Rosetta Daily · Jun 7, 2026

Generated automatically · 29 sources configured (WebSearch mode, feed allowlist still in effect) · 13 items selected
Window: past 24 hours (2026-06-06 → 2026-06-07). Weekend edition — lighter fresh disclosure flow; several items are still-hot carry-overs.

In-the-Wild Exploitation / Actively Exploited

• 🔥⚠️ Android Framework CVE-2025-48595 — actively exploited 0-day in the June 2026 Android update (124 flaws total), in CISA KEV
  Google's June 2026 Android Security Bulletin fixes 124 vulnerabilities, headlined by CVE-2025-48595, an integer-overflow elevation-of-privilege flaw in the Android Framework (CVSS 8.4) that Google flags as under "limited, targeted exploitation" — and it requires no user interaction. Affects Android 14, 15, 16 and 16 QPR2. CISA added it to KEV on 6/2 with a 6/5 FCEB remediation deadline (now passed). Roll the June patch level to all managed Android fleets; prioritize devices that can't auto-update.
  The Hacker News · BleepingComputer · Help Net Security · CISA KEV

• 🔥⚠️ Cisco Catalyst SD-WAN Manager CVE-2026-20245 — 7th Cisco SD-WAN 0-day of 2026, exploited in the wild, still no patch (carry-over, still hot)
  Cisco PSIRT's actively-exploited, unpatched CLI flaw (CVSS 7.8) remains the top open item: insufficient input validation lets an authenticated netadmin-level attacker upload a crafted file and run arbitrary commands as root. Mandiant reported the exploitation, including cases where attackers pushed config changes to edge devices. Attackers chain it with the May SD-WAN bugs — CVE-2026-20182 or CVE-2026-20127 — to first get the authenticated foothold. Affects on-prem, Cloud-Pro, Cisco-managed cloud and FedRAMP gov deployments. No fix for 20245 yet; Cisco's interim guidance is to be on the 20182-fixed release (5/14) and lock down netadmin access.
  BleepingComputer · SOC Prime · SecurityWeek

• 🔥 Reminder — Magento Cache Warmer CVE-2026-45247 (CVSS 9.8) KEV deadline was 6/6; Cisco Unified CM CVE-2026-20230 has public PoC
  Two carry-over actively-/easily-exploited items still need closure across estates: CVE-2026-45247 (Mirasvit Cache Warmer for Magento, unauth PHP-object-injection RCE via the CacheWarmer cookie) hit its FCEB remediation deadline 2026-06-06 — verify e-commerce stacks are patched. And CVE-2026-20230 (Cisco Unified CM WebDialer unauth SSRF → arbitrary file write → root, CVSS 8.6) has working PoC code public; WebDialer is off by default, so exposure is limited to deployments that enabled it. Fix: Unified CM 14SU6 / release-15 COP patch; disable WebDialer if unused.
  The Hacker News (Magento KEV) · The Hacker News (Unified CM) · SecurityWeek

Critical Vulnerabilities & Advisories

• Windows Secure Boot — 2011 CA certificates begin expiring this month (Microsoft KEK CA 2011 on 6/24); act before the lapse
  The Secure Boot certificate transition deadline is now days away. Devices that haven't received the 2023 CAskeep booting and getting normal Windows updates, but lose the ability to receive boot-level security updates— Boot Manager updates, Secure Boot DB/DBX revocations, and mitigations for newly discovered bootkit-class flaws — entering a "degraded security state" that worsens as new boot vulnerabilities ship. Most PCs built since 2024 already carry the 2023 certs. IT teams: roll out the 2023 CAs via Microsoft's Secure Boot playbook before the 2011 CAs lapse on 6/24.
  Microsoft Tech Community playbook· Microsoft Support· Malwarebytes

Vendor Advisories

• Google ships June 2026 Android bulletin — 124 fixes, one exploited (see In-the-Wild above)
  Beyond the exploited Framework EoP, the June bulletin clears multiple critical System and Framework remote-privilege-escalation bugs. Confirm the June 2026 patch level (2026-06-01 / 2026-06-05) is applied; OEM rollout lags the AOSP date.
  SC Media· TechRepublic

Web Security Research

• PortSwigger — Top 10 Web Hacking Techniques of 2025 published; James Kettle to debut "Meet the HTTP Terminator" at Black Hat USA 2026
  PortSwigger Research published the 19th annual Top 10 Web Hacking Techniques of 2025, the community-curated list of the year's must-read web research — this edition spotlights new request-smuggling/desync techniques (malformed chunks, browser-redirect stalls feeding further exploit chains) and SAML exploitation enabling complete auth bypass. Looking ahead, James Kettle will debut "Meet the HTTP Terminator" at Black Hat USA 2026, alongside research on CSS-based email-account takeover end-to-end on multiple major providers. Good reading list for web/appsec teams; review desync and SAML exposure now.
  PortSwigger — Top 10 of 2025 · PortSwigger Research

• 🛡 Carry-over — Microsoft Security "When prompts become shells": indirect prompt injection → host RCE in agent frameworks (Semantic Kernel)
  Still circulating in the past day: Microsoft's research showing a vulnerable path in Semantic Kernel where indirect prompt injection becomes host-level RCE (a single crafted prompt launched calc.exe on the agent host). Generalizes to any tool-calling agent that pipes model output into a shell/eval path. Audit agent frameworks for any path where model output reaches an interpreter; enforce sandboxing and tool allowlists.
  Microsoft Security Blog · Google — prompt injections on the web

AI Security

• ⚠️🛡 WithSecure — GREYVIBE: state-aligned actor ran commercial AI (ChatGPT, Gemini, Ideogram) across the full kill chain against Ukraine
  WithSecure detailed GREYVIBE, a previously-undocumented, Russian-speaking (Moscow-timezone) threat group that has used OpenAI ChatGPT, Google Gemini and Ideogram AI across nearly every operational stage — lure development, malware creation, infrastructure setup, obfuscation tooling and post-compromise activity — targeting Ukrainian military, government, civilian and business orgs since at least August 2025. Lures include spear-phishing, fake CAPTCHA pages and bogus Ukrainian "adult club" sites. WithSecure assesses it low-to-moderately sophisticated (repeated OPSEC mistakes, heavy LLM dependence), but it's a concrete data point that commercial AI is now production adversarial infrastructure, not experimentation.
  BleepingComputer · The Register · CyberSecurityNews

• ⚠️🛡 Unit 42 — web-based indirect prompt injection against AI agents observed in the wild; OWASP keeps it #1 into 2026
  Updated Unit 42 tracking (published 6/2) documents web-based indirect prompt injection moving from research into live attacks against agentic AI clients — ad-review evasion and system-prompt leakage seen on commercial platforms; meta-analysis of recent studies finds >85% attack-success against SOTA defenses when adaptive strategies are used, and the International AI Safety Report 2026 notes best-defended models are bypassed ~50% of the time within 10 attempts. The five 2026 agent attack surfaces: prompt injection, memory poisoning, tool misuse, supply-chain, data exfiltration. Treat any browsing/agentic AI client as an RCE-adjacent substrate; sandbox tool calls.
  Unit 42 · Securance — OWASP #1

Threat Intelligence

• Carnival breach — ~6M affected, ShinyHunters-linked, single social-engineered account
  Carnival confirmed a breach affecting 5,995,277 people (Maine filing). An attacker social-engineered a Carnival employee on 4/14, and by 4/22 used the compromised account to reach a "limited portion" of IT systems and copy personal data — names, contact details, dates of birth and government ID numbers — before being blocked. Carnival is offering credit monitoring to 6M customers. Pattern to drill on: privileged accounts reachable via social engineering with no compensating controls.
  Malwarebytes · CPO Magazine · Cybersecurity Insiders

• Charter / Spectrum — ShinyHunters leaks data after ransom refusal; 4.9M emails confirmed, 42M records claimed
  ShinyHunters published Charter Communications (Spectrum) data after a ransom refusal — 4.9M email addresses confirmed alongside names, phone numbers, physical addresses and partial employee-directory records; the actor claims 42M customer records, which Charter disputes (says no CPNI exfiltrated). Entry vector per the actor: a vishing attack on a Charter employee's Microsoft Entra account (4/1) enabling Salesforce access. Same actor, same playbook as the Carnival and Lithuania Centre-of-Registers cases. Harden Entra/Salesforce against voice-phishing-driven session takeover; enforce phishing-resistant MFA.
  TechRepublic · The Register · SecurityAffairs

Ransomware Today

• ~20–30 new DLS posts in the past 24hacross ~85 active leak sites (weekend slowdown; public-aggregator estimate — direct RansomLook fetch blocked by sandbox egress allowlist). Most active: Qilin, Akira, Play, INC Ransom, The Gentlemen, with LockBit / Genesis / DragonForce / Worldleaks also posting. Notable victims this window: The Gentlemenposting three US healthcare/surgical targets (Downriver Medical Associates, Edgewood Surgical, Michigan Surgical Center); LockBit × Sierra Vista Hospital; Genesis × Family Medical Associates of Raleigh; manufacturing via Play (Corley Manufacturing), INC Ransom (Stuga Machinery, National Standard Parts), Akira (Kennon Worldwide), Bavaqai (Dolphin Manufacturing). Today's watchlist hits:The Gentlemen × US healthcare, LockBit/Genesis × US healthcare/hospital, Play/INC/Akira × manufacturing. Structure unchanged: Qilin remains #1(5th straight month on top, 101 victims in May), Akira #2; payment rate near historic low (~28%).
• Full victim table + watchlist hits → intel/ransomware/daily/2026-06-07.html

---

AI Frontier

OpenAI

• Real-time audio + translation models for agents (June 2026)— OpenAI shipped real-time audio and translation models aimed at agentic use: live voice interaction, transcription and multilingual flows become more practical for agent builders. LLM-Stats AI news
• Self-serve advertising platform inside ChatGPT (reported June 2026)— OpenAI rolled out a self-serve ads platform within ChatGPT — a notable monetization/product shift to watch. WaveSpeed — June 2026 launch wave
• Daybreak cyber platform (carry-over)— Codex-Security-powered vuln detection + patch validation; partner integrations (Akamai, Cisco, Cloudflare, CrowdStrike, Fortinet, Oracle, Palo Alto, Zscaler) continue. OpenAI

Anthropic

• Claude Opus 4.8 — 1M-token default context for complex coding (model claude-opus-4-8, GA late May, adoption growing)— hybrid reasoning model with a 1M context window pushing the coding/agent frontier; Claude Code gains Dynamic Workflows(orchestrator spawns hundreds of parallel subagents). Pricing unchanged vs 4.7 ($5/$25 per Mtok). Anthropic — Opus 4.8· SiliconANGLE
• $965B valuation round + confidential IPO filing (reported early June)— financing round reported at a $965B valuation; confidential SEC filing on file. CNBC
• Project Glasswing / Claude Mythos expansion (carry-over, 6/2)— Mythos Preview extended to ~150 new orgs (~200 partners, 15+ countries); Claude Security(repo scanning + patch suggestions) shipping; 10,000+ high/critical-bug storyline continues. Anthropic — Expanding Glasswing

Google DeepMind / AI

• Antigravity 2.0 — parallel multi-agent orchestration— Google's agentic IDE can now orchestrate multiple agents in parallel (e.g., one coding a site while another generates brand assets), reinforcing the "agentic Gemini era" framing around Gemini 3.5. WaveSpeed
• SynthID watermarking adopted by OpenAI, Kakao, ElevenLabs— Google's SynthID content-provenance watermarking picks up cross-vendor adoption — a small but real step for AI-generated-content attribution / anti-abuse. Google blog
• GREYVIBE used Gemini in its kill chain (see AI Security)— alongside ChatGPT/Ideogram; relevant to Google's abuse-monitoring posture. BleepingComputer

🛡 = security-relevant

---

Chinese Community Picks

• FreeBuf / AnQuanKe / YiJing Lab et al.continue local follow-up on the supply-chain thread: the GitHub TeamPCP breach (~4,000 private repos, ~$50k sale), the codexui-androidnpm package stealing persistent refresh_tokencredentials, and Checkmarx's tampered Jenkins AST plugin(2026.5.09) — the company's third such supply-chain incident since late March. Supply chain (供应链) remains the dominant local topic.
• GREYVIBE's full-kill-chain use of ChatGPT/Geminiresonates in Chinese AI-security circles as a concrete "AI 自动化攻击" case, paired with prior coverage of Sysdig's first in-the-wild LLM-agent intrusion (Marimo CVE-2026-39987).
• June Android 124-flaw update (CVE-2025-48595 actively exploited)and the Magento Cache Warmer KEV deadline (6/6)are on local mobile-security and 电商/站长 radars.
  FreeBuf· FreeBuf 供应链 tag

---

Failed Sources

• RansomLook API + RSS— blocked by sandbox egress allowlist (host not permitted; curlreturned empty). Ransomware section uses WebSearch aggregation (breachsense / ransomware.live / vendor trackers); per-victim accuracy and exact discovery timestamps not guaranteed.
• Direct RSS/Atom feeds (CISA, The Hacker News, BleepingComputer, vendor blogs)— direct fetch blocked by egress allowlist; this edition reconstructed via WebSearch over the same source set.
• Chinese feeds (FreeBuf / AnQuanKe / Xianzhi)— feed pull unavailable in sandbox; Chinese section assembled from WebSearch summaries.

---

Source configuration: see intel/sources.yaml