Microsoft shipped its largest Patch Tuesday ever, addressing nearly 200+ vulnerabilities, while a researcher released a proof‑of‑concept for a new Windows Defender race condition dubbed “RoguePlanet” that grants SYSTEM privileges. With three zero-days publicly disclosed and exploit code emerging within hours, defenders should prioritize rapid patching and watch for local privilege escalation attempts tied to Defender’s offline scan behavior.
Source: Help Net Security
Ivanti Sentry: Critical pre-auth RCE (CVE-2026-10520) with public PoC—patch now
Ivanti Sentry contains a CVSS 10.0 OS command injection flaw and a 9.9 auth bypass that allow unauthenticated attackers to gain root-level code execution and full admin access. A working PoC for CVE‑2026‑10520 is public and exploitation is considered likely; Ivanti has released fixes (10.7.1/10.6.2/10.5.2), and organizations should patch outside normal cycles.
Source: Rapid7
CISA orders 3‑day patching for high‑risk vulns amid AI‑accelerated exploits
A new CISA directive will require U.S. federal agencies to remediate certain high‑risk vulnerabilities within 72 hours, reflecting concern that AI tools are compressing the time from discovery to exploitation. Agencies have 180 days to implement the new prioritization, which emphasizes exposed assets, automation‑friendly flaws, complete system compromise potential, and active exploitation.
Source: Recorded Future News (The Record)
OWASP: Prompt injection remains the top cause of agentic AI failures
OWASP’s latest State of Agentic AI Security and Governance highlights that prompt injection still drives most production security failures, with recent incidents including a backdoored LiteLLM package that briefly shipped an autonomous attack bot to tens of thousands of downloads. The report underscores the need for rigorous package integrity, strict capability scoping, input/output controls, and auditable decision trails for AI agents.
Source: Help Net Security
China‑linked JDY botnet expands to 1,500+ SOHO/IoT devices for mass recon
Researchers report a resurgence and growth of the JDY botnet, which commandeers routers and IoT gear to continuously scan and fingerprint exposed services at scale. Tied to China‑nexus actors, JDY’s high‑performance reconnaissance raises concerns for pre‑positioning against critical infrastructure; defenders should harden edge devices, disable unnecessary services, and segment networks.
Source: The Hacker News
ServiceNow patches flaw exploited against some customers’ instances
ServiceNow confirmed a security issue—reportedly known since April—was exploited to gain deeper, unauthorized access to certain hosted customer instances before a June 5 update. Impacted organizations should review access logs, rotate credentials and tokens, and validate whether unauthenticated API exposure occurred in their environments.
Source: SecurityWeek
Krebs: Inside ‘The Gentlemen’—ransomware group racing up the charts
‘The Gentlemen’ has rapidly become the second most active ransomware operation by victim count, luring affiliates with a 90/10 revenue split and aggressive recruitment. New research pieces together clues pointing to a possible real‑world identity for the group’s administrator, offering defenders insights into the gang’s structure and growth strategy.
Source: KrebsOnSecurity
You May Also Be Interested In...
New Browser‑in‑the‑Browser phishing uses fake login popups to steal Microsoft 365 credentials
GitHub to disable npm install scripts by default to curb supply‑chain attacks
Critical HVAC and UPS flaws could let attackers disrupt data centers