Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, data breaches, supply chain attacks, and AI-related security developments to help you stay informed and proactive in the fast-evolving threat landscape.
1. Critical Splunk Enterprise Flaw Allows Unauthenticated Remote Code Execution
Published: June 13, 2026
Splunk has patched a high-severity vulnerability (CVE-2026-20253, CVSS 9.8) in Splunk Enterprise that lets unauthenticated attackers perform arbitrary file creation or truncation via a PostgreSQL sidecar service endpoint, potentially leading to remote code execution. Affected versions below 10.2.4 and 10.0.7 require immediate updates; Splunk Cloud is not impacted.
2. Over 400 Arch Linux AUR Packages Hijacked for Infostealer and eBPF Rootkit
Published: June 12-13, 2026
Attackers compromised more than 400 packages in the Arch User Repository (AUR), modifying build scripts to deploy a Rust-based credential stealer and eBPF rootkit. Users who built or installed affected packages since June 11 should verify and rebuild. This highlights risks in community-driven repositories.
3. ShinyHunters Exploits Oracle PeopleSoft Zero-Day in Widespread Data Theft Attacks
Published: June 11-12, 2026
The ShinyHunters group leveraged a critical Oracle PeopleSoft zero-day (CVE-2026-35273) to breach over 100 organizations, primarily U.S. higher education institutions. Oracle issued mitigations, and CISA added it to the Known Exploited Vulnerabilities catalog. Data leaks include sensitive personal and financial records.
4. U.S. Government Orders Anthropic to Suspend Access to Advanced AI Models Fable 5 and Mythos 5
Published: June 13, 2026
Anthropic disabled its latest AI models worldwide following a U.S. directive to block access for foreign nationals due to national security concerns and potential jailbreaks. The company disputes the severity but is complying while seeking clarification. Other models remain available.
5. Google Sues Chinese Smishing Network Using Gemini AI for Phishing Campaigns
Published: June 12, 2026
Google is taking legal action against a Chinese cybercrime network accused of using Gemini AI to generate phishing sites and conduct large-scale smishing attacks targeting Americans. The operation involves the “Outsider” phishing-as-a-service kit.
6. China-Linked Hackers Maintain Decade-Long Persistence via Backdoored Linux Login Software
Published: June 12-13, 2026
A China-nexus group (Velvet Ant) backdoored PAM and OpenSSH components for nearly 10 years, enabling stealthy access and credential harvesting on air-gapped or isolated networks. The persistence evaded typical detection by modifying trusted system binaries.
7. Microsoft June 2026 Patch Tuesday Addresses Record ~200 Vulnerabilities
Published: June 9-10, 2026 (ongoing relevance)
Microsoft released fixes for approximately 206 vulnerabilities, including critical flaws and publicly disclosed zero-days. This large update cycle underscores the growing volume of threats in Windows ecosystems.
8. CISA Adds Multiple Vulnerabilities to Known Exploited Catalog; Ivanti Sentry Urgency
Published: June 8-12, 2026
CISA continues updating its KEV catalog with actively exploited flaws, including a critical Ivanti Sentry OS command injection vulnerability. Federal agencies were given tight deadlines to patch. Additional entries reflect ongoing exploitation trends.
Stay Vigilant
Cyber threats continue to blend traditional exploits with AI-enhanced attacks and supply chain compromises. Organizations should prioritize patching, monitor open-source repositories closely, and implement robust AI governance. Subscribe to our newsletter for daily/weekly updates, and consider tools like vulnerability scanners and AI threat detection platforms. Stay safe online!