Security news, decoded.

Researchers from YesWeHack and Sekoia report that the Python-based trojan ChocoPoC is distributed through fake GitHub proof-of-concept repositories that look like fixes for newly disclosed issues. The payload steals credentials and local data, then provides remote command execution, affecting fake PoCs tied to CVE-2025-64446, CVE-2025-55182, CVE-2025-14847, CVE-2026-0257, CVE-2026-10520, CVE-2026-50751, and CVE-2026-48908. Because the malicious code is hidden in dependency packages (e.g., frint and skytext), simply reviewing the visible exploit file may miss the threat, making this a serious supply-chain risk for vulnerability researchers and downstream tooling.

CISA has added the Microsoft SharePoint Server remote code execution flaw CVE-2026-45659 (CVSS 8.8) to its Known Exploited Vulnerabilities (KEV) catalog, citing indications that it is being actively exploited in the wild. The issue stems from deserialization of untrusted data and allows an authenticated attacker to run code remotely without requiring admin rights; Microsoft fixed it in May 2026 for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. This matters because it raises the priority for patching—CISA advises Federal Civilian Executive Branch agencies to remediate by July 4, 2026.

Researchers found weaponized PoC exploit repositories on GitHub that ultimately deliver the Python-based RAT ChocoPoC to victims, including researchers. The campaign relies on malicious packages fetched from PyPI during repository cloning, which then lead to execution, data theft, and command execution capabilities. At least seven PoC repos were tied to exploits for FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page Builder (CVE-2026-48908), underscoring why running unverified PoCs or their dependencies can quickly turn vulnerability research into compromise.

Forscher berichten, dass auf GitHub veröffentlichte, „waffenfähige“ PoC-Exploits den Python-basierten Remote-Access-Trojaner ChocoPoC ausliefern. Dabei werden nach dem Klonen eines Repository heimlich schädliche Python-Pakete von PyPI nachgeladen, die beim Ausführen zusätzliche Komponenten nachladen und letztlich ChocoPoC aktivieren; der Code kann u. a. Kommandos ausführen und Browserdaten sowie Host-Infos exfiltrieren. Betroffen sind u. a. PoCs für FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751) und Joomla SP Page Builder (CVE-2026-48908) – wichtig, weil dies Test-/Research-Umgebungen durch glaubwürdig wirkende Code-„Beispiele“ kompromittieren kann.

Argo CD’s repo-server component contains an unpatched, unauthenticated remote code execution weakness that can allow attackers to run commands if they can reach its internal gRPC port, potentially leading to full Kubernetes cluster compromise. The issue affects Argo CD v2.13.3 and has no CVE or fixed release; researchers at Synacktiv report the flaw abuses kustomize’s --helm-command handling to execute attacker-controlled scripts. This matters because compromised repo-server access can be chained with prior exposure of Argo CD’s Redis cache behavior, re-enabling deployment poisoning similar to CVE-2024-31989—so administrators should verify Kubernetes network policies restrict repo-server and Redis access.

Adobe has issued fixes for multiple highest-severity vulnerabilities affecting Adobe ColdFusion and Adobe Campaign Classic. In ColdFusion, multiple CVSS 10.0 issues (CVE-2026-48276, CVE-2026-48283, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282) plus additional high-severity flaws (CVE-2026-48313, CVE-2026-48315) could enable arbitrary code execution, privilege escalation, arbitrary file reads, and security bypasses, with patches available in ColdFusion 2023 Update 21 and ColdFusion 2025 Update 10. Adobe Campaign Classic is also affected by CVE-2026-48286 (CVSS 10.0), where incorrect authorization can lead to arbitrary code execution; it is fixed in ACC v7: 7.4.3 build 9397 for affected on-premise Windows and Linux deployments.

AI code editor Cursor has two critical issues, tracked as CVE-2026-50548 and CVE-2026-50549, where prompt injection can bypass Cursor’s command sandbox and execute arbitrary commands on a developer’s machine without any user click or approval. The flaws matter because they allow attackers to neutralize the safety boundary using seemingly normal inputs (such as content read via MCP or web results), potentially leading to full local compromise and access to connected workspaces. Cursor fixed both problems in Cursor 3.0; all versions prior to 3.0 are affected.

A critical Progress Kemp LoadMaster vulnerability is being actively exploited, with eSentire reporting targeting of CVE-2026-8037 (CVSS 9.6). The issue is an OS command injection in a pre-auth API path that can allow unauthenticated attackers to achieve arbitrary code execution on vulnerable appliances. Although observed exploitation attempts reportedly failed and did not progress further, the availability of proof-of-concept details may accelerate real-world attacks.

Researchers report a new ransomware attack chain that was developed with DeepSeek and operates entirely within the browser on Google Chrome and other Chromium-based browsers on Windows and Android, using the File System Access API. The campaign centers on the malware sample InfernoGrabber v9.0 and a Python Flask application, which performs local file enumeration, exfiltration, encryption, and shows a “WinLocker” Bitcoin demand without installing a native payload. VirusTotal also links the code to browser exploitation routines involving CVE-2023-4863, underscoring how AI can turn speculative concepts into practical threats and why permission and browser security boundaries matter.

More than 900 Oracle E-Business Suite (EBS) instances are reportedly reachable online while attackers are actively targeting a critical issue, CVE-2026-46817, in the File Transmission component of Oracle Payments. The flaw can be abused by unauthenticated attackers with HTTP network access to take over vulnerable systems through low-complexity techniques, making exposure particularly risky for exposed deployments. Oracle has released fixes in its May 2026 Critical Security Patch Update, and defenders are urged to patch immediately as scanners such as Shadowserver continue to observe a large number of potentially vulnerable installations.

Adobe has issued security updates for ColdFusion and Adobe Campaign Classic to address multiple high-severity vulnerabilities, some rated 10/10. Adobe Campaign Classic patches include CVE-2026-48286, which could enable arbitrary code execution via an authorization weakness, with fixes shipped in version 7.4.3 build 9397 for Windows and Linux. For ColdFusion, updates for 2025 and 2023 resolve several issues including CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, CVE-2026-48282, CVE-2026-48283, along with other critical flaws such as CVE-2026-48313 and CVE-2026-48315, CVE-2026-48307, CVE-2026-48285, and CVE-2026-48314; these bugs stem from problems like unsafe file upload handling, input validation gaps, XSS, SSRF, and path traversal. Adobe notes no public exploits are known, but the updates are treated as high priority, so users should apply them promptly.

Citrix has released new security updates for NetScaler ADC and NetScaler Gateway that address six vulnerabilities, including the recently publicized HTTP/2 Bomb denial-of-service flaw. Affected CVEs include CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816 (memory corruption and arbitrary file read issues), plus CVE-2026-49975 (an out-of-bounds read) and CVE-2026-13474 for the NetScaler-specific HTTP/2 Bomb behavior that can knock Apache HTTP Server offline. These issues matter because exploitation could enable service disruption and, for some bugs, memory-related data exposure; upgrade to the fixed NetScaler versions as indicated by Citrix and verify whether your configuration enables the vulnerable components.

Adobe has released updates addressing seven maximum-severity vulnerabilities across its ColdFusion web application platform and Adobe Campaign Classic marketing automation product. The ColdFusion issues (CVE-2026-48276, CVE-2026-48277, CVE-2026-48281, CVE-2026-48316, and CVE-2026-48282) affect ColdFusion versions 2025.9, 2023.20 and earlier and could enable remote code execution without user interaction or special privileges. A Campaign Classic flaw (CVE-2026-48286) affecting versions 7.4.3 build 9396 and earlier can allow arbitrary code execution in the context of the current user, and Adobe notes it impacts only on-premises instances.

Citrix has released security updates for NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) to remediate six vulnerabilities that could let an attacker perform arbitrary file reads or cause denial-of-service conditions. Affected CVEs include CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474, impacting scenarios such as SAML parsing, gateway/AAA configurations, load balancing/DNS proxy deployments, and HTTP/2 handling. Fixes are available in specified 13.1 and 14.1 NetScaler releases, with additional configuration guidance required for CVE-2026-13474 via the Http2SmallWndTimeout setting when HTTP Strict Profiles are not used.

watchTowr Labs reports that Citrix has publicly disclosed a pre-auth memory disclosure issue, CVE-2026-8451, in Citrix NetScaler when the NetScaler appliance is configured as a SAML IDP. The vulnerability is described as insufficient input validation leading to memory overread, with affected products including NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-72.61, NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-63.18, NetScaler ADC FIPS BEFORE 14.1-72.61 FIPS, and NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.272. This matters because it can cause the appliance to include unintended memory contents in responses (e.g., within cookies), potentially exposing sensitive data to an unauthenticated attacker.

Researchers from QiAnXin XLab report a two-stage malware family called RustDuck that compromises home routers, IP cameras, Android boxes, and exposed servers, then uses the infected devices to launch DDoS attacks. The campaign has been linked to multiple vulnerable products and vulnerabilities, including CVE-2017-17215, CVE-2025-29635, CVE-2024-1781, CVE-2024-1781, CVE-2018-8007, plus exposure to ThinkPHP, Jenkins, and Hadoop YARN issues. The risk is amplified by RustDuck’s active evolution and its use of modern encryption and anti-analysis checks, making detection and takedown harder.

Attackers are exploiting CVE-2026-33017, an unauthenticated remote code execution issue in Langflow (CVSS 9.3), to gain initial access on internet-exposed AI application endpoints. Once triggered, the flaw enables deployment of a Monero cryptocurrency miner that disables host security components, persists via scheduling/cron, spreads through reused SSH credentials, and attempts to erase evidence. This matters because it turns reachable Langflow instances into a new entry point for commodity cryptojacking into enterprise environments.

Threat actors have been observed attempting exploitation of CVE-2026-46817 against Oracle Payments, the payment-processing module in Oracle’s E-Business Suite (EBS). The issue targets the ibytransmit endpoint in Oracle Payments’ File Transmission component and can be used by unauthenticated remote attackers to read files from the server, potentially exposing sensitive data such as database credentials, encryption keys, and API secrets. Oracle patched the vulnerability in late May 2026, and organizations running Oracle E-Business Suite versions 12.2.3 to 12.2.15 should apply the May 2026 Critical Security Patch Update immediately and avoid public internet exposure of EBS web interfaces until updated.

CISA says a vulnerability in Microsoft Defender, tracked as BlueHammer and identified as CVE-2026-33825, is being used as part of ransomware intrusions. The issue affects Microsoft’s Defender component and can enable authenticated attackers to escalate privileges, which is why it matters for incident risk. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and later updated the entry to indicate ransomware exploitation in the wild, underscoring the need to apply Microsoft’s April patches.

Threat actors have begun targeting a critical Oracle E-Business Suite (EBS) vulnerability tracked as CVE-2026-46817 (CVSS 9.8), with activity observed against the File Transmissions component in the Payments product. Oracle says unauthenticated attackers can exploit the issue over HTTP to take over Oracle Payments, making it a high-impact risk for organizations running EBS. The flaw was addressed in Oracle’s first monthly Critical Security Patch Update (CSPU) in late May, so defenders should prioritize patching to reduce exposure.

An unidentified threat actor is actively exploiting the critical SimpleHelp flaw CVE-2026-48558 (CVSS 10.0), which allows an unauthenticated attacker to bypass authentication in OpenID Connect (OIDC) flows and obtain a fully authenticated “Technician” session. Using that access, they deployed two malware families, TaskWeaver (a Node.js loader) and Djinn Stealer (a cross-platform credential and data-stealing payload targeting systems across Windows, macOS, and Linux). The scale of harvested secrets—spanning cloud accounts, code repositories, AI tooling, and cryptocurrency wallets—makes this a high-impact risk, and CISA has added CVE-2026-48558 to its Known Exploited Vulnerabilities catalog.

Attackers are actively exploiting CVE-2026-48558, a newly fixed authentication bypass in SimpleHelp RMM, to gain access and deploy Djinn Stealer on compromised systems. The malware is reported to target Windows, macOS, and Linux and can harvest credentials and sensitive data from many cloud platforms, development tools, browsers, SSH, and cryptocurrency wallets. This matters because stolen tokens, keys, and session data could enable re-entry and further compromise even after the original SimpleHelp server is isolated.

Apple released security updates for iOS/iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2, addressing multiple vulnerabilities that primarily impact browser components such as WebKit, libxslt, WebRTC, and Web Extensions. CVE-2026-39868, CVE-2026-43676, CVE-2026-43700, CVE-2026-43701, CVE-2026-43703, CVE-2026-43704, CVE-2026-43705, CVE-2026-43706, CVE-2026-43707, CVE-2026-43708, CVE-2026-43712, CVE-2026-43713, CVE-2026-43715, CVE-2026-43716, CVE-2026-43718, CVE-2026-43720, CVE-2026-43721, CVE-2026-43722, CVE-2026-43724, CVE-2026-43725, CVE-2026-43727, CVE-2026-43732, CVE-2026-43735, CVE-2026-43740, CVE-2026-43742, CVE-2026-43743, CVE-2026-43745, CVE-2026-43746, and CVE-2026-43732 are included, with additional issues in the Kernel and IOGPUFamily. None of the reported flaws are labeled as “exploited,” but the browser-focused nature makes timely patching important.

Researchers reported six vulnerabilities across Apple AirDrop and Samsung Quick Share that let an attacker nearby disrupt the receiving service (crashing sharingd on macOS/iOS) without user interaction, potentially affecting multiple Continuity-related features at once. For Quick Share, Samsung’s Android issues can bypass session handshake checks, while Google’s Quick Share for Windows contains a memory safety problem consistent with a use-after-free, with a CVE still pending; the component has previously been linked to CVE-2024-38271, CVE-2024-38272, and CVE-2024-10668. The findings matter because these flaws require only local proximity or a shared network, meaning attackers in crowded locations could impact many nearby devices.

Nissan reported that employee data was exposed as part of a zero-day campaign aimed at Oracle PeopleSoft environments. The incident affected Nissan Americas, which uses Oracle PeopleSoft for functions including tax and payroll processing, with the exploited issue tracked as CVE-2026-35273. The company suspects attackers accessed information such as SSNs, banking details, and financial or tax records for current and former employees across multiple countries, underscoring the risk of widely targeted enterprise software flaws.

The U.S. CISA has confirmed that ransomware groups have started exploiting the Microsoft Defender privilege-escalation vulnerability tracked as CVE-2026-33825. This issue, known as BlueHammer, allows an authenticated attacker to elevate local privileges by exploiting overly broad access control, which can lead to SYSTEM-level control and full compromise. CISA added CVE-2026-33825 to its KEV catalog and urged rapid patching because it is now tied to real ransomware activity.

A critical authentication bypass in SimpleHelp remote monitoring and management (RMM) software has been used to deliver malware, tracked as CVE-2026-48558 (CVSS 10). The flaw impacts SimpleHelp’s OpenID Connect (OIDC) login flow by letting attackers supply forged identity tokens to obtain fully authenticated technician sessions, enabling remote file transfer and command execution over systems managed by the server. Observed intrusions deployed TaskWeaver and Djinn Stealer, while SimpleHelp addressed the issue in versions 5.5.16 and 6.0 RC2; CISA also added CVE-2026-48558 to its KEV catalog to prompt rapid patching.

Progress Kemp LoadMaster discloses a critical pre-auth remote command execution issue in its API that can allow an unauthenticated attacker to run arbitrary commands as root by sending a crafted request. The vulnerability is tracked as CVE-2026-8037 (CVSS 9.8) and affects LoadMaster GA v7.2.63.1 and older, plus LTSF v7.2.54.17 and older when the API is enabled; fixed releases are GA v7.2.63.2 and LTSF v7.2.54.18. The bug matters because the affected /accessv2 endpoint is reachable before authentication, and a public proof of concept has been demonstrated even though no exploitation reports have been made.

Apple released security updates for iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2 to address 30+ vulnerabilities, including multiple WebKit flaws identified with AI tooling such as Anthropic Claude and OpenAI Codex Security. The WebKit issues include CVE-2026-43707, CVE-2026-43716, CVE-2026-43745, and CVE-2026-43715, which range from memory corruption to out-of-bounds writes and can crash Safari or enable broader memory-safety impact. Apple also patched additional issues affecting the kernel, including CVE-2026-43722, CVE-2026-43724, and CVE-2026-39868—making these updates important for reducing risk even though none are reported as exploited in the wild.

Oracle E-Business Suite’s Oracle Payments component is facing a critical actively exploited weakness, tracked as CVE-2026-46817 (CVSS 9.8). The issue involves improper privilege management and authentication that can be abused by a network-based unauthenticated attacker over HTTP to take over affected Oracle Payments instances (versions 12.2.3 through 12.2.15). This matters because it indicates real-world compromise attempts are underway, and organizations should verify they have applied Oracle’s latest security patches.

A campaign targeting the remote management product SimpleHelp has been observed using the critical authentication bypass vulnerability CVE-2026-48558 as an entry point. After exploiting an Internet-facing SimpleHelp instance, attackers gained technician-level access, deployed a JavaScript loader (TaskWeaver), and delivered Djinn Stealer to collect and encrypt high-value secrets. The malware can harvest cloud and developer credentials—including keys and configuration data tied to AI tooling/agents—highlighting why RMM compromise can quickly escalate into broader access and downstream supply-chain risk.

Nissan says attackers exploited an Oracle PeopleSoft vulnerability to steal employee information, and the incident may have affected current and former staff. The breach has been connected to exploitation of Oracle PeopleTools zero-day CVE-2026-35273, a flaw that was used in data-theft operations previously attributed to the ShinyHunters extortion group. This matters because exposed payroll and identity data can enable further fraud and long-term account and tax-related abuse.

The NAIC says it was compromised by ShinyHunters after the threat group exploited a zero-day in an Oracle PeopleSoft server (CVE-2026-35273). According to NAIC, the attackers obtained mainly already publicly available statutory financial reports, outdated logs, and configuration information, and it reports no evidence that PII or financial data was exposed. The incident still caused disruptions for downstream partners, while ShinyHunters’ leaked-file claims differ from NAIC’s findings and NAIC states affected systems have been remediated.

CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities catalog, warning that PTC Windchill and FlexPLM are being targeted in the wild. PTC reports that attackers can exploit the improper input validation flaw (unauthenticated remote code execution) and has observed indicators consistent with JSP webshells being deployed on vulnerable systems. Organizations using affected PTC product lifecycle management deployments should apply the relevant patches and check their environments for indicators of compromise.

Researchers disclosed DirtyClone (CVE-2026-43503), a new variant of the Dirty Frag Linux kernel issue that can let local users achieve root by abusing cloned packets. JFrog notes the risk is especially high on multi-tenant cloud setups, Kubernetes clusters, and containers when user namespaces are enabled and attackers can obtain CAPNETADMIN. The wider roundup also highlights active exploitation of CVE-2026-12569 in PTC Windchill PDMlink and PTC FlexPLM, underscoring how missed patches and old access paths continue to drive real-world compromise.

In Check Point Research’s 29th June threat intelligence update, multiple incidents were highlighted, including a supply-chain compromise impacting Polymarket customers, a reported KDDI ISP email platform breach affecting up to 14.22 million email addresses and passwords, and a Tata Electronics data breach involving alleged 630GB of leaked material. On the vulnerabilities front, Cisco fixed actively exploited CVE-2026-20245 in Catalyst SD-WAN Manager, Dify released 1.14.2 to address critical issues including CVE-2026-41947 and CVE-2026-41948, and Ubiquiti UniFi OS was flagged for exploitation of CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910. The report also notes ongoing targeting of Langflow via CVE-2026-55255 and mass exploitation of CVE-2026-33017, underscoring how quickly attackers weaponize new weaknesses.

Attackers are actively exploiting a recently disclosed critical vulnerability in SimpleHelp (CVE-2026-48558) to compromise exposed instances and deploy new malware, including Djinn Stealer and a TaskWeaver loader. The affected SimpleHelp deployments—often used by MSPs, IT teams, and helpdesks—matter because the flaw can be used to bypass authentication via OpenID Connect (OIDC), enabling attackers to gain a trusted technician session for remote execution. Djinn Stealer then targets cross-platform developer and infrastructure data on Windows, macOS, and Linux, potentially allowing theft of credentials and downstream access to cloud resources, repositories, and API-connected AI tooling.