Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, data breaches, and industry developments to help you navigate the fast-evolving digital threat landscape.
1. Microsoft June 2026 Patch Tuesday Fixes Record 206 Flaws, Including Multiple Zero-Days
Published: June 10, 2026
Microsoft released updates addressing a record 206 vulnerabilities, including six zero-days (some actively exploited), with 39 rated critical. Key fixes include Windows Kernel use-after-free flaws, Exchange Server XSS issues, and Defender-related exploits like RoguePlanet granting SYSTEM privileges.
Read more (Microsoft Patch Tuesday coverage)
2. ServiceNow Flaw Exploited for Unauthorized Access to Customer Instances
Published: June 10, 2026
ServiceNow disclosed a security incident where attackers exploited an unauthenticated access flaw in an API endpoint, gaining deeper access to certain customer instances and querying data tables. The company applied a fix on June 5 and notified affected users.
3. China-Linked JDY Botnet Expands to 1,500+ Devices Targeting U.S. Military Networks
Published: June 10, 2026
The JDY botnet, associated with Chinese state-sponsored actors like Volt Typhoon, has grown significantly and is being used for large-scale reconnaissance, including against U.S. military targets. It leverages compromised SOHO/IoT devices for scanning and mapping.
4. Unpatched Langflow Vulnerability (CVE-2026-5027) Actively Exploited for RCE
Published: June 10, 2026
A high-severity path traversal flaw in the open-source AI development platform Langflow is being exploited in the wild, allowing arbitrary file writes and potential remote code execution on exposed servers. No patch is available yet.
5. Ivanti, Fortinet, and SAP Release Critical Patches for Multiple Vulnerabilities
Published: June 10, 2026
Vendors issued urgent updates: Fortinet fixed a command injection flaw (CVE-2026-25089, CVSS 9.1) in FortiSandbox; Ivanti addressed max-severity Sentry issues; SAP patched critical flaws in NetWeaver and Commerce Cloud.
6. CISA Adds Cisco, Chrome, and Arista Flaws to Known Exploited Vulnerabilities Catalog
Published: June 10, 2026
CISA updated its KEV catalog with actively exploited flaws, including Cisco Catalyst SD-WAN Manager (CVE-2026-20245), Google Chrome V8 (CVE-2026-11645), and Arista EOS issues. Federal agencies must remediate promptly.
7. Oracle PeopleSoft Servers Targeted in ShinyHunters Data Theft Attacks
Published: June 10, 2026
The ShinyHunters group is actively hacking Oracle PeopleSoft servers, claiming data theft from over 100 organizations in ongoing extortion campaigns.
8. CISA Issues New Directive on Vulnerability Prioritization and Patching
Published: June 10, 2026
CISA directed federal agencies to prioritize remediation based on new risk criteria, shortening fix windows (e.g., to three days for high-risk flaws) amid rising AI-driven threats and exploitation.
Stay Vigilant
Cyber threats, especially AI-enhanced attacks, supply chain risks, and state-sponsored operations, continue to accelerate. Patch promptly, monitor for anomalous activity, and implement strong identity controls. Subscribe for daily/weekly updates and consider advanced tools for vulnerability management and threat detection. Stay safe online!