DFIRLab
All Briefings
weeklyJune 1, 2026 — June 8, 2026Published 07:01 UTC

Weekly Threat Briefing — 2026-06-01 to 2026-06-08

33 findings9 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
758 CVEs6,917 IOCs

First seen in this period: CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 30
Browse all 33 findings

Executive summary · as of 07:01 UTC

The situation

The period of June 1-8, 2026 saw significant vulnerability disclosure activity with CISA adding five critical vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, including severe flaws in SolarWinds Serv-U, Oracle WebLogic Server, and Android Framework. Two CRITICAL-severity vulnerabilities emerged in the NVD: CVE-2026-45758 affecting the Guardrails AI Python framework (CVSS 9.6) involving malicious PyPI package distribution, and CVE-2026-46389 in UDS Identity Config (CVSS 10.0) representing a logic error in Keycloak client authentication. The threat landscape showed continued Mozi botnet activity with 24 malware distribution URLs identified, alongside persistent ClearFake campaign infrastructure and emerging ELF-based malware distribution from IP 45.205.1.59.

Browse the full briefing

33 findings · 9 sections
Findings by severity
  • 5 critical
  • 25 high
  • 2 medium
  • 1 info
Vulnerabilities2 critical · 3 high

Critical Known Exploited Vulnerabilities (KEV)

CISA added five vulnerabilities to the KEV catalog, indicating active exploitation in the wild. These require immediate patching attention.

Vulnerabilities2 critical · 3 high

Critical Zero-Day and High-Impact Vulnerabilities

Two CRITICAL-severity vulnerabilities and multiple high-impact flaws disclosed, including supply chain attacks and authentication bypasses.

Vulnerabilities5 high

WordPress Plugin Vulnerabilities

Multiple high-severity vulnerabilities identified in WordPress plugins, including authentication bypass, arbitrary file upload, and privilege escalation flaws.

Vulnerabilities4 high

Router and IoT Device Vulnerabilities

Multiple command injection and buffer overflow vulnerabilities discovered in GL.iNet routers with public exploits available.

Vulnerabilities4 high

Database and Enterprise Application Vulnerabilities

Critical privilege escalation vulnerabilities in AWS Aurora PostgreSQL wrappers and multiple SQL injection flaws in enterprise applications.

Malware2 high

Mozi Botnet Infrastructure

Sustained Mozi botnet activity with 24 malware distribution URLs identified, primarily targeting MIPS-based IoT devices.

Malware1 high · 2 medium

ClearFake and Emerging Threats

ClearFake campaign continues with multiple new distribution domains. New ELF malware distribution infrastructure identified.

Tools & Techniques1 critical · 3 high

Attack Techniques and Exploitation Methods

Analysis of prevalent attack techniques observed across vulnerability disclosures and malware campaigns.

  • Critical severity
    Supply Chain Attacks via Package Repositories

    CVE-2026-45758 (malicious Guardrails AI package) demonstrates ongoing risk of compromised packages in public repositories. Attackers publish malicious versions of legitimate packages to PyPI for widespread distribution.

    Source: Manual
  • High severity
    Deserialization Attacks Targeting Web Applications

    Multiple critical deserialization vulnerabilities (CVE-2026-45247, CVE-2026-7654) demonstrate continued effectiveness of object injection attacks against PHP and Java applications. Attackers leverage unsafe unserialize() operations for remote code execution.

    Source: Manual
  • High severity
    Command Injection in IoT Devices

    GL.iNet router vulnerabilities and JD Cloud Box flaw showcase persistent command injection issues in IoT firmware. Attackers manipulate input parameters passed to system functions without proper sanitization.

    Source: Manual
  • High severity
    Authentication Bypass via Logic Errors

    UDS Identity Config and WordPress plugin vulnerabilities show how authentication logic flaws enable complete security control bypass. Missing capability checks and insufficient validation allow unauthorized access.

    Source: Manual
DFIR Lab1 info

DFIR Analysis Capabilities

New blog post discusses advanced email header analysis capabilities for incident response.

  • Info severity
    MxToolbox vs DFIR Platform: Beyond Basic Header Analysis

    Technical comparison of email header analysis tools for digital forensics and incident response investigations, highlighting advanced capabilities beyond basic MX record lookups.

    Source: Blog

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.