Rosetta Daily · Jun 6, 2026
Generated automatically · 29 sources configured (WebSearch mode, feed allowlist still in effect) · 13 items selected
Window: past 24 hours (2026-06-05 → 2026-06-06)
In-the-Wild Exploitation / Actively Exploited
-
🔥⚠️ Cisco Catalyst SD-WAN Manager CVE-2026-20245 — 7th Cisco SD-WAN 0-day of 2026, exploited in the wild, no patch yet
Cisco PSIRT warns of an actively exploited, unpatched flaw (CVSS 7.8) in the Catalyst SD-WAN Manager CLI: insufficient validation of user-supplied input lets an authenticated local attacker with netadmin privileges upload a crafted file and execute arbitrary commands as root. Mandiant reported the exploitation. Critically, attackers chain it with the May SD-WAN bugs — CVE-2026-20182 (May zero-day) or CVE-2026-20127 (abused since 2023 by a "highly sophisticated" actor) — to first obtain the authenticated foothold. Affects on-prem, Cloud-Pro, Cisco-managed cloud, and FedRAMP gov deployments. No fix for 20245 yet; Cisco advises upgrading to the 20182-fixed release (5/14) as the interim defensive posture.
BleepingComputer · Help Net Security · SecurityWeek · Cisco advisory -
🔴⚠️ Cisco Unified CM CVE-2026-20230 (CVSS 8.6, rated Critical) — unauthenticated SSRF → arbitrary file write → root, public PoC out
Cisco patched an unauthenticated SSRF (CWE-918) in the WebDialer web service of Unified Communications Manager / Unified CM SME. A crafted HTTP request makes WebDialer write attacker-controlled files to the Linux filesystem; the file-write primitive is chained to escalate to root. Cisco says it has not seen in-the-wild use, but working PoC code went public the day after disclosure. WebDialer is disabled by default — exposure is limited to deployments that enabled it. Fixed in Unified CM 14SU6; release 15 gets an interim COP patch now (15SU5 ships September 2026). Disable WebDialer if unused; apply the COP patch.
The Hacker News · SecurityWeek · SOCRadar -
🔥 Reminder — Microsoft Defender CVE-2026-41091 / CVE-2026-45498 in KEV; Magento Cache Warmer CVE-2026-45247 still being hit
Carry-over actively-exploited items remain hot: the two Microsoft Defender flaws (41091 LPE CVSS 7.8; 45498 DoS CVSS 4.0) added to CISA KEV with a 6/3 FCEB deadline — confirm Antimalware Platform is on v4.18.26040.7 / engine v1.1.26040.8. And CVE-2026-45247 (Mirasvit Cache Warmer for Magento, CVSS 9.8, KEV 6/3) continues to see live PHP-object-injection payloads. Verify both are remediated across the estate.
Help Net Security (Defender) · The Hacker News (Defender) · The Hacker News (Magento KEV)
Critical Vulnerabilities & Advisories
- Windows Secure Boot — 2011 CA certificates begin expiring June 2026 (Microsoft KEK CA 2011 on 6/24); act now
Microsoft and OEMs (Dell, etc.) are pushing the Secure Boot certificate transition: the 2011 root-of-trust certificates start expiring in June 2026. Devices that haven't received the 2023 CAskeep booting and getting normal Windows updates, but lose the ability to receive boot-level security updates— Boot Manager updates, Secure Boot DB/DBX revocations, and mitigations for newly discovered bootkit-class flaws — entering a "degraded security state" that worsens as new boot vulnerabilities ship. Most PCs built since 2024 already carry the 2023 certs. IT teams: roll out the 2023 CAs via the Secure Boot playbook before the 2011 CAs lapse.
Microsoft Tech Community playbook· Microsoft Support· Malwarebytes
Vendor Advisories
- OpenAI launches "Daybreak" — Codex-Security-powered vulnerability detection + patch validation (carry-over, gaining adoption)
OpenAI's defensive cyber initiative builds an editable per-repo threat model focused on realistic attack paths, tests vulnerabilities in an isolated environment, and proposes fixes — folding secure code review, threat modeling, patch validation and dependency-risk analysis into the dev loop. Built on GPT-5.5, GPT-5.5 with Trusted Access for Cyber, and the permissive GPT-5.5-Cyber. Akamai, Cisco, Cloudflare, CrowdStrike, Fortinet, Oracle, Palo Alto, and Zscaler are integrating. Not fully public — request a scan via OpenAI. The "AI finds bugs, vendors race to validate patches" theme now has a named OpenAI platform alongside Anthropic's Glasswing.
The Hacker News· Help Net Security· OpenAI
Web Security Research
- Microsoft Security — "When prompts become shells": prompt injection → host RCE in AI agent frameworks (Semantic Kernel)
Microsoft's research details how a vulnerable path in Microsoft Semantic Kernelturns indirect prompt injection into host-level RCE— a single crafted prompt was enough to launchcalc.exeon the machine running the agent. It generalizes to the agent-framework category: tool-calling agents that pass model output into code/shell execution paths are a fresh RCE substrate. Pairs with Google/Forcepoint's in-the-wild indirect-injection findings and OWASP keeping prompt injection at #1. Audit agent frameworks for any path where model output reaches an interpreter, shell, or eval; enforce sandboxing and tool allowlists.
Microsoft Security Blog· Google — prompt injections on the web· TechRepublic
AI Security
-
⚠️🛡 Claude Code GitHub Action flaw — one malicious GitHub issue could hijack any public repo running it (fixed)
RyotaK (GMO Flatt Security) disclosed thatclaude-code-action'scheckWritePermissionsunconditionally trusted any actor name ending in[bot], regardless of real permissions — and anyone can register a GitHub App, install it on their own repo, and use its token to open an issue/PR on any public repository. Combined with indirect prompt injection (an issue body disguised as an error message, refined until Claude "recovered" by running embedded commands), an attacker reaches code execution. Because Anthropic's own action repo used the same workflow, a successful attack could have poisoned the action itself and propagated downstream — a supply-chain risk. Reported in January; Anthropic fixed it in 4 days, hardened through spring, rated it 7.8 (CVSS v4.0), paid a bounty. Fix is in claude-code-action v1.0.94 — confirm you're on it.
The Hacker News · GMO Flatt Security research · The Next Web · eSecurity Planet -
⚠️🛡 Sysdig — first in-the-wild LLM-agent-driven post-exploitation (Marimo CVE-2026-39987), AI ran the whole intrusion
Sysdig TRT documented an intrusion where, after compromising an internet-reachable marimo notebook via CVE-2026-39987 (pre-auth RCE, ≤ 0.20.4), an LLM agent autonomously ran the post-exploitation: extracted two cloud credentials, replayed them through a fanned-out egress pool (12 calls across 11 IPs in 22 seconds) to pull an SSH private key from AWS Secrets Manager, then drove eight SSH sessions against a bastion and dumped a full internal PostgreSQL database — schema and contents — in under two minutes, improvising without prior schema knowledge. A Chinese-language planning comment ("看还能做什么" — "see what else we can do") leaked into the command stream. Defenders: assume machine-speed lateral movement; tighten secrets-manager egress and notebook exposure.
Sysdig ·
Threat Intelligence
-
🛡 GitHub breach — TeamPCP (UNC6780) cloned ~3,800 internal repos via a poisoned VS Code extension (carry-over, still developing)
GitHub confirmed a threat actor compromised an employee device through a malicious Nx Console VS Code extension (nrwl.angular-consolev18.95.0, published 5/18), harvested IDE secrets/tokens, and cloned ~3,800 internal private repos (Actions, Copilot internals, CodeQL, infra, security tooling, Codespaces, Dependabot). GitHub detected it 5/19, rotated secrets same day, isolated endpoints, removed the extension — and assesses customer repos, enterprise accounts, and user data are not affected. TeamPCP listed the data for ~$50,000. Same actor behind the TanStack/Mini Shai-Hulud npm campaigns. Reinforces: IDE extensions are a first-class supply-chain attack surface — pin and vet extensions.
The Hacker News · BleepingComputer · Help Net Security -
Device-code phishing surges 37x as PhaaS kits commoditize it (Push Security)
Push Security tracked a 37.5x surge in device-code phishing pages by 4/4, driven by the commercial launch of the EvilTokens PhaaS kit, with ≥11 distinct kits (VENOM, SHAREFILE, CLURE, LINKID, AUTHOV, DOCUPOLL, FLOW_TOKEN, PAPRIKA) and AiTM leader Tycoon2FA adding device-code functionality. Abusing the OAuth 2.0 Device Authorization Grant, successful attacks yield persistent OAuth tokens that survive password resets and credential rotation. Primary targets: Microsoft 365 / Entra ID / Teams / SharePoint. Mitigate: restrict device-code flow in Entra Conditional Access; alert on device-code auth from unexpected contexts.
BleepingComputer · Push Security · CSA Labs
Ransomware Today
- ~30–40 new DLS posts in the past 24hacross ~90 active leak sites (public-aggregator estimate; direct RansomLook fetch blocked by sandbox egress allowlist). Most active: Qilin, Akira, Play, INC Ransom, Nightspire, with DragonForce / Worldleaks / LockBit also posting. Notable 6/5 victims: Trican Well Service(oilfield services, Qilin), Urschel Laboratories& Corley Manufacturing(manufacturing, Play), Kennon Worldwide+ Oaks Park(Akira), Access Dental(Worldleaks), Sierra Vista Hospitaland Family Medical Associates of Raleigh(healthcare claims). Today's watchlist hits:Qilin × energy/oil, Play/Akira/INC × manufacturing, multiple × US healthcare; non-US targets in Austria (Avcon Jet/Genesis) and Slovenia (Don Don/AiLock). Structure unchanged: Qilin remains #1 (>1,700 tracked victims), Akira #2; payment rate near historic low (~28%).
- Full victim table + watchlist hits: intel/ransomware/daily/2026-06-06.html
AI Frontier
OpenAI
- Dreaming V3 memory + GPT-5.5 Instant style update (6/4)— Dreaming V3, OpenAI's biggest memory upgrade since 2024, began reaching ChatGPT Plus/Pro in the US: a background process after conversations end synthesizes preferences, constraints and ongoing projects automatically. GPT-5.5 Instant rolling out with cleaner, less bullet-heavy responses. Releasebot· OpenAI
- GPT-Rosalind (life sciences) updated (6/4)— stronger agentic coding + drug-discovery/genomics, new evidence-retrieval and bioinformatics plugins; expanded trusted-access preview. OpenAI News
- Daybreak cyber platform— Codex-Security-powered vuln detection + patch validation; partner integrations growing. See Vendor Advisories above. The Hacker News
Anthropic
- Claude Code GitHub Action flaw fixed (disclosed 6/4)—
[bot]-trust bypass + prompt injection could hijack public repos running the action; fixed in 4 days, v1.0.94. See AI Security above. The Hacker News - Project Glasswing expansion (6/2)— Claude Mythos Preview extended to ~150 new orgs (~200 partners, 15+ countries); Claude Security(repo scanning + patch suggestions) shipping; 10,000+ high/critical bugs storyline continues. Anthropic — Expanding Glasswing
- Claude Partner Network — Services Track + Partner Hub (6/3); IPO confidential SEC filing (6/1)— and Claude Code now runs on Opus 4.8 with a security-guidance plugin. Washington Post (IPO)· Anthropic news
Google DeepMind / AI
- Gemini 3.5 Flash GA + Gemini Omni unveiled (I/O 2026 carry-over)— 3.5 Flash positioned as the top agentic/coding model; Gemini Omni(any-input → any-output, starting with video); 3.5 Pro "next month"; Ultra cut to $200/mo, new $100/mo Developer tier; Gemini MAU 900M (2x YoY). Google Cloud — I/O 26· Gemini 3.5
- DeepMind hires 20+ Contextual AI researchers (~$80–90M licensing deal)— talent/IP push. HeyGoTrade
- AI-found-bug trend persists— autonomous AI analyzers continue surfacing long-dormant RCEs (Redis CVE-2026-23479, NGINX "Rift" CVE-2026-42945 in recent days), reinforcing the Verizon 2026 DBIR "AI finds bugs faster than defenders patch" theme. SecurityWeek
🛡 = security-relevant
Chinese Community Picks
- FreeBuf / AnQuanKe / YiJing Lab et al.continue local follow-up on English-sphere stories: the GitHub TeamPCP breach (4,000 private repos, $50k sale), the Claude Code deep-link / GitHub Action parsing flawweaponization angle, codexui-android Codex token theft, and Anthropic Glasswing / Claude Mythos commercialization (10,000+ critical bugs across ~200 orgs).
- Sysdig's first in-the-wild LLM-agent intrusion (Marimo CVE-2026-39987)is resonating in Chinese AI-security circles — partly because a Chinese-language planning comment leaked in the attacker's command stream, making it a concrete "AI 自动化入侵" case study.
- Supply-chain stays the dominant thread— IDE-extension poisoning (Nx Console) joins npm/CI poisoning (TanStack, codexui-android) as the recurring 供应链 discussion topic; cPanel CVE-2026-29201/2/3 and the Magento Cache Warmer RCE remain on local 站长/电商 radar.
FreeBuf· FreeBuf Vulnerabilities
Failed Sources
- RansomLook API + RSS— blocked by sandbox egress allowlist (host not permitted). Ransomware section uses WebSearch aggregation (breachsense / ransomware.live / vendor trackers); per-victim accuracy not guaranteed.
- Direct RSS/Atom feeds (CISA, The Hacker News, BleepingComputer, vendor blogs)— direct fetch blocked by egress allowlist; this edition reconstructed via WebSearch over the same source set.
- Chinese feeds (FreeBuf / AnQuanKe / Xianzhi)— feed pull unavailable in sandbox; Chinese section assembled from WebSearch summaries.
Source configuration: see intel/sources.yaml