Cyber security developments for Wednesday the 10th of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 10 articles to cover. All attribution is by the article authors. All article analysis is automated.
Palo Alto Networks Unit 42 have confirmed active exploitation of a critical authentication bypass in PAN-OS GlobalProtect components. The flaw lets unauthorised actors bypass authentication entirely and establish VPN connections straight into internal networks. It landed on the CISA known exploited vulnerabilities list on the 29th of May, with widespread scanning observed but so far only limited successful sessions documented.
And another VPN bypass in the wild โ this time from Check Point. Two critical flaws in the deprecated version one IKE protocol are being actively exploited by financially motivated actors linked to Qilin ransomware, with attacks running since early May. The authentication bypass scored nine point three out of ten and affects multiple versions going back to R80. The attackers are using dedicated VPS infrastructure and the Tox protocol for command coordination.
Trend Micro report that two Russia-aligned campaigns are still exploiting that year-old WinRAR vulnerability against Ukrainian organisations, nearly twelve months after the patch came out. The lack of centralised patch management for WinRAR continues to provide an opening โ malicious archives are being used to deploy malware with persistence established via Windows Startup folders. One for anyone supporting Ukrainian organisations or running legacy WinRAR installs.
Proofpoint have tracked a North Korea-aligned actor called UNK_DeadDrop running a large-scale phishing campaign targeting developers. Between April and May they sent over 250 emails to nearly a hundred organisations, mostly in the US, using recruitment and code review lures to trick targets into cloning malicious GitHub repositories. When opened in IDEs like VS Code or Cursor, the repos automatically execute platform-specific malware โ essentially an industrialised attack model aimed squarely at the developer community.
WhatsApp have filed a contempt motion against NSO Group for violating a permanent injunction that barred them from targeting WhatsApp and its users. Despite US court orders and government blacklisting, NSO have been conducting new social engineering attacks using one-click phishing to lure users to malicious domains. WhatsApp released indicators of compromise for three domains tied to the campaign.
France's DINUM have disclosed a security incident on Tchap, the messaging platform used by French government agencies. An unauthorised actor compromised a user account and accessed public forum data and profile information for roughly seventy-three thousand users โ about nine percent of the total user base. The attacker ran malicious queries to pull public conversations and metadata including names, email addresses, and organisational affiliations. Private encrypted communications were not affected, and the account was blocked immediately.
BushidoToken report that ShinyHunters carried out a data extortion attack against Instructure, the company behind Canvas learning management system. The attackers exploited a vulnerability in the Free-for-Teacher account creation system, pulled three point six five terabytes of data, and defaced login portals for roughly three hundred and thirty educational institutions. The incident reportedly concluded with a ten million dollar ransom payment from Instructure โ exam season timing presumably didn't hurt the leverage.
Researchers have developed QuasarNix, a machine learning framework to detect Linux living-off-the-land reverse shells that evade traditional signatures. Fourteen architectures were tested on over a million synthesised commands, with Gradient Boosted Decision Trees hitting sixty percent detection at a false positive rate of one in a million โ significantly better than signature-based methods at three point three seven percent. The framework also showed resilience against adversarial evasion and poisoning attacks, which is worth noting for anyone evaluating ML-based detection tooling.
The Cloud Native Computing Foundation have issued a security notice about baltocdn.com, a domain formerly used as a community APT mirror for Helm. It was decommissioned in September last year and re-registered by a third party in May. Unverified reports now suggest the new owner may be serving malicious content, which creates supply chain risks for anyone whose systems or infrastructure still reference the expired domain.
And finally, Microsoft have introduced a two-hour delay for automatic extension updates in Visual Studio Code version one point one two three. The delay provides a window for community detection of malicious or broken updates before they spread widely โ a straightforward supply chain mitigation. Extensions from Microsoft, GitHub, and OpenAI are exempt, and users can still manually update extensions immediately if they choose.
That concludes today's briefing.