Security news, decoded.

The National Association of Insurance Commissioners (NAIC) says it was targeted in the recent Oracle PeopleSoft attack chain involving the zero-day vulnerability CVE-2026-35273, which enables unauthenticated remote code execution. NAIC reports unauthorized access discovered on June 11, with attackers obtaining statutory financial reporting and related technical data; however, it states personally identifiable information and payment/financial account details were not compromised. The incident matters because a widely used enterprise platform vulnerability is being actively leveraged by the ShinyHunters group and regulators are now confirming real-world impact.

The Russian APT group Gamaredon has intensified its cyber campaign against Ukraine throughout 2025 by expanding its malware and increasing the use of legitimate third-party online services for command-and-control, exfiltration, and “dead drop” infrastructure. ESET reports 35 spear-phishing campaigns targeting Ukrainian government and military organizations, including attacks that abused a patched WinRAR flaw tracked as CVE-2025-8088 to deliver an HTA downloader and establish persistence. This matters because the continued weaponization of archive-based delivery and cloud/service impersonation makes detection and disruption significantly harder across affected environments.

JFrog disclosed details and a PoC for CVE-2026-43503, a high-severity Linux kernel local privilege escalation vulnerability that can let any local user obtain root access (CVSS 8.8). The issue is a variant related to the DirtyFrag (Copy Fail 2) and Fragnesia vulnerability family, and it stems from memory corruption in the kernel’s networking skb processing and zero-copy page-cache interactions. Debian, Fedora, and Ubuntu are potentially impacted when unprivileged user namespaces are enabled, and attackers with CAPNETADMIN on an affected kernel can escalate to root—posing particular risk for multi-tenant cloud, Kubernetes, and container environments.

A public proof-of-concept has been released for CVE-2026-55200, a critical memory corruption issue in libssh2 (affecting all releases up to and including 1.11.1) that allows a malicious or compromised SSH server to trigger heap overflow during the SSH handshake, potentially leading to code execution without credentials or user interaction. Because libssh2 is commonly embedded in products like curl, Git, PHP, and various embedded/firmware updaters—often as statically linked binaries—many systems may remain vulnerable even if package updates aren’t straightforward. Mitigation depends on applying the upstream fix (commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8) or waiting for downstream patched releases, while restricting outbound SSH access to trusted endpoints until then.

CISA has issued an urgent directive for federal agencies to patch CVE-2026-20230 in Cisco Unified Communications Manager Server, a server-side request forgery (SSRF) issue that is already being exploited in the wild and is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Cisco rated it critical and released a fix on June 3, warning it can be triggered remotely without authentication through specially crafted HTTP requests, and researchers have reported observed attacks leveraging it to write arbitrary text files. The deadline to remediate is Sunday, June 28, and CISA also added CVE-2026-12569 to KEV for PTC Windchill and FlexPLM (improper input validation leading to remote code execution).

Rapid7’s Metasploit Framework update introduces new scanners and an exploit module, including a Next.js Middleware Authorization Bypass scanner for CVE-2025-29927, a LiteLLM proxy pre-auth SQL injection scanner for CVE-2026-42208, and an unauthenticated Audiobookshelf API authentication bypass scanner for CVE-2025-25205 (fixed in 2.19.1 for affected releases 2.17.0–2.19.0). The release also adds a Dalfox found-action deserialization RCE exploit for Dalfox Server versions <= 2.12.0 tied to CVE-2026-45087. These additions matter because they help detect and potentially validate high-impact pre-auth and authorization flaws, as well as remote code execution via unsafe deserialization paths.

A newly identified campaign dubbed StrikeShark distributes the previously unknown Windows malware family SharkLoader, which then deploys Cobalt Strike Beacon on compromised systems. Kaspersky reports targeting includes organizations in Indonesia, Taiwan, and multiple other countries, using publicly available post-compromise tools and opportunistic exploitation of exposed services. The initial access leverages vulnerabilities such as ProxyLogon (CVE-2021-26855), Openfire traversal flaws (CVE-2023-32315), and GeoServer remote code execution (CVE-2024-36401), highlighting an elevated risk of espionage and follow-on payload delivery.

Wiz reported a high-severity issue in the Amazon Q Developer extension for Visual Studio Code where opening a booby-trapped repository could trigger automatic actions on workspace configuration files without user consent. This could allow attackers to run attacker-controlled commands and inherit the developer’s environment, potentially capturing AWS or other cloud credentials and API keys—tracked as CVE-2026-12957, with a related symbolic link issue CVE-2026-12958. AWS issued patches (including fixes in the Amazon Q Developer language server, noted as version 1.65.0) and says updates are available for affected plugins covering VS Code, JetBrains, Eclipse, and Visual Studio.

A Linux kernel vulnerability in the traffic-control packet-editing action (actpedit), tracked as CVE-2026-46331 (“pedit COW”), can allow an unprivileged local user to gain root. The issue is an out-of-bounds write that corrupts shared page-cache content, enabling an attacker to poison the in-memory copy of /bin/su without touching the disk, bypassing file integrity checks after exploitation. Public working exploits appeared shortly after the CVE was assigned, and Red Hat, Debian, and Ubuntu kernels are affected (per their advisories), making timely patching and mitigation important for multi-tenant and containerized environments.

A high-severity issue in Amazon Q Developer could allow a malicious repository to trigger command execution and potentially steal developers’ cloud credentials through Model Context Protocol (MCP) server settings. The vulnerability is tracked as CVE-2026-12957 (CVSS 8.5) and affects the Language Servers for AWS component used by Amazon Q across VS Code, JetBrains, Eclipse, and Visual Studio, where repo-bundled MCP configuration could lead to running attacker-defined servers in the developer’s environment. This matters because it can turn trusted code checkout into unauthorized access to AWS identity and sensitive credentials unless systems are updated with the vendor’s fix.

CISA has added a actively exploited remote code execution flaw to its Known Exploited Vulnerabilities (KEV) catalog, affecting PTC Windchill PDMlink and PTC FlexPLM. The issue is tracked as CVE-2026-12569 (CVSS 9.3), where improper input validation can enable arbitrary code execution. PTC reports that attackers are continuing to use the vulnerability to install JSP web shells on vulnerable systems, underscoring the risk of rapid weaponization after patch releases.

An unnamed threat actor exploited a Cisco SD-WAN zero-day against service provider infrastructure, with Mandiant reporting evidence of compromise. The attackers targeted Cisco Catalyst SD-WAN Manager and used a malicious CSV upload path to trigger CVE-2026-20245, ultimately escalating to root-level control and conducting anti-forensic actions. Organizations running affected Cisco SD-WAN components should upgrade to the fixed releases listed by the vendor to eliminate CVE-2026-20245 risk and reduce further intrusion likelihood.

A newly disclosed Linux kernel flaw in the DirtyFrag family, called DirtyClone, can allow a local attacker to corrupt file-backed memory via cloned packet handling and achieve root privileges. The issue is tracked as CVE-2026-43503 (CVSS 8.8) and matters because the demonstrated technique modifies in-memory data only—so file integrity tools may not detect it and a reboot restores the original binary. JFrog Security Research has shared a working exploit, and the fix has already landed upstream; unpatched systems should update their kernels promptly.

Security researchers report that the Russia-linked APT Turla has been using a new .NET espionage backdoor called StockStay to target Ukrainian government and military organizations, and in some cases related European entities. The malware has been delivered through phishing themes and can be installed via malicious RDP configuration files, with recent activity in November 2025 also leveraging exploitation of CVE-2025-8088 (WinRAR) for payload execution. This matters because the infection chain shows continued refinement of Turla’s initial access and stealthy command-and-control methods against high-value targets.

CVE-2026-12569 has been exploited by threat actors in real-world attacks, marking the first confirmed abuse of a PTC issue targeting the Windchill and FlexPLM product line. The vulnerability stems from improper input validation that can be triggered remotely without authentication to achieve arbitrary code execution. CISA added CVE-2026-12569 to its Known Exploited Vulnerabilities (KEV) catalog, signaling urgency for remediation—important because Windchill is widely used in industrial and manufacturing environments, including critical supply chains and operational technology systems.

Google Threat Intelligence has linked the Russian state-sponsored actor Turla to a previously unknown Windows .NET backdoor named STOCKSTAY, used against government and military targets in Ukraine and other organizations with Italian foreign policy interests. The malware is built from multiple cooperating components that communicate via a secure WebSocket channel and inter-process communication, and it has been used both for initial access and post-exploitation during operations where Turla also relies on Kazuar. Some delivery waves used archives exploiting CVE-2025-8088 (a WinRAR flaw), which matters because it can enable fast malware deployment to targeted environments.

In under 24 hours of proof-of-concept release, attackers started actively exploiting a critical Cisco Unified Communications Manager (CUCM) vulnerability to obtain root access. The issue, tracked as CVE-2026-20230, is an unauthenticated SSRF input validation flaw affecting Cisco Unified CM and Unified CM SME deployments when the WebDialer service is enabled. This matters because public exploit chains have been observed in the wild, enabling attackers to deploy web shells and escalate privileges on exposed systems; Cisco issued fixes on June 3 and organizations should patch or disable WebDialer if not required.

The open source data transfer tool and library curl has shipped a security update addressing 18 vulnerabilities (four medium and 14 low). The most notable issue is CVE-2026-8932, affecting libcurl applications (not the curl command-line tool) and related to mTLS connection reuse that can enable authentication bypass; it traces back to behavior introduced in version 7.7. Other tracked flaws include CVE-2026-8926 (credential confusion), CVE-2026-8925 (double-free), CVE-2026-9080 and CVE-2026-10536 (use-after-free), and CVE-2026-9547 (improper host validation). Because curl is widely used across servers and devices, unpatched flaws in libcurl can be attractive targets for attackers.