This briefing covers critical security threats identified during June 5-6, 2026. The threat landscape is dominated by severe authentication bypass vulnerabilities and widespread botnet activity. Three CRITICAL-severity vulnerabilities demand immediate attention: CVE-2026-45389 (CVSS 10.0) affecting UDS Identity Config with complete authentication bypass, CVE-2026-10580 (CVSS 9.8) enabling WordPress administrator account takeover, and CVE-2026-45758 (CVSS 9.6) involving a malicious PyPI package compromise of the guardrails-ai library.
Malware distribution infrastructure remains highly active with 50 malicious URLs detected, primarily serving Mirai and Mozi botnets targeting IoT devices. Multiple architectures are being targeted including MIPS, ARM, x86, and SH4, indicating broad-spectrum IoT compromise campaigns. NetSupport RAT, AgentTesla, PureLogsStealer, and ClearFake malware families are also actively being distributed through compromised websites and malicious infrastructure.
The Termix server management platform exhibits multiple critical vulnerabilities (6 separate CVEs) including OS command injection and broken access control flaws. Additional high-severity issues affect WordPress plugins, Markdown Preview Enhanced, and network appliances with hardcoded credentials. Organizations should prioritize patching critical authentication bypass vulnerabilities and implement network-level controls to block identified malicious infrastructure.
Three critical-severity vulnerabilities enable complete authentication bypass and unauthorized access across different platforms
Logic error in client-kubernetes-secret Keycloak authenticator allows complete authentication bypass in UDS Core Identity deployment. Affects versions 0.11.0 through 0.26.0. This represents a complete compromise of authentication infrastructure.
Logic conflation in HippooPermissions allows unauthenticated attackers to gain administrator privileges in WooCommerce installations. Affects all versions up to 1.9.4. Enables complete WordPress site compromise without authentication.
Attacker published malicious version 0.10.1 of guardrails-ai to PyPI on May 11, 2026. Users who installed this version may have been compromised. Supply chain attack targeting AI application developers.
Network management device fails to enforce authentication on administrative pages, allowing remote attackers to access sensitive configuration including LAN credentials, WAN settings, and SNMP community strings.
Hard-coded credentials 'eurek/eurek' grant administrative access to NetMan 204 devices. Remote unauthenticated attackers can gain full control of network infrastructure devices.
Six critical and high-severity vulnerabilities identified in Termix web-based server management platform affecting versions prior to 2.3.2
Command injection vulnerability in /ssh/file_manager/ssh/resolvePath endpoint due to inadequate double-quote escaping. Allows authenticated attackers to execute arbitrary OS commands on managed servers.
User-controlled host record fields are interpolated into SSH tunnel commands without sanitization in /ssh/tunnel/connect endpoint, enabling command injection attacks.
Improper validation of sessionId parameter allows authenticated attackers to access arbitrary SSH sessions and manipulate files on any managed server without authorization.
Path parameter embedded into shell commands without validation in /ssh/file_manager/ssh/resolvePath endpoint enables command execution.
File manager endpoints fail to verify session ownership, allowing authenticated attackers to access other users' SSH sessions via sessionId guessing or knowledge.
Electron-based desktop client disables certificate validation since version 1.7.0, enabling man-in-the-middle attacks against HTTPS communications.
Multiple high-severity vulnerabilities enabling remote code execution across various platforms and applications
Versions before 0.8.28 parse WaveDrom diagrams using eval() on untrusted markdown content, enabling arbitrary JavaScript execution in preview, presentation, and HTML export modes.
Bitfield fenced code blocks processed with vm.runInNewContext() allow arbitrary code execution through crafted markdown documents before version 0.8.28.
External files and links opened through shell without validation of diagram filenames, import paths, and latex_engine attributes. Windows exploitation enables command execution via crafted markdown.
Unsafe unserialize() without allowed_classes restriction in IdsToCollection function enables PHP object injection leading to remote code execution in versions up to 7.0.18.
Version 0.8.x with crossnote engine 0.9.28 allows JavaScript injection via malicious WaveDrom fenced code blocks in crafted markdown documents.
Capability check vulnerability in licensing module save_ajax() function allows arbitrary file uploads in all versions up to 5.38.
Case-insensitive extension validation but verbatim filename writes, combined with incomplete .htaccess rules, allow HTML upload and execution prior to version 26.0.0.
Privilege escalation, information disclosure, and security control bypass vulnerabilities requiring prompt remediation
Untrusted search path issue in GlobalDatabasePlugin allows authenticated low-privilege users to escalate to rds_superuser via crafted functions.
Similar untrusted search path vulnerability in JDBC wrapper's GlobalDatabasePlugin enables privilege escalation to rds_superuser.
Versions 2.x prior to 2.15.0 and 3.x prior to 3.0.10 leak Cookie headers to cross-origin redirect targets, exposing authentication credentials.
ajax_run_tool() AJAX handler relies solely on nonce check, enabling authentication bypass in all versions up to 5.38.
MFA disable and backup code endpoints accept password as sole factor, enabling MFA bypass by attackers with password access.
Path traversal in AliPan, U115, and Rclone download handlers allows writing files outside intended directories via malicious cloud API metadata.
WebRTC ingest endpoint lacked authentication in versions 0.8.95-2.4.1, allowing unauthenticated stream injection. Fixed in 2.5.0 with HTTP Basic auth requirement.
Uses unsuitable uniqid() function for generating salts in versions prior to 26.0.1, weakening cryptographic operations.
Bug in Network component versions prior to 1.0.0.CR3-20260418 allows attackers to close parent connections affecting public-facing software.
Vulnerability in versions prior to 1.0.0.CR3-20260417 enables attackers to stall connections in publicly accessible software.
Photo parameter in newdriver.php allows unrestricted file uploads in code-projects Vehicle Management System 1.0.
SQL injection in /details.php room parameter affects code-projects Hotel and Tourism Reservation System 1.0. Exploit publicly available.
CISA KEV entry requiring immediate patching action
Specially crafted POST requests using Content-Encoding: deflate header can crash Serv-U service without authentication. Added to CISA KEV catalog indicating active exploitation. Ransomware use unknown.
Extensive malware distribution infrastructure detected targeting IoT devices across multiple architectures with Mirai and Mozi botnets
Server hosting Mirai binaries for m68k, spc, and arm7 architectures. Indicates broad IoT device targeting including legacy embedded systems.
Botnet infrastructure serving Mirai for ARM-based devices. ARM processors common in routers, cameras, and IoT devices.
Server hosting bin.sh and MIPS binaries for Mozi botnet propagation. Mozi targets vulnerable routers and network devices.
Three distinct IP addresses (60.22.196.199, 123.12.229.216, 42.6.84.128) distributing 32-bit MIPS ELF Mozi binaries, indicating coordinated IoT compromise campaign.
Server hosting multiple architecture-specific Gafgyt and Mirai binaries with 'Sakura' naming convention (ARM-4/5/6/7, MIPS, x86, SH4). Comprehensive IoT targeting operation.
Infrastructure distributing multiple ELF binaries with obfuscated filenames across various architectures. Generic ua-wget user agent suggests automated targeting.
Telnet-based propagation script hosted at smart.abuse.st, likely used for automated scanning and exploitation of telnet-enabled IoT devices.
Active distribution of commodity malware including stealers and remote access trojans through compromised websites
PureLogs stealer distributed through corwineagles.com (stegopay.png, payloads.png) and concilicartoes.com.br (Omada.exe). Steganography-based delivery indicates evasion techniques.
AgentTesla keylogger and information stealer delivered via corwineagles.com using image-based payload delivery (payloads.png).
SiriusRAT delivered via iwd21.icu using reverse base64 loader technique for evasion. Remote access trojan capabilities for persistent control.
NetSupport legitimate remote administration tool abused for malicious purposes, hosted on Cloudflare R2 storage (pub-9682d5896df841679c5a17eb41273f89.r2.dev).
Malware payload hidden in PNG file (stego_pyloa.png) indicating continued use of steganography for malware delivery and AV evasion.
Social engineering campaigns and legitimate tool abuse for malware delivery
Two URLs (ptrpzfj.volleyball.poker, pacsuhw1.pishbini90.bet) hosting ClearFake social engineering malware. ClearFake uses fake browser update prompts to deliver malware.
Four IP addresses (194.26.192.187, 203.159.90.37, 193.26.115.238) hosting ConnectWise ScreenConnect clients for unauthorized remote access. Legitimate RMM tool abused by threat actors.