Blahalla

SVD-2026-0602: Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise

advisory.splunk.com · 4 months ago

Low-privilege SSRF via Splunk Dashboard Studio PDF export exploits CVE-2026-20252. Attackers bypass domain checks for internal requests. Upgrade Splunk users to patch this vulnerability.

SVD-2026-0603: Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

advisory.splunk.com · 4 months ago

Critical vulnerability CVE-2026-20253 affects Splunk's PostgreSQL sidecar service endpoint, allowing unauthenticated users to create or truncate arbitrary files. This flaw stems from the endpoint lacking necessary authentication controls. Users must upgrade affected Splunk Enterprise and Cloud Platform versions to mitigate this critical risk.

SVD-2026-0604: Information Disclosure through External Content Restriction Bypass in Splunk Enterprise

advisory.splunk.com · 4 months ago

CVE-2026-20254 affects multiple Splunk versions. A low-privilege user can exploit it via crafted classic dashboards using CSS injection when a higher-privileged user views the payload, exfiltrating data. Upgrade or configure Trusted Domains to patch this medium-severity flaw.

SVD-2026-0605: Improper Input Validation through Classic Dashboards in Splunk Enterprise

advisory.splunk.com · 4 months ago

A vulnerability in Splunk's Classic Dashboards, tracked as CVE-2026-20255, permits low-privileged users to craft dashboards that exfiltrate sensitive data. This flaw arises because incomplete URL validation allows the dashboard to make requests to untrusted external servers. Organizations must upgrade affected versions or configure restricted domains to mitigate this risk.

SVD-2026-0606: Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise

advisory.splunk.com · 4 months ago

Low-priv users can exfiltrate data via Splunk Classic Dashboards < 10.2.4 (CVE-2026-20256). Attackers use protocol-relative URLs in drill-down links. Upgrade affected Splunk Enterprise/Cloud to patched versions.

SVD-2026-0607: Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise

advisory.splunk.com · 4 months ago

Low-privilege user found CVE-2026-20257 in older Splunk. It allows data exfiltration from higher-privileged users via crafted classic dashboards by exploiting improper style attribute validation. Upgrade to patched versions or restrict dashboard access immediately.

SVD-2026-0608: Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise

advisory.splunk.com · 4 months ago

Researchers found a Stored Cross-Site Scripting vulnerability (CVE-2026-20258) in Splunk Enterprise and Cloud Classic Dashboards. Low-privileged users exploit this flaw by storing malicious scripts that execute unauthorized JavaScript when another user visits the dashboard via phishing. Organizations must upgrade to patched versions, such as 10.2.4 or later, eliminating the attack surface.

SVD-2026-0609: Improper Access Control in Splunk Enterprise

advisory.splunk.com · 4 months ago

CVE-2026-20259 exposes improper access control in multiple Splunk versions. A user with the high-privilege capability editsavedsearchowner could reassign saved search ownership to users outside their authorized scope, as the endpoint lacks necessary controls. Organizations must upgrade affected instances, including Splunk Enterprise and Cloud Platform components, for mitigation.

SVD-2026-0610: Third-Party Package Updates in Splunk Enterprise - June 2026

advisory.splunk.com · 4 months ago

Splunk patched many Common Vulnerabilities and Exposures in Third Party Packages for several Enterprise versions. The patches upgraded core libraries, including MongoDB, aiohttp, opentelemetry, PostgreSQL, and golang, to resolve issues like CVE-2026-4147 and CVE-2025-68121. These updates address various vulnerabilities across components listed by the advisory ID SVD-2026-0610.

SVD-2026-0611: Log Injection through HTTP Request Paths in Splunk SOAR

advisory.splunk.com · 4 months ago

Splunk SOAR versions below 8.5.0 contain CVE-2026-20260, allowing unauthenticated attackers to inject ANSI escape codes into application logs via specially crafted HTTP request paths. This vulnerability stems from SOAR failing to strip control characters before writing them to the log files. Users must upgrade Splunk SOAR to version 8.5.0 or later to mitigate this dangerous log injection risk.

SVD-2026-0612: Third-Party Package Updates in Splunk SOAR - June 2026

advisory.splunk.com · 4 months ago

Splunk SOAR v8.5.0 patches multiple CVEs including pyasn1's CVE-2026-23490, wheel's CVE-2026-24049, and more (e.g., CVE-2025-12817). This addresses several high-severity third-party package flaws across multiple vulnerabilities.

Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges

www.bleepingcomputer.com · 4 months ago

Nightmare Eclipse found "RoguePlanet," a zero-day exploit hitting patched Win 10/11 via MS Defender race condition. Attackers gain SYSTEM prompt access. ThreatLocker advises application allowlisting to protect all users.

A Record-Breaking Patch Tuesday for June 2026

krebsonsecurity.com · 4 months ago

Microsoft released ~200 patches for Windows, fixing zero-day flaws like CVE-2026-49160 (IIS/OpenAI Codex), CVE-2026-45586, and CVE-2026-50507. Nightmare Eclipse continues exploit drops despite updates.

Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility

unit42.paloaltonetworks.com · 4 months ago

Unit 42 research examined how groups target cloud logging services like AWS CloudTrail and Google Cloud Logging for defense evasion. Attackers attempt to manipulate logs or redirect data streams to achieve continuous visibility within a victim's environment. Organizations must understand these specific attack techniques to implement necessary defenses and detect service misuse.

The Invisible Battlefield: How Cyber War Is Reshaping Everyday Life

www.darkreading.com · 4 months ago

Former National Cyber Director Chris Inglis warns that cyberspace constitutes a consequential battlefield woven into modern life. He argues cyber conflict surpasses simple technical issues, becoming central to national competition. Attacks disrupting essential infrastructure like hospitals, utilities, and financial systems pose immediate threats to human life and commerce.

Blame AI: Patch Tuesday Hits Record 206 CVEs

www.darkreading.com · 4 months ago

MS June 2026 Patch Tuesday fixed 206 CVEs, showing AI's speed. Flaws include RCE in Windows HTTP.sys (CVE-2026-47291) and DHCP Client (CVE-2026-44815). Other fixes: CVE-2026-42987, CVE-2026-44803, CVE-2026-44812; EoP/DoS: CVE-2026-45586, CVE-2026-49160/CVE-2026-50507.

ServiceNow discloses security incident exposing customer data

www.bleepingcomputer.com · 4 months ago

Exploitable unauthenticated flaw in ServiceNow API allowed querying sensitive customer data. Impacts older/Australia platform versions. Update restricted access to authenticated users only. Admins must check logs.

OpenClaw AI agent found falling for phishing attacks, spills user data

www.bleepingcomputer.com · 4 months ago

Varonis tested OpenClaw AI with phishing simulations using LLMs like Gemini 3.1 Pro. Social engineering exposed the agent's weakness; urgency bypassed guards, leaking AWS IAM keys and CRM data.

G.M. Plans to Sell Energy Storage Batteries as E.V. Sales Flag

www.nytimes.com · 4 months ago

General Motors aims to enter the energy storage market, challenging Tesla's dominance. The carmaker will build large batteries designed to manage fluctuating power supplies for utilities and data centers. These systems help stabilize electricity demand across various businesses.

Meta A.I. Bug Allowed Hackers to Take Over Instagram Accounts

www.nytimes.com · 4 months ago

A flaw in Meta's new artificial intelligence software allowed unauthorized users to take over any Instagram account. The vulnerability reportedly bypassed previous security fixes implemented by the company.

Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address

www.darkreading.com · 4 months ago

InfoGuard found "Ghost-Sender," an email spoofing flaw in Microsoft Exchange hybrid modes. It targets orgs with external mail servers, bypassing SPF/DKIM/DMARC via exposed MX records. Attackers can send emails appearing from any source.

In A.I. Blunder, More Than 34,000 Instagram Accounts Became Vulnerable

www.nytimes.com · 4 months ago

Meta's new artificial intelligence software contains a flaw allowing users to take over Instagram accounts. The vulnerability persists, despite Meta previously claiming it had fixed the bug. Researchers report that anyone can exploit this flaw to compromise user accounts.

Anthropic releases Mythos-class Fable 5 model with safeguards for cyber risks

www.csoonline.com · 4 months ago

Anthropic's Claude Fable 5 AI is here for tasks like engineering and research. It uses Claude Opus 4.8 guardrails, but early tests show potential over-restriction of standard security work.

SAP fixes critical flaws in NetWeaver and Commerce Cloud

www.bleepingcomputer.com · 4 months ago

SAP's June 2026 patch fixes 15 vulnerabilities across core platforms. Critical updates address CVE-2026-44748 (XML Signature Wrapping), CVE-2026-27671 (memory corruption), CVE-2026-22732, CVE-2026-40128, CVE-2026-29145, and CVE-2026-44751. Users must apply these patches immediately.

Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories

www.darkreading.com · 4 months ago

Miasma worm hit Microsoft GitHub on June 5, taking 73 Azure repos offline via compromised PyPI packages ("rope.pyz"). Attackers used poisoned durabletask SDK with official credentials to steal secrets and deploy wipers against CI/CD pipelines.

Microsoft Patches 200 Vulnerabilities

www.securityweek.com · 4 months ago

MS June 2026 Patch Tuesday addressed 200 vulns. Key: CVE-2026-49160 (HTTP2/Bomb DoS), CVE-2026-50507 (BitLocker bypass, physical access), and CVE-2026-45586 (Win CTF escalation). All rated 'exploitation more likely.' Patch immediately.

Apple’s Siri-AI, or more shouting into the void about “private” agents

blog.cryptographyengineering.com · 4 months ago

Apple plans a major AI upgrade for Siri via a partnership with Google, integrating Gemini models into the voice assistant system. To maintain privacy, this architecture combines Google’s Confidential Inference with Apple’s Private Cloud Compute (PCC). This setup ensures data processes entirely on encrypted hardware, preventing both Apple and Google from accessing private user information.

Microsoft releases Windows 10 KB5094127 extended security update

www.bleepingcomputer.com · 4 months ago

MS released Windows 10 KB5094127 patching 200 flaws, including zero-days. It updates Secure Boot and File Explorer. Note potential BitLocker prompts postinstall on certain TPM systems.

Adobe Patches 123 Vulnerabilities

www.securityweek.com · 4 months ago

Adobe patched 123 vulnerabilities across 11 products during Patch Tuesday's updates. Experience Manager received 57 fixes, primarily addressing XSS flaws and improper input validation. Adobe also resolved critical issues in Adobe Campaign Classic and ColdFusion, stating that most addressed vulnerabilities lack known wild exploitation.

Microsoft June 2026 Patch Tuesday fixes 6 zero-days, 200 flaws

www.bleepingcomputer.com · 4 months ago

Microsoft's June 2026 Patch Tuesday released updates for 200 flaws, including six zero-day vulnerabilities and one actively exploited in attacks. Critical patches address issues like CVE-2026-45586, a Windows Collaborative Translation Framework elevation of privilege flaw. The cumulative update also resolves the HTTP/2 denial-of-service vulnerability identified as CVE-2026-49160.

Microsoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flaws

www.bleepingcomputer.com · 4 months ago

Microsoft released its June 2026 Patch Tuesday updates, addressing over 200 flaws and three publicly disclosed zero-day vulnerabilities. The patches fix Elevation of Privilege flaw CVE-2026-45586 in the Collaborative Translation Framework and HTTP/2 Bomb Denial of Service vulnerability CVE-2026-49160. Microsoft also included fixes for CVE-2026-50507 among numerous other critical system flaws.

Reconstructing AI activity in investigations

www.microsoft.com · 4 months ago

Security teams can adopt a structured, telemetry-driven playbook to investigate AI activity within Microsoft 365 Copilot and Azure AI services. This guidance helps investigators reconstruct detailed events and assess potential data exposure following an incident. Ultimately, the approach enables security professionals to detect threats faster.

Check Point Warning: Actively Exploited VPN Zero-Day Linked to Qilin Ransomware

www.techrepublic.com · 4 months ago

Check Point disclosed that a zero-day vulnerability, CVE-2026-50751, impacted its VPN service. Qilin-linked actors exploited this flaw, prompting Check Point to issue emergency hotfixes. Organizations must also meet a strict CISA patch deadline to secure affected systems.

Windows 11 KB5094126 & KB5093998 cumulative updates released

www.bleepingcomputer.com · 4 months ago

MS released KB5094126/KB5093998 for Win 11 (25H2/24H2/23H2), patching critical flaws. Updates add Bluetooth LE Audio, Magnifier, and NPU tracking in Task Manager.

Anthropic Releases ‘Safe’ Version of Its Mythos A.I. Technology

www.nytimes.com · 4 months ago

Anthropic is developing Claude Fable 5, its next flagship AI system. The company announced this new model costs twice as much as Anthropic's previous generation system.

Meta to Use Off-Site Business Data for Feed and AI Personalization

thehackernews.com · 4 months ago

Meta announced plans to use off-site information shared by other businesses to personalize user feeds and responses from its AI chatbot. This greatly expands Meta's data usage, moving beyond limited ad targeting. The company stated it already collects data detailing people's activity on various websites.

Anthropic Launches Claude Fable 5: Mythos-Class AI With Cybersecurity Guardrails

www.securityweek.com · 4 months ago

The AI giant also announced that Project Glasswing partners are being given access to the upgraded Mythos 5.

OpenSSL Patches High-Severity Vulnerability Found With AI

www.securityweek.com · 4 months ago

A total of 18 vulnerabilities have been patched in the latest OpenSSL releases, including many that were potentially discovered by AI.

Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code

thehackernews.com · 4 months ago

Veeam released security patches addressing a critical flaw in its Backup & Replication software. Tracked as CVE-2026-44963, this vulnerability allows remote code execution (RCE) on the Backup Server using only an authenticated domain user account. The advisory highlights the flaw carries a high CVSS score of 9.4 out of 10.

Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues

thehackernews.com · 4 months ago

Microsoft on Monday confirmed that it temporarily removed some GitHub repositories in response to a recent security incident that led to 73 of its open-source projects being compromised to inject an information stealer into the code. "Our priority is to protect customers and the broader ecosystem," a Microsoft spokesperson told The Hacker News via email.

Spyware firm targeted WhatsApp users in defiance of US court order, Meta says

www.theguardian.com · 4 months ago

Tech company says it ‘caught and disrupted’ NSO Group’s attempts to access accounts in Jordan and Lebanon A spyware firm has been targeting WhatsApp users with malicious links in contravention of a US court order forbidding it from doing so, Meta has said.

XBOW tests Anthropic's Mythos Preview for offensive security

www.bleepingcomputer.com · 4 months ago

Anthropic's Mythos Preview was highly effective at finding vulnerability candidates, especially when analyzing source code. XBOW explores how the model performed across exploit discovery, reverse engineering, and live-site validation.

GitHub disables Microsoft repos pushing password-stealing malware

www.bleepingcomputer.com · 4 months ago

Microsoft removed 73 repositories across its Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations on GitHub, disrupting continuous integration pipelines.

Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs

www.darkreading.com · 4 months ago

Two separate campaigns target CVE-2025-8088, fixed last July, to conduct data theft and cyberespionage against military and government targets in Ukraine.

GPS As a Key Distribution Platform

www.schneier.com · 4 months ago

This is interesting: The U.S. military has likely been quietly broadcasting codes for its global encryption network using public GPS for nearly 20 years, turning each satellite into a hidden “numbers station,” according to Steven Murdoch… That means every device that uses GPS has been receiving hidden government information for years, and nobody outside the military knew it until now.

Claude Mythos Turns N-Days Into N-Hours With Rapid Exploit Creation

www.securityweek.com · 4 months ago

Public LLM models with safeguards turned off can also build working exploits, increasing patch gap risks.

Dutch Authorities Block $115 Million Deal by a U.S. Tech Company

www.nytimes.com · 4 months ago

The Netherlands blocked a U.S. company from buying a Dutch firm that handles its national ID system, saying it would create a “threat to the public interest.

Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability

sec.cloudapps.cisco.com · 4 months ago

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

New Veeam vulnerability exposes backup servers to RCE attacks

www.bleepingcomputer.com · 4 months ago

Veeam has released security updates to patch a critical Backup & Replication security flaw that can be exploited to gain remote code execution (RCE) on domain-joined backup servers.

Why Apple’s A.I. Upgrade for Siri Won’t Be Available in Europe

www.nytimes.com · 4 months ago

A regulatory dispute has indefinitely delayed the release of Siri AI.