STORIES LAST WEEK
Cisco discloses exploited SD-WAN Manager zero-day with no patch
Cisco said CVE-2026-20245 is being exploited against Catalyst SD-WAN Manager and can give root command execution after netadmin access. Cisco has released indicators of compromise, but fixes are still pending. SecurityWeek, June 5, 2026
Agencies warn attackers are modifying internet-exposed tank gauges
NSA, CISA, FBI, and other agencies warned that attackers are compromising automatic tank gauge systems across critical infrastructure. OT owners should remove direct exposure and block command execution paths. NSA, June 3, 2026
New HTTP/2 Bomb DoS attack crashes web servers in less than a minute
Researchers showed HTTP/2 Bomb abusing header compression and stalled flow control against default NGINX, Apache, IIS, Envoy, and Pingora deployments. Some servers need patches, proxies, or HTTP/2 disablement. BleepingComputer, June 3, 2026
Meta AI support bot let attackers reset Instagram passwords
Hackers manipulated Meta’s AI support assistant to link targeted Instagram accounts to new email addresses, enabling resets for high-profile accounts. The incident shows why account recovery needs human, identity, and rate-limit controls. The Guardian, June 1, 2026
Attackers use AI scripts to automate EDR evasion testing
Sophos found AI-generated Python scripts tied to a lab testing malware against Sophos, CrowdStrike, and Windows Defender. The setup turns evasion into an iterative engineering workflow before deployment. Dark Reading, June 3, 2026
Anthropic opens Mythos vulnerability hunting to critical infrastructure operators
Anthropic expanded Project Glasswing to about 150 new organizations across 15 countries, including operators of power, water, health care, communications, and hardware. The rollout may flood vendors with AI-discovered high-risk findings. CyberScoop, June 2, 2026
Microsoft 365 Android bug lets any app request account tokens
Enclave found a production debug flag that disables token-sharing checks in Word, PowerPoint, Excel, Copilot, Loop, and OneNote on Android. Enterprises should update apps, verify MDM coverage, and revoke exposed refresh tokens. Enclave, June 2, 2026
VS Code flaw exposes GitHub tokens after one click
A researcher published a PoC for VS Code and GitHub.dev flaw that steals GitHub tokens through a crafted notebook link. Repository access makes the bug a DevOps supply chain risk. SecurityWeek, June 4, 2026
Exploited Magento cache extension flaw reaches CISA catalog
CISA added CVE-2026-45247 after attacks targeted Mirasvit Cache Warmer for Magento. The unauthenticated PHP deserialization flaw can execute code through a crafted cookie, putting storefront servers at risk. The Hacker News, June 3, 2026
Palo Alto GlobalProtect authentication bypass is under exploitation
Rapid7 observed exploitation of CVE-2026-0257 against unpatched PAN-OS devices, allowing attackers to establish VPN connections. Edge firewall flaws like this can become initial-access paths within days. CyberScoop, June 1, 2026
Inspector general says NIST failed to manage vulnerability database backlog
A Commerce watchdog said the NVD backlog grew to over 27,000 entries and that NIST duplicated CISA’s work. Patch teams rely on that enrichment to rank risk, automate triage, and justify remediation. The Record, June 1, 2026
Five Eyes warn China is recruiting insiders through job platforms
The agencies said Chinese intelligence officers pose as recruiters on LinkedIn, Indeed, Upwork, and similar services to reach personnel with privileged access. Security teams should fold unusual job outreach into insider-risk monitoring. The Record, June 4, 2026
IronWorm campaign targets npm developers for credentials
JFrog said IronWorm uses Rust malware, eBPF hiding, Tor-based command-and-control, and stolen npm tokens to spread through developer workflows. The campaign hit 36 packages with 32,000 monthly downloads. Dark Reading, June 4, 2026
Hola Browser Windows build shipped with an undeclared cryptominer
Hola confirmed a supply chain compromise after researchers found an unsigned Monero miner that created Defender exclusions, persistence, and idle-time execution. The incident points to gaps in code signing and distribution pipeline verification. BleepingComputer, June 4, 2026
Stock exchange executive’s mailbox was exfiltrated for five months
Symantec and Carbon Black said attackers used native Windows tools, Dropbox, and OneDrive Personal to copy an exchange executive’s Outlook mailbox. One privileged inbox can expose deals, calendars, and market-moving plans. Broadcom, June 3, 2026
More cybersecurity news
- Last week’s news roundup
- More cybersecurity news
- All articles sponsored by NetworkTigers
About NetworkTigers
NetworkTigers is the leader in the secondary market for Grade A, seller-refurbished networking equipment. Founded in January 1996 as Andover Consulting Group, the company originally built and re-architected data centers for Fortune 500 firms. Today, NetworkTigers provides consulting and network equipment to global government agencies, Fortune 2000 companies, and healthcare companies. Visit www.networktigers.com
