Posted on Identity & Governance Incidents & Breaches Security Operations Vulnerability Intelligence

BreachForums Governance Crisis and Clone Forum Impersonation Reveal Dark Web Volatility in June 2026

In June 2026, BreachForums underwent leadership upheaval involving diencracked's return, conflict with HasanBroker experienced leadership instability as former operator diencracked returned, clashed with HasanBroker, announced retirement, and signaled ownership transfer to user L, raising governance concerns. Simultaneously, clone forums attempted to sell BreachForums infrastructure for $3,000 in cryptocurrency while admitting to impersonating ShinyHunters and original staff. DarkForums and XSS forums showed domain instability, DaMaGeLiB went offline after lead operator gliderexpert disappeared, and new forums BlackForums and RAIDForums emerged, underscoring the dark web ecosystem's resilience amid persistent volatility. Read more

Posted on Cloud Security Identity & Governance Security Operations Vulnerability Intelligence

GovCERT.HK Issues High Threat Alert for Linux Kernel Privilege Escalation Flaws

GovCERT.HK has issued a High Threat Security Alert (A26-06-45) for two elevation-of-privilege vulnerabilities in the Linux kernel—DirtyClone (CVE-2026-43503) and pedit COW (CVE-2026-46331)—with public PoC exploits available, allowing local unprivileged users to gain root access on affected systems. Read more

Posted on Cloud Security Incidents & Breaches Security Operations Vulnerability Intelligence

Active Exploitation of Oracle E-Business Suite CVE-2026-46817 Highlights Critical Patch Delay Risks

Attackers are actively exploiting CVE-2026-46817, a critical unauthenticated remote code execution flaw in Oracle E-Business Suite's Payments module, with Defused observing real-world exploitation over the weekend and Shadowserver tracking over 450 exposed instances globally. Oracle patched the vulnerability in its May 2026 CPU but warns unpatched systems remain at risk. Read more

Posted on Cloud Security Incidents & Breaches Security Operations Vulnerability Intelligence

Nissan Employee Data Breach Highlights Systemic Risk in Oracle PeopleSoft in Oracle PeopleSoft Zero-Day Campaign

Nissan disclosed a data breach affecting current and former employees across North and South America after threat actors exploited CVE-2026-35273, a zero-day vulnerability in Oracle PeopleSoft PeopleTools, in a campaign linked to ShinyHunters that compromised over 300 instances across 100 organizations, primarily in education, between May 27 and June 9, 2026. Read more

Posted on Cloud Security Incidents & Breaches Security Operations Vulnerability Intelligence

DirtyClone Linux Kernel Flaw Enables Root Escalation via Cloned Network Packets

CVE-2026-43503 (CVSS 8.8) allows local users to gain root by corrupting file-backed memory through cloned network packets, exploiting a missing shared-frag flag in kernel packet handling. The flaw affects multi-tenant systems where unprivileged namespaces are enabled, including CI runners and Kubernetes clusters. A patch was merged in Linux v7.1-rc5 on May 21, 2026. Read more

Posted on AI Security Incidents & Breaches Security Operations Vulnerability Intelligence

CISA KEV Addition of PTC Windchill RCE Flaw Exposes Gaps in Enterprise Patch Timelines

CISA’s inclusion of CVE-2026-12569 in the KEV catalog confirms active exploitation of a critical deserialization flaw in PTC Windchill PDMlink and FlexPLM, with attackers deploying JSP web shells for persistence. Despite patches released the prior week, continued threat activity highlights systemic delays in enterprise patch deployment and detection coverage for specialized PLM systems. Read more

Posted on AI Security Incidents & Breaches Security Operations Vulnerability Intelligence

Cisco Unified CM Exploit Analysis: CVE-2026-20230 File-Write Flaw Drives Federal Patch Mandate

Active exploitation of CVE-2026-20230, a critical SSRF vulnerability in Cisco Unified CM enabling unauthenticated file writes and potential root access via the WebDialer service, has prompted CISA to add the flaw to its KEV catalog with a June 28, 2026 deadline for federal agencies. Despite WebDialer being disabled by default, misconfigurations in enterprise deployments are exposing systems to attack, highlighting the critical need for configuration validation alongside patching. Read more

Posted on Identity & Governance Incidents & Breaches Security Operations Vulnerability Intelligence

CISA Alert: Active Exploitation of Critical Lantronix EDS5000 Flaw Demands Immediate Patching

CISA has warned of active exploitation of CVE-2025-67038, a critical code injection vulnerability in Lantronix EDS5000 Series devices, requiring Federal Civilian Executive Branch agencies to apply patches by June 26, 2026. The flaw allows unauthenticated remote command execution with root privileges via the HTTP RPC module, posing significant risks to network integrity and device security. Read more

Posted on AI Security Identity & Governance Incidents & Breaches Security Operations

Research Digest: Explainable ML Framework Reveals Moral Condemnation as Dominant Tactic in Korean Foreign Influence Operations

A two-decade analysis of 112 million South Korean news comments identifies 23,998 accounts showing coordinated manipulation behavior, with moral condemnation of domestic political figures driving higher engagement than direct foreign narrative promotion, informing platform defense prioritization. Read more