Zero Day Wire

Alerts

Microsoft June 2026 Patch Tuesday Fixes 200 Vulnerabilities Including Three Publicly Disclosed Zero-Days and 33 Critical Flaws

Microsoft's June 2026 Patch Tuesday addresses 200 vulnerabilities, including three publicly disclosed zero-days covering a CTFMON privilege escalation, the "HTTP/2 Bomb" denial-of-service technique, and the YellowKey BitLocker bypass released by Nightmare Eclipse.

Threats

Silent Ransom Group Escalates Data Theft Campaign Against US Law Firms — Combining Vishing, IT Impersonation, and Physical Office Intrusions to Exfiltrate and Extort Within 30 Minutes

Google Mandiant attributes a sustained data theft and extortion campaign to UNC3753, combining voice phishing, IT impersonation, and in-person office break-ins to compromise US law and financial firms — progressing from initial contact to ransom demand in under an hour.

Alerts

Google Patches Fifth Chrome Zero-Day Exploited in 2026 — V8 Out-of-Bounds Read/Write Enables Sandbox Code Execution (CVE-2026-11645)

Google has released emergency Chrome 149 updates to patch CVE-2026-11645, a high-severity V8 out-of-bounds read/write zero-day exploited in the wild — the fifth Chrome zero-day patched this year.

Alerts

Critical UniFi OS Exploit Chain Grants Unauthenticated Root Access to Network Management Consoles — No Credentials Required

Three chained vulnerabilities in Ubiquiti UniFi OS Server allow attackers to bypass authentication, execute commands, and escalate to root with no credentials or user interaction — granting full control over network infrastructure, surveillance cameras, and door access systems.

Alerts

Check Point VPN Zero-Day Exploited by Qilin Ransomware Affiliate — Authentication Bypass Allows VPN Sessions Without Passwords (CVE-2026-50751)

Check Point has disclosed active exploitation of a critical authentication bypass vulnerability in its Remote Access VPN and Mobile Access products, tracked as CVE-2026-50751 with a CVSS score of 9.3. The flaw allows an unauthenticated remote attacker to establish a VPN session without a valid password by

Threats

GitHub Disables 73 Microsoft Repositories in 105 Seconds After Miasma Worm Compromises Azure Infrastructure and Breaks CI/CD Pipelines

GitHub has disabled 73 Microsoft repositories after the Miasma worm infiltrated Azure infrastructure through a compromised contributor account, breaking CI/CD pipelines across the Azure Functions ecosystem and triggering remote code execution on developer machines that opened the infected repos in IDEs and AI coding tools. The attack began on

Breaches

Former IBM Threat Intelligence VP Alleges IBM and AT&T Hid Nation-State Breaches From Federal Government in Unsealed False Claims Act Lawsuit

A False Claims Act lawsuit originally filed under seal in 2020 has been unsealed after the federal government declined to join as co-plaintiff, revealing explosive allegations from IBM's former Vice President of Threat Intelligence that both IBM and AT&T systematically concealed nation-state hacking incidents

Breaches

Meta Confirms 20,000 Instagram Accounts Hijacked After Attackers Exploit AI-Powered Support System to Bypass Authentication

Meta has disclosed that over 20,000 Instagram accounts were hijacked after attackers exploited a vulnerability in the company's AI-powered High Touch Support (HTS) system — an account recovery tool designed to help users regain access after being locked out. The flaw allowed unauthorized password resets without verifying

Threats

Five Eyes Warn Chinese Military Intelligence Recruiting Government and Military Personnel Through Fake Job Offers on LinkedIn and Indeed

The intelligence agencies of all five Five Eyes nations have issued a joint alert warning that Chinese military intelligence officers are conducting coordinated recruitment campaigns on professional networking platforms, targeting government and military personnel with access to classified or privileged information. The alert — co-authored by the FBI, MI5, the

Alerts

PAN-OS Authentication Bypass Under Active Exploitation — Attackers Initiating Unauthorized VPN Sessions via GlobalProtect (CVE-2026-0257)

Palo Alto Networks Unit 42 has confirmed active exploitation of CVE-2026-0257, an authentication bypass vulnerability in the portal and gateway components of PAN-OS that allows unauthorized attackers to circumvent security controls and initiate VPN connections through GlobalProtect. CISA added the flaw to its Known Exploited Vulnerabilities catalog

Breaches

GitHub Confirms TeamPCP Breach of 3,800 Internal Repositories After Employee Installed Poisoned VS Code Extension

GitHub has confirmed that approximately 3,800 internal repositories were compromised after a TeamPCP supply chain attack that began with a single employee installing a poisoned Visual Studio Code extension. The breach was announced on Tuesday after TeamPCP posted claims on an underground forum offering GitHub's stolen source

Threats

Nx Console VS Code Extension Compromised — 2.2 Million Installs Exposed to Credential Stealer With Sigstore Supply Chain Poisoning Capability

A compromised version of the Nx Console extension — a popular VS Code plugin with over 2.2 million installations — was published to the Visual Studio Code Marketplace after an attacker leveraged stolen developer credentials to inject a multi-stage credential stealer into the official nrwl/nx GitHub repository. The malicious