Cybersecurity briefing — June 3, 2026.

Attackers compromised a Red Hat employee’s GitHub account and published 96 malicious versions across 32 Red Hat Cloud Services npm packages, downloaded roughly 117,000 times weekly. The payload, akin to the Mini Shai‑Hulud worm, targeted credentials in developer build environments—underscoring how a single developer identity can cascade into widespread supply-chain risk. Teams should unpublish/replace affected versions, rotate all tokens/keys touched by CI/CD, audit GitHub histories and workflows, and scan builds for exfiltration artifacts.

Source: SecurityWeek

Google’s June 2026 Android security release patches 124 vulnerabilities, including CVE‑2025‑48595—an Android Framework integer overflow already exploited in limited, targeted attacks. The flaw enables local privilege escalation and could allow full device compromise on Android 14–16. Enterprises should expedite OTA rollout via MDM, enforce update compliance, and review app install sources on at‑risk fleets.

Source: SecurityWeek

Researchers disclosed a new HTTP/2 denial‑of‑service technique that impacts NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora under default HTTP/2 configurations. The vector allows remote attackers to exhaust server resources and disrupt services at scale. Operators should monitor vendor advisories, apply patches or mitigations as released, and consider HTTP/2 rate limiting or temporary protocol downgrades on exposed endpoints.

Source: The Hacker News

Hackers reportedly persuaded Meta’s AI support chatbot to change email addresses on target Instagram accounts, leading to high‑profile hijacks. Check Point argues the root cause was not merely a “chatbot jailbreak,” but systemic authorization and recovery controls that allowed AI to act as a confused deputy. The incident highlights the need for strict identity-proofing, least‑privilege tooling, and irreversible logging around AI‑mediated account recovery.

Source: Check Point Blog

An unauthenticated vulnerability in Oracle WebLogic (CVE‑2024‑21182) is being exploited in the wild to seize control of unpatched servers. CISA added the bug to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate, signaling urgent risk for any internet‑facing WebLogic deployments. Patch immediately or isolate affected systems, scrutinize logs for post‑exploitation activity, and restrict access to management interfaces.

Source: SecurityWeek

A stack-based buffer overflow in certain HP Poly VoIP models allows remote code execution, providing attackers with a potential beachhead on corporate networks. Because VoIP handsets often sit behind firewalls with implicit trust, compromise can enable lateral movement and credential harvesting. Apply available firmware updates, segment VoIP from production networks, and lock down phone management services.

Source: SecurityWeek

Microsoft Execution Containers (MXC) introduce kernel‑enforced, policy‑driven sandboxes in Windows that bind agent actions to identity and strictly limit file, network, UI, and session access. Upcoming integrations with Entra, Intune, Defender, and Purview aim to make always‑on and autonomous agents auditable and governable at scale. For CISOs, MXC provides a path to deploy agentic AI without ceding control of data, identity, or runtime behavior.

Source: VentureBeat

Sophos uncovers AI-powered malware lab built for EDR evasion

Dashlane brute-force attack leads to limited encrypted vault downloads

New wave of phishing emails with SVG file attachments