Security

Published Sunday, June 21, 2026 at 01:01 AM PT BLUF: Threat actors are actively exploiting a ViewState deserialization vulnerability (CVE-2026-5426) in the KnowledgeDeliver platform, enabled by identical pre-shared ASP.NET machine keys shared across multiple customer deployments. All KnowledgeDeliver customers should treat their deployments as potentially compromised pending investigation. DETAILS Root cause confirmed: Identical ASP.NET machine keys deployed across multiple KnowledgeDeliver customer instances enabled ViewState deserialization attacks — a known high-risk configuration that allows unauthenticated remote code execution when machine keys are known or shared. Zero-day origin: The vulnerability was initially exploited as a zero-day before public disclosure; it is now formally tracked as CVE-2026-5426. Patch availability status is not confirmed in available intelligence at this time. Multi-tenant exposure: The shared machine key architecture means exploitation of one deployment may provide keys applicable to other affected customer environments — scope of compromise may extend beyond initially identified victims. Attribution: Google Threat Intelligence is tracking active exploitation. Threat actor identity, tooling, and campaign objectives are not confirmed in available reporting. Exploitation mechanism: ASP.NET ViewState deserialization via known machine keys is a well-documented attack class; exploitation typically yields remote code execution on the web server. IMPACT Who is affected: Organizations running KnowledgeDeliver deployments, particularly those using default or vendor-supplied ASP.NET machine key configurations. Scope: Multi-customer; exact number of affected deployments is unconfirmed. Potential impact: Full remote code execution on affected web servers; lateral movement, data exfiltration, and persistence are plausible follow-on actions — not yet confirmed by available reporting. RECOMMENDED ACTIONS Immediately rotate ASP.NET machine keys on all KnowledgeDeliver deployments; generate unique keys per environment. Audit web server logs for anomalous ViewState payloads or unexpected process execution originating from web worker processes. Isolate affected systems if active compromise indicators are identified pending forensic review. Contact KnowledgeDeliver vendor for official patch status, indicators of compromise (IOCs), and remediation guidance. Monitor Google Threat Intelligence and CVE-2026-5426 advisories for updated patch and IOC releases. SOURCES Google Threat Intelligence — Active exploitation reporting, CVE-2026-5426 tracking CVE Record: CVE-2026-5426 ⚠️ UNCERTAINTY FLAG: Patch availability, confirmed victim count, threat actor attribution, and full exploitation chain details are not confirmed in current reporting. This alert will require update as additional intelligence becomes available. ...

Published Friday, June 19, 2026 at 12:28 PM PT BLUF: Rapid7 has released new Metasploit modules including a full unauthenticated RCE exploit chain targeting Paperclip AI and a Windows local privilege escalation module abusing NTLM relay-to-self via WebDAV. Organizations running Paperclip AI or Windows domain-joined systems should treat this as an active exploitation risk — weaponized, ready-to-run exploit code is now publicly available. ...

Published Friday, June 19, 2026 at 06:27 AM PT BLUF: CISA has added a Splunk Enterprise vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Federal agencies and all Splunk Enterprise operators are directed to patch immediately — deadline reported as this Sunday. DETAILS CISA has formally catalogued a Splunk Enterprise flaw as actively exploited, triggering mandatory remediation timelines under Binding Operational Directive (BOD) 22-01 for federal civilian agencies The Sunday patch deadline indicates CISA assessed exploitation risk as severe enough to compress the standard 3-week KEV remediation window — specific CVE identifier and technical vulnerability class not confirmed in available reporting at time of publication Active exploitation status means threat actors have demonstrated working capability against unpatched Splunk Enterprise instances in real-world environments — not theoretical Splunk Enterprise is widely deployed as a SIEM and log aggregation platform, meaning compromise could grant attackers visibility into an organization’s security telemetry and detection infrastructure — a high-value target ⚠️ UNCERTAINTY FLAG: Specific CVE number, CVSS score, attack vector (network vs. local), and whether authentication is required have not been confirmed in available source material. Consult CISA KEV catalog and Splunk’s security advisories directly for technical specifics IMPACT Who: All organizations running Splunk Enterprise — federal agencies under mandatory BOD 22-01 compliance, but scope extends to all sectors What’s at risk: Splunk instances often sit at the center of security operations; a compromised SIEM can blind defenders, expose ingested log data, and provide lateral movement opportunities Scope: Broad — Splunk Enterprise is deployed across government, financial services, healthcare, critical infrastructure, and enterprise environments globally RECOMMENDED ACTIONS Patch immediately — Access Splunk’s official security advisories at splunk.com/en_us/product-security.html and apply the relevant patch before Sunday Identify exposure — Audit all Splunk Enterprise instances, including version numbers; prioritize internet-facing deployments Check for indicators of compromise — Review Splunk internal logs and access records for anomalous activity, particularly unusual search queries, data exports, or admin-level actions Restrict access — If patching cannot be completed before the deadline, consider isolating Splunk management interfaces from external network access as a temporary mitigation Federal agencies — BOD 22-01 compliance is mandatory; escalate to CISO immediately if patch cannot be applied by deadline SOURCES BleepingComputer — CISA: Splunk Enterprise flaw actively exploited, patch by Sunday CISA Known Exploited Vulnerabilities Catalog: cisa.gov/known-exploited-vulnerabilities-catalog Splunk Security Advisories: splunk.com/en_us/product-security.html ⚠️ Technical specifics (CVE, attack vector, affected versions) unconfirmed at time of publication. Verify against CISA KEV and Splunk advisories before scoping remediation.

Published Friday, June 19, 2026 at 12:26 AM PT BLUF: Accenture has announced acquisition of a majority stake in industrial cybersecurity firm Dragos at a $3.25 billion valuation, signaling significant consolidation in the operational technology (OT) security sector. Critical infrastructure operators and industrial organizations using or evaluating Dragos products and services should monitor for potential changes to service delivery, licensing, and vendor relationships. ...

Published Thursday, June 18, 2026 at 11:54 AM PT BLUF: Accenture has committed $4.18 billion to acquire a majority stake in Dragos and full ownership of runZero and NetRise, marking a major consolidation in operational technology (OT) and industrial cybersecurity. Organizations relying on these platforms should monitor for service, licensing, or support changes during integration. DETAILS Accenture is acquiring a majority stake in Dragos — a leading OT/ICS threat detection and intelligence platform — alongside full acquisitions of runZero (network discovery/asset management) and NetRise (firmware and software supply chain security) Total deal value reported at $4.18 billion, per CyberScoop and SecurityWeek; deal structure details and closing timeline are not yet fully confirmed in available reporting Accenture characterizes this as its first major push into OT software, distinct from its existing consulting and managed services business The move is explicitly framed as a response to AI-driven threats intensifying against critical infrastructure — energy, manufacturing, utilities, and industrial control environments All three acquired companies operate in distinct but complementary layers of OT/ICS security: threat detection (Dragos), asset visibility (runZero), and supply chain/firmware risk (NetRise) IMPACT Current Dragos, runZero, and NetRise customers face potential changes to product roadmaps, pricing, support structures, and integration priorities — standard risk in large acquisition events Critical infrastructure operators (energy, water, manufacturing, transportation) who depend on these tools for OT visibility and threat detection should engage vendors directly for continuity assurances Competitive landscape shift: Consolidation of three specialized OT security vendors under a single consulting giant may reduce independent vendor options in the ICS/OT market Scope: Global — all three companies serve enterprise and critical infrastructure clients across multiple sectors and geographies RECOMMENDED ACTIONS If you are a Dragos, runZero, or NetRise customer: Contact your account representative now to request clarity on contract continuity, SLA commitments, and roadmap plans post-acquisition Security and procurement teams: Review vendor dependency risk; assess whether acquisition changes your organization’s risk posture or compliance positioning (particularly relevant for CMMC, NERC CIP environments) OT/ICS security leads: Monitor Accenture, Dragos, runZero, and NetRise official channels for integration announcements — no operational changes confirmed at this time No immediate technical threat action required — this is a market/vendor risk event, not an active exploit or breach SOURCES CyberScoop: Accenture shells out $4.18B on three companies in big industrial cybersecurity push SecurityWeek: Accenture to Acquire Majority Stake in Dragos, All of runZero, NetRise in $4.1 Billion OT Cybersecurity Push ⚠ NOTE: Deal closing conditions, timelines, and post-acquisition operational details are not yet confirmed. This alert reflects announced intent only. Monitor for official regulatory filings and vendor communications.

Published Thursday, June 18, 2026 at 05:53 AM PT BLUF: Israeli cybersecurity startup Dream has closed a $260 million funding round at a $3 billion valuation, signaling accelerating institutional investment in sovereign AI-driven cyber defense platforms targeting governments and critical infrastructure operators. No immediate threat action required — situational awareness recommended for procurement and strategy stakeholders. ...

Published Wednesday, June 17, 2026 at 11:22 PM PT BLUF: Australia’s Cyber and Infrastructure Security Centre (CISC) has announced Enhanced Critical Infrastructure Risk Management Program (CIRMP) Rules, expanding mandatory security obligations for critical infrastructure operators to explicitly address AI systems, legacy OT environments, supply chain risks, and insider threats. Operators subject to the Security of Critical Infrastructure (SOCI) Act should review compliance obligations immediately. ...

Published Wednesday, June 17, 2026 at 11:21 PM PT BLUF: iOT365 has released a multi-vector detection model targeting post-quantum cyber threats against operational technology (OT) environments. Critical infrastructure operators should assess applicability to their OT/ICS environments as quantum-era threat timelines accelerate. DETAILS iOT365 has introduced a new detection capability specifically designed for OT environments, focused on identifying threats associated with emerging post-quantum attack vectors — details on technical architecture and specific detection methods are not yet confirmed in available reporting. The release aligns with a broader industry recognition that “harvest now, decipher later” (HNDL) attacks — where adversaries collect encrypted OT traffic today for future quantum decryption — represent an active and growing risk to critical infrastructure. UK NCSC has issued formal guidance on post-quantum cryptography migration timelines, signaling regulatory and national security urgency around this threat class. Google has begun implementing post-quantum cryptography (PQC) in Android, indicating the broader technology ecosystem is actively transitioning — OT environments, which typically have longer refresh cycles, remain disproportionately exposed. NOTE: Specific technical capabilities, pricing, deployment requirements, and independent validation of iOT365’s detection model are unconfirmed at this time. IMPACT Who: Critical infrastructure operators across energy, water, manufacturing, and transportation sectors running legacy OT/ICS systems. Scope: OT environments are particularly vulnerable due to long asset lifecycles, limited patching cadence, and historically weak encryption implementations — making them high-value targets for HNDL collection now. Threat horizon: Cryptographically relevant quantum computers capable of breaking current encryption are not confirmed as operational; however, adversary data collection in anticipation of that capability is assessed as ongoing. RECOMMENDED ACTIONS Inventory OT encryption dependencies — identify systems relying on RSA, ECC, or other quantum-vulnerable cryptographic standards. Review NCSC post-quantum migration timelines and begin internal planning cycles — OT migration lead times are significantly longer than IT environments. Evaluate iOT365’s detection model against your environment’s specific OT protocols and threat profile — independent validation recommended before deployment. Assume HNDL collection is active — treat sensitive OT communications as potentially compromised in a future quantum context. Monitor NIST PQC standard adoption guidance for OT-applicable algorithms. SOURCES Industrial Cyber — iOT365 product announcement (limited technical detail available) UK NCSC — Timelines for migration to post-quantum cryptography Google Security Blog — Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android CSO Online — ‘Harvest now, decipher later’: The quantum threat few are preparing for Classification: UNCLASSIFIED // FOR DISTRIBUTION Confidence Level: MODERATE — vendor claims unverified; threat landscape context confirmed via multiple independent sources

Published Wednesday, June 17, 2026 at 05:20 PM PT BLUF: Microsoft has confirmed an actively tracked zero-day vulnerability in Microsoft Defender, attributed to threat actor cluster “RoguePlanet.” No patch is currently available. All organizations running Microsoft Defender should implement mitigations immediately pending patch release. DETAILS Microsoft has officially acknowledged a zero-day vulnerability affecting Microsoft Defender, confirming the issue is real and under active investigation. The vulnerability has been attributed to or associated with threat actor cluster designated “RoguePlanet” — nature of that attribution (nation-state, criminal, other) is not confirmed in available reporting. Microsoft states a patch is in development; no release timeline has been publicly confirmed. Specific technical details — CVE assignment, exploit mechanism, affected Defender versions, and whether exploitation is confirmed in the wild — are NOT confirmed in available source material and should not be assumed. The Hacker News is the primary reporting source; independent technical corroboration from Microsoft’s Security Response Center (MSRC) advisory has not been verified in provided context. IMPACT Affected product: Microsoft Defender — scope across Defender for Endpoint, Defender Antivirus, and/or Defender for Business variants is unconfirmed at this time. Affected population: Potentially broad — Microsoft Defender is deployed across millions of enterprise and consumer endpoints globally. Exploitation status: Unknown. Treat as potentially exploitable until Microsoft clarifies. Organizations in sectors previously targeted by sophisticated threat actors should treat risk as elevated. RECOMMENDED ACTIONS Monitor MSRC immediately (msrc.microsoft.com) for an official advisory and CVE assignment — this is the authoritative source. Do not disable Microsoft Defender as a precaution without a confirmed alternative endpoint protection solution in place — removing protection creates greater risk. Enable cloud-delivered protection and automatic sample submission in Defender if not already active — Microsoft may push interim detection updates ahead of a full patch. Alert your SOC and endpoint teams to increase monitoring for anomalous Defender process behavior or unexpected privilege escalation events. Watch for Microsoft out-of-band patch release — given zero-day status, do not wait for Patch Tuesday. Apply network-level monitoring for indicators associated with RoguePlanet if your threat intelligence platform carries them. ⚠️ UNCERTAINTY FLAGS CVE identifier: NOT CONFIRMED Active exploitation in the wild: NOT CONFIRMED Specific Defender product variants affected: NOT CONFIRMED RoguePlanet attribution details (origin, motivation): NOT CONFIRMED Do not escalate beyond confirmed facts in external communications. Reassess as Microsoft publishes official guidance. ...

Published Wednesday, June 17, 2026 at 05:19 PM PT BLUF: CISA has released Binding Operational Directive 26-04, superseding BOD 19-02 and BOD 22-01 and fundamentally restructuring how U.S. federal agencies must prioritize and remediate vulnerabilities. All federal civilian executive branch (FCEB) agencies are affected and must assess compliance posture immediately. DETAILS CISA BOD 26-04 officially replaces BOD 19-02 (patch timelines) and BOD 22-01 (Known Exploited Vulnerabilities catalog requirements), consolidating and updating federal vulnerability management obligations under a single directive. The directive shifts federal agencies away from static vulnerability management approaches toward risk-based prioritization — confirmed by both CISA’s own directive language and independent vendor analysis from Tenable and Qualys. BOD 26-04 introduces explicit prioritization requirements for assets that grant total control post-exploitation, with differentiated timelines for lower-risk vulnerabilities — indicating a tiered remediation framework rather than a flat patch deadline model. Multiple vendors (Tenable, Qualys) have published operationalization guidance, suggesting compliance tooling and workflow changes will be required across agency environments. NOTE: Full directive text details, specific remediation deadlines, and agency-specific scope boundaries are not fully confirmed from available source excerpts. Agencies should consult the CISA directive directly at cisa.gov for authoritative requirements. IMPACT ...