Security

Published Tuesday, June 23, 2026 at 01:12 PM PT BLUF: A large-scale credential theft campaign is actively exploiting CVE-2025-54068 in Laravel Livewire applications. Imperva reports 6,000+ applications compromised. Organizations running Laravel Livewire should treat this as an active incident and apply mitigations immediately. DETAILS Imperva’s Cloud WAF began detecting exploitation attempts against Laravel Livewire applications on May 24, 2026, initially flagged as deserialization attack traffic before being attributed to a coordinated credential theft operation. The vulnerability is tracked as CVE-2025-54068 (note: source material also references CVE-2025-5406 — it is unclear whether these are the same CVE or a transcription error; treat as potentially the same until confirmed). The attack vector involves deserialization abuse within the Livewire component framework, a PHP-based full-stack framework built on Laravel. Imperva characterizes this as a large-scale, organized campaign — not opportunistic scanning — given the volume and consistency of exploitation patterns observed. 6,000+ applications are reported as compromised. The methodology used to arrive at this figure has not been independently confirmed at time of publication. IMPACT Directly affected: Any internet-facing application built on Laravel Livewire — particularly those without a WAF or unpatched against this CVE. Credential theft is the confirmed objective; downstream impacts may include account takeover, lateral movement, and data exfiltration depending on what credentials are exposed. Scope is global; Laravel is widely deployed across industries including SaaS, e-commerce, healthcare, and financial services. Organizations relying solely on perimeter defenses without application-layer controls are at elevated risk. RECOMMENDED ACTIONS Audit immediately — Identify all internal and customer-facing applications running Laravel Livewire. Apply patches — Check Laravel and Livewire official channels for CVE-2025-54068 patches or mitigations; apply without delay. Review WAF rules — Ensure deserialization attack signatures are active and up to date; Imperva Cloud WAF is confirmed blocking. Hunt for indicators — Review application logs for anomalous Livewire component requests, unexpected deserialization activity, or unusual authentication events from May 24, 2026 onward. Rotate credentials — If exploitation cannot be ruled out, treat exposed application credentials as compromised and rotate. Isolate if necessary — Consider taking vulnerable applications offline or behind additional access controls until patched. UNCERTAINTY FLAGS The CVE identifier discrepancy (CVE-2025-54068 vs. CVE-2025-5406) is unresolved — verify against NVD and Imperva’s full advisory before referencing in internal communications. The 6,000+ compromise figure is sourced solely from Imperva at this time; independent corroboration is pending. Full technical details of the exploit chain have not been confirmed in available source material. SOURCES Imperva Threat Research — CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised (May 2026)

Published Tuesday, June 23, 2026 at 01:12 PM PT BLUF: A disgruntled security researcher has publicly dropped an unpatched zero-day vulnerability affecting Microsoft Windows with no coordinated patch release. All Windows users and enterprise environments are potentially at risk. No official Microsoft patch is confirmed available at time of writing. Treat as active threat until patched. DETAILS A security researcher, reportedly in an ongoing dispute with Microsoft over vulnerability handling practices, has publicly released details and/or exploit code for a new Windows zero-day vulnerability without coordinating a patch release with Microsoft. This follows a documented pattern: at least one prior incident involved a separate researcher leaking Microsoft exploits in direct defiance of Microsoft’s disclosure process — suggesting a broader breakdown in researcher-vendor relations. Specific vulnerability class, affected Windows versions, and exploit reliability are NOT confirmed in available reporting at this time. Treat scope as potentially broad pending Microsoft advisory. Microsoft has not issued a patch or official CVE advisory as of this alert. The vulnerability is currently unmitigated by vendor fix. Public disclosure of exploit details significantly accelerates the timeline for threat actor weaponization — exploitation in the wild should be considered a near-term risk. IMPACT Who: All Windows users; enterprise environments running unpatched or standard Windows builds are primary concern. Scope: Unknown until Microsoft confirms affected versions. Assume all supported Windows releases are potentially in scope. Risk elevation: Public exploit availability dramatically lowers the bar for opportunistic attackers and ransomware operators. RECOMMENDED ACTIONS Monitor Microsoft Security Response Center (MSRC) for an emergency out-of-band patch or advisory — apply immediately upon release. Increase endpoint detection monitoring for anomalous Windows process behavior, privilege escalation attempts, and lateral movement indicators. Restrict unnecessary exposure of Windows systems to untrusted networks where feasible pending patch availability. Brief SOC/IR teams now — establish watch posture for exploitation attempts consistent with a new, uncharacterized Windows vulnerability. Do not rely on workarounds until Microsoft or a credible third party confirms effective mitigations for the specific vulnerability class. SOURCES The Register Security — “Angry bug hunter with Microsoft beef drops new Windows 0-day” CSO Online — “Microsoft feud escalates as researcher drops new Windows zero-day” The Register Security — “Another bug hunter leaks Microsoft exploits in defiance of company’s handling of vulnerability disclosures” ⚠️ UNCERTAINTY FLAG: Vulnerability class, CVE identifier, affected Windows versions, and exploit reliability are unconfirmed at time of publication. This alert will require update as Microsoft responds. Do not treat specific technical details as confirmed until official advisory is issued.

Published Tuesday, June 23, 2026 at 01:10 AM PT BLUF: Zero Day Initiative has published continued Day Two results from Pwn2Own Berlin 2026, confirming additional successful exploit demonstrations against enterprise targets. Organizations running affected products should monitor ZDI advisories immediately for patch availability and mitigation guidance. DETAILS ZDI has released updated Day Two results for Pwn2Own Berlin 2026, including a revised Master of Pwn leaderboard reflecting additional successful exploitation attempts. Specific targets and vulnerability classes from this session have not been confirmed in the source data provided — full technical details are pending ZDI’s official write-up. Pwn2Own Berlin 2026 follows the standard ZDI contest format: all demonstrated vulnerabilities are zero-days at time of exploitation, with details embargoed and vendors notified immediately following successful attempts. Affected vendors are notified by ZDI upon successful demonstration per responsible disclosure policy; vendors typically have 90 days to issue patches before public disclosure. Specific products successfully exploited in this session are not confirmed in available source material. Do not assume scope based on prior Pwn2Own events. Contest results indicate competitive participation with a populated leaderboard, suggesting multiple successful exploitation chains were demonstrated across Day Two. IMPACT Who is affected: Organizations running enterprise software, browsers, virtualization platforms, and operating systems historically targeted at Pwn2Own — scope for Berlin 2026 specifically is unconfirmed pending full ZDI disclosure. Severity: Zero-days demonstrated at Pwn2Own are confirmed exploitable by skilled researchers under controlled conditions. Real-world weaponization risk varies; no in-the-wild exploitation of these specific vulnerabilities has been reported at this time. Patch status: Patches are not expected to be immediately available. ZDI’s 90-day disclosure window applies. RECOMMENDED ACTIONS Monitor ZDI’s blog and advisory feed (zerodayinitiative.com) for full Day Two technical summaries and affected product identification as they are published. Identify your exposure to product categories historically targeted at Pwn2Own Berlin (browsers, hypervisors, OS kernels, enterprise applications) and review existing compensating controls. Do not wait for patches — apply defense-in-depth measures including network segmentation, privilege restriction, and endpoint detection tuning for affected product categories once confirmed. Track vendor security bulletins for any out-of-band emergency patches that may follow contest disclosure. SOURCES Zero Day Initiative — Pwn2Own Berlin 2026 Day Two Results (cont): zerodayinitiative.com ZDI Pwn2Own Berlin 2026 Announcement (Zero Day Initiative) ⚠️ UNCERTAINTY FLAG: Specific exploited products, vulnerability classes, prize amounts, and team names from Day Two (cont) are not confirmed in available source data. This alert will require update once ZDI publishes full technical results. Do not redistribute with assumed specifics. ...

Published Monday, June 22, 2026 at 07:08 PM PT BLUF: Threat actor ShinyHunters (tracked as UNC6240) is conducting an active compromise and extortion campaign targeting Oracle PeopleSoft applications, with confirmed focus on the education sector. Organizations running Oracle PeopleSoft should treat this as an active threat and audit exposure immediately. DETAILS Attribution confirmed: Mandiant and Google Threat Intelligence Group (GTIG) have jointly attributed this campaign to UNC6240, a threat actor publicly known as ShinyHunters — a group with a documented history of large-scale data theft and extortion operations. Attack vector: The campaign exploits Oracle PeopleSoft applications. Specific CVE(s) involved have not been confirmed in available reporting at this time — treat all PeopleSoft deployments as potentially at risk pending further disclosure. Campaign nature: Described as an active compromise and extortion campaign, indicating data exfiltration and ransom demands are likely components. Exact extortion methodology is not yet confirmed in available details. Sector targeting: Education sector organizations are the confirmed primary target. Whether additional sectors are affected is not confirmed at this time. Source credibility: Attribution and campaign details originate from Mandiant and GTIG — high-confidence sources with direct incident response visibility. IMPACT Who is affected: Higher education institutions and K-12 organizations running Oracle PeopleSoft — commonly used for student information systems (SIS), HR, and financial management. Data at risk: PeopleSoft environments in education typically contain highly sensitive PII including student records, financial aid data, employee records, and Social Security Numbers. Scope: Campaign is described as active. Scope of confirmed victim count is not available in current reporting. RECOMMENDED ACTIONS Audit immediately: Identify all Oracle PeopleSoft instances in your environment, including internet-facing deployments and administrative portals. Restrict access: Limit external access to PeopleSoft interfaces where operationally feasible; enforce MFA on all administrative accounts. Patch posture review: Verify all available Oracle PeopleSoft patches and CPU (Critical Patch Update) releases are applied — prioritize any recent updates. Hunt for indicators: Engage threat hunting for anomalous authentication, data staging, or exfiltration activity within PeopleSoft environments. Contact Mandiant/GTIG for IOCs if available through your threat intel subscriptions. Incident response readiness: If compromise is suspected, isolate affected systems and engage IR resources. Do not negotiate with threat actors without legal counsel. Notify stakeholders: If student or employee data may be affected, begin preliminary breach notification assessment per applicable regulations (FERPA, state breach laws). ⚠️ UNCERTAINTY FLAG: Specific CVE(s) being exploited, full IOC sets, and confirmed victim count are not available in current reporting. This alert will require update as Mandiant/GTIG release additional technical details. ...

Published Monday, June 22, 2026 at 01:07 PM PT BLUF: A zero-day vulnerability linked to Microsoft’s “Nightmare” flaw class enables attackers to bypass BitLocker encryption protections; all organizations relying on BitLocker for data-at-rest security on Windows devices should treat this as an active threat. Patch status and full exploitation scope are not yet fully confirmed — treat as high-priority pending further vendor guidance. ...

Published Monday, June 22, 2026 at 07:06 AM PT BLUF: Threat actor group ShinyHunters continues executing large-scale data breaches without relying on malware or zero-day exploits, demonstrating that stolen credentials and misconfigured access remain sufficient to compromise major organizations. Any enterprise dependent on cloud services or SaaS platforms is in scope. ...

Published Sunday, June 21, 2026 at 07:05 PM PT BLUF: Google has patched a fifth actively exploited zero-day vulnerability in Chrome this year. All users and organizations running unpatched versions of Chrome are at risk. Update immediately. DETAILS Google has confirmed a fifth Chrome zero-day vulnerability exploited in the wild in 2026, continuing a pattern of repeated active exploitation against the browser this year. The vulnerability is tracked as CVE-2026-11645. Google has released emergency updates to address it. Active exploitation has been confirmed; however, specific threat actor attribution, attack vectors, and the full technical nature of the vulnerability have not been publicly confirmed at this time. Google’s disclosure follows its standard limited-detail policy during active exploitation windows — full technical details are likely being withheld to allow user patching time. This is the fifth zero-day patched in Chrome in 2026 alone, indicating sustained, active targeting of the browser by threat actors. IMPACT Who is affected: All users and organizations running Google Chrome on any platform (Windows, macOS, Linux, Android) on unpatched versions. Scope: Potentially global and broad — Chrome holds a dominant share of browser market usage across enterprise and consumer environments. Severity: Active exploitation confirmed. Risk level is HIGH until patching is complete. Uncertainty flag: Specific exploitation targets (e.g., targeted campaigns vs. opportunistic) are not confirmed. Do not assume your organization is or is not targeted. RECOMMENDED ACTIONS Update Chrome immediately — navigate to Settings > Help > About Google Chrome to force an update and relaunch. Verify version — confirm all endpoints are running the patched version released with this emergency update. Check Google’s official release notes for the confirmed safe version number. Prioritize enterprise fleet patching — push updates via endpoint management tools (Intune, SCCM, etc.) without waiting for user-initiated updates. Monitor threat intelligence feeds for emerging indicators of compromise (IOCs) as technical details are released post-patch. Consider temporary browser restrictions in high-sensitivity environments if immediate patching is not feasible. SOURCES The Register Security — “Chrome’s zero-day Whac-A-Mole continues with fifth exploited bug of the year” SOC Prime — CVE-2026-11645: Chrome Zero-Day Vulnerability Exploited in the Wild Google Chrome release channel (verify patched version number directly at chromereleases.googleblog.com) ⚠ NOTE: Technical exploitation details remain limited pending Google’s post-patch disclosure. This alert will require update as additional confirmed information becomes available. Do not act on unverified third-party claims about attack specifics.

Published Sunday, June 21, 2026 at 07:03 AM PT BLUF: CISA has issued an alert confirming Iranian-affiliated cyber actors are actively exploiting internet-exposed Programmable Logic Controllers (PLCs) across U.S. critical infrastructure. Rockwell Automation/Allen-Bradley PLCs are confirmed affected. Operators must remove PLCs from direct internet exposure immediately. DETAILS Confirmed affected hardware: Rockwell Automation/Allen-Bradley manufactured PLCs. CISA indicates other PLC brands may also be at risk — scope beyond Rockwell is not yet fully confirmed. Attack vector: Direct internet exposure of PLCs is the confirmed entry point. Actors are exploiting this exposure to achieve compromise — specific CVEs or exploit methods have not been confirmed in available alert text. Threat actor attribution: Iranian-affiliated cyber actors — specific group designation not confirmed in available details. IOCs available: CISA has published Indicators of Compromise (IOCs) for log querying. Full IOC list not reproduced here — operators should retrieve directly from CISA advisory. Sector targeting: U.S. critical infrastructure broadly — specific sectors (water, energy, manufacturing, etc.) not confirmed in available alert excerpt. IMPACT Who is affected: U.S. critical infrastructure operators running internet-exposed PLCs, with confirmed risk to Rockwell Automation/Allen-Bradley deployments. Potential exposure extends to operators of other PLC brands. Operational risk: Successful PLC compromise can enable disruption, manipulation, or sabotage of industrial control system (ICS) processes — physical consequences possible depending on sector. Scope: Assessed as broad given the targeting of critical infrastructure categories. Full scope of active exploitation is not yet confirmed in available details. RECOMMENDED ACTIONS Immediately remove PLCs from direct internet exposure — place behind secure gateways and properly configured firewalls. Query available logs against CISA-published IOCs — retrieve full IOC list directly from the official CISA advisory. Audit all remote access paths to ICS/OT environments; disable any unnecessary external-facing interfaces. Verify firmware integrity on affected Rockwell Automation/Allen-Bradley devices where possible. Report confirmed compromises to CISA at report@cisa.gov. SOURCES Primary: CISA Alert — Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across U.S. Critical Infrastructure Full advisory and IOCs: cisa.gov ⚠️ Note: Alert excerpt provided was partial. Details on specific CVEs, targeted sectors, and full IOC list are sourced directly from CISA. Operators should consult the complete advisory before drawing conclusions on scope. ...

Published Sunday, June 21, 2026 at 07:03 AM PT BLUF: Google Threat Intelligence has published findings from its 2025 zero-day exploitation review, confirming active exploitation of enterprise network technologies and mobile/browser platforms by state-sponsored actors and commercial surveillance vendors (CSVs). Organizations running enterprise edge and network infrastructure should treat unpatched systems as actively targeted. Apply all available vendor patches immediately. ...

Published Sunday, June 21, 2026 at 07:02 AM PT BLUF: Threat actor UNC6201 is actively exploiting a zero-day vulnerability in Dell RecoverPoint for Virtual Machines to deploy multiple malware families, including a previously undocumented backdoor designated GRIMBOLT. Organizations running Dell RecoverPoint for Virtual Machines should treat this as an active threat and apply mitigations immediately pending patch availability. DETAILS Threat actor: UNC6201, a tracked intrusion set with prior attribution to espionage-motivated operations — specific nation-state nexus not confirmed in this reporting Zero-day target: Dell RecoverPoint for Virtual Machines — a disaster recovery and data replication platform commonly deployed in enterprise and virtualized environments Malware deployed: Three distinct tools confirmed — SLAYSTYLE, BRICKSTORM (previously documented), and GRIMBOLT, a novel backdoor not previously observed in the wild Initial access vector: NOT CONFIRMED — Google Threat Intelligence reporting explicitly states the initial access method was not verified; exploitation of the Dell RecoverPoint zero-day is suspected but not conclusively established as the sole entry point GRIMBOLT details: Limited technical specifics available at time of publication; classified as a backdoor; full capability assessment is ongoing IMPACT Directly affected: Organizations using Dell RecoverPoint for Virtual Machines in enterprise and virtualized infrastructure environments Scope: Potentially broad — RecoverPoint is widely deployed across sectors including financial services, healthcare, government, and critical infrastructure Risk level: HIGH — zero-day exploitation combined with multi-tool malware deployment indicates a sophisticated, prepared threat actor; BRICKSTORM has previously been associated with network appliance targeting and persistent access operations Secondary risk: GRIMBOLT’s novelty means existing detection signatures may not flag it; dwell time in affected environments is unknown RECOMMENDED ACTIONS Audit immediately — Identify all Dell RecoverPoint for Virtual Machines instances in your environment and assess exposure Monitor for indicators — Request IOCs associated with SLAYSTYLE, BRICKSTORM, and GRIMBOLT from your threat intelligence provider; update detection rules accordingly Review Dell advisories — Check Dell’s security advisory portal for patch status or compensating controls; apply any available mitigations without delay Hunt for lateral movement — Given confirmed multi-tool deployment, assume post-exploitation activity may extend beyond the initial access point Restrict access — Where operationally feasible, limit network exposure of RecoverPoint management interfaces pending remediation Preserve logs — Retain all relevant system and network logs for forensic investigation SOURCES Google Threat Intelligence — “From BRICKSTORM to GRIMBOLT: UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day” ⚠️ UNCERTAINTY FLAG: Initial access vector is unconfirmed per source reporting. GRIMBOLT technical capabilities are not yet fully characterized. This alert will require update as additional details are published.