DFIRLab
All Briefings
weeklyJune 8, 2026 — June 15, 2026Published 07:01 UTC

Weekly Threat Briefing — 2026-06-08 to 2026-06-15

36 findings9 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
930 CVEs6,314 IOCs

First seen in this period: CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 31
Browse all 36 findings

Executive summary · as of 07:01 UTC

The situation

This week's threat landscape is dominated by critical authentication and command injection vulnerabilities requiring immediate attention. CISA added seven vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, with Oracle PeopleSoft (CVE-2026-35273) being actively exploited by ransomware actors for complete system takeover. Critical authentication bypasses in Check Point Security Gateway and Nefteprodukttekhnika gas station systems present immediate remote exploitation risks.

Browse the full briefing

36 findings · 9 sections
Findings by severity
  • 5 critical
  • 26 high
  • 5 medium
Vulnerabilities3 critical · 3 high · 1 medium

Critical Known Exploited Vulnerabilities

CISA added seven critical vulnerabilities to KEV catalog, with multiple authentication bypasses and command injection flaws under active exploitation

Vulnerabilities1 critical · 2 high

High-Severity Network Device and Router Vulnerabilities

Multiple critical command injection and authentication bypass vulnerabilities in network devices and embedded systems

Vulnerabilities3 high

Security Product Vulnerabilities

Critical vulnerabilities in security software create ironic attack vectors through antivirus engines and security management platforms

Vulnerabilities1 critical · 4 high

OpenClaw Remote Management Platform - Multiple Critical Flaws

Seven vulnerabilities in OpenClaw platform enable authorization bypass, command execution, and privilege escalation in remote management infrastructure

Vulnerabilities4 high

Industrial Control and Embedded System Vulnerabilities

Critical vulnerabilities in ICS protocols and embedded libraries affecting industrial and IoT systems

Vulnerabilities3 high

Linux System Vulnerabilities - ABRT Service Race Conditions

Multiple race condition and symlink vulnerabilities in ABRT automated bug reporting tool enable privilege escalation

Vulnerabilities3 high

Web Application Vulnerabilities

SQL injection and cross-site scripting vulnerabilities in WordPress plugins and library management systems

Malware3 high · 2 medium

Active Malware Distribution Campaigns

50 malicious URLs identified distributing Mozi botnet, ClearFake browser updates, and mobile banking trojans

Tools & Techniques1 high · 2 medium

Emerging Attack Techniques and Tradecraft

Analysis of novel attack methods observed in disclosed vulnerabilities

  • High severity
    Security Product Exploitation via Malformed Files

    Multiple Avira vulnerabilities demonstrate targeted exploitation of security products through weaponized file formats (tar, PE, PDF). Attackers can disable protection by crashing antivirus engines or achieve code execution during scan operations.

    Source: Manual
  • Medium severity
    Approval System Bypass Through UI Truncation

    OpenClaw CVE-2026-53829 demonstrates a novel social engineering technique: submitting oversized commands with benign prefixes to hide malicious suffixes from approval interfaces. This technique exploits human review processes and UI display limitations.

    Source: Manual
  • Medium severity
    Shell Expansion Allowlist Bypass

    CVE-2026-53831 showcases exploitation of shell metacharacter expansion after allowlist validation. Attackers use approved command prefixes with shell wildcards to access unintended file paths, bypassing static allowlist checks.

    Source: Manual

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.