiring immediate attention. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ CYBER CVE-2026-35273 (Oracle PeopleSoft): ShinyHunters exploiting unauthenticated RCE zero-day. Oracle mitigated but has not issued formal CVE disclosure. 68% of confirmed victims in higher education sector. Attacker staging servers had open directory listings — Mandiant/GTIG performed artifact recovery. Patch status: mitigation deployed by Oracle server-side; verify any self-hosted PeopleSoft instances immediately. [Mandiant, SecurityWeek, Google GTIG] [HIGH CONFIDENCE] ...

11 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE ENGINEER | LOS ANGELES, CA BLUF: Three actively-exploited critical vulnerabilities (Exchange CVE-2026-42897, Ivanti Sentry max-severity, Langflow path traversal) demand immediate patch triage; local infrastructure shows a crash storm on primary host and a critical service outage requiring same-day resolution. CYBER CVE-2026-42897 (Microsoft Exchange Server): Zero-day exploitation confirmed in the wild since 14 MAY; patch released this cycle. Attack surface: any internet-facing Exchange instance. Patch immediately — exploitation predates patch availability by ~4 weeks. [SecurityWeek] [HIGH CONFIDENCE] ...

10 JUN 2026 | FOR: SENIOR SRE/INFRASTRUCTURE — LOS ANGELES BLUF: June 2026 Patch Tuesday is record-breaking at 206 CVEs with one zero-day (RoguePlanet) already exploited in the wild; Ivanti Sentry carries a max-severity unauthenticated RCE; ServiceNow is actively being exploited against customer instances — patch or mitigate all three today. CYBER PATCH TUESDAY — IMMEDIATE ACTION REQUIRED Microsoft patched 206 vulnerabilities 09 JUN, largest single Patch Tuesday on record. Three publicly disclosed zero-days: YellowKey, GreenPlasma, MiniPlasma. [BleepingComputer, CrowdStrike] [HIGH CONFIDENCE] RoguePlanet (CVE unconfirmed at time of writing): race condition in Microsoft Defender exploited in the wild, achieves LPE to SYSTEM on fully-patched Windows. Public exploit code released. Patch deployment blocked on some endpoints due to separate Windows Update installation failure — verify patch status manually. [SecurityWeek, BleepingComputer, Rapid7] [HIGH CONFIDENCE] Ivanti Sentry (formerly MobileIron Sentry): two critical vulnerabilities disclosed 09 JUN, at least one rated max severity. Unauthenticated OS command injection → remote code execution as root. Ivanti has prior exploitation history; treat as actively targeted until confirmed otherwise. [Rapid7, BleepingComputer] [HIGH CONFIDENCE] ServiceNow: vulnerability known internally since 07 APR 2026 patched only after confirmed exploitation against customer instances. Unauthorized access to customer data confirmed. If your org uses ServiceNow SaaS, verify your instance is on current patch level and audit access logs from 07 APR forward. [SecurityWeek, The Hacker News, BleepingComputer] [HIGH CONFIDENCE] Arista EOS: actively exploited vulnerability, no patch planned. Vendor advises mitigations or device retirement. Relevant if your network stack includes Arista switching/routing. [SecurityWeek] [HIGH CONFIDENCE] SAP NetWeaver and Commerce Cloud: critical flaws patched 09-10 JUN. NetWeaver has been a high-value target for Chinese APT activity in prior cycles. [BleepingComputer] [MODERATE CONFIDENCE] OpenSSL: high-severity vulnerability patched in latest release; 18 total CVEs addressed, several AI-assisted discoveries. Update OpenSSL across all services and container base images. [SecurityWeek] [HIGH CONFIDENCE] ICS/OT — DATA CENTER PHYSICAL SYSTEMS ...