Comparing 16 June 2026 with the previous day 15 June 2026.
All three critical flaws (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) are being actively exploited; working exploits exist for at least two vulnerabilities, making immediate patching a priority for organizations running FortiSandbox.
APT37 deploys a new RAT malware (NarwhalRAT) featuring multi-stage Python loaders, pCloud as a secondary C2 channel, and advanced information collection capabilities,a sophisticated upgrade from previous RokRAT operations.
A previously Linux-only, China-linked backdoor is now expanding to Windows with two new variants (WIN_DRV and WIN_PLUS) leveraging kernel drivers for stealth and C&C communication over TCP/UDP.
Chinese state-sponsored actors are conducting coordinated dual-layer phishing campaigns against European targets, demonstrating increased operationalization of supply-chain attack patterns in countries adjacent to the DACH region.
An elevation-of-privilege flaw in the Microsoft Malware Protection Engine could allow attackers to escalate their privileges on affected systems, undermining Defender's effectiveness as a protective layer.
Critical vulnerabilities in Fortinet FortiSandbox are being actively exploited in attack campaigns, posing immediate risk to organizations deploying this solution.
Dirty Frag chains two kernel vulnerabilities (xfrm-ESP and RxRPC) into a local privilege-escalation flaw, but requires prior network access or system compromise, making it lower-priority for secured production environments.
The BSI warns of multiple privilege escalation vulnerabilities in core Microsoft Cloud services that can enable code execution and information disclosure , a strategic update for organizations with heavy Microsoft footprint.
An unauthenticated remote command execution vulnerability in FortiSandbox enables immediate exploitation risk for Fortinet deployments.
Three of the patched vulnerabilities are already being actively exploited for malicious code execution, posing an immediate risk to systems running outdated Firefox or Thunderbird versions.
A mistakenly enabled debug flag in production Microsoft 365 Android builds allowed attackers to steal authentication tokens and compromise user accounts.
The Kali365 phishing platform has expanded its targets from Microsoft 365 to AWS, Okta, and Russian services, using device code phishing to bypass multi-factor authentication.
Large-scale npm supply-chain attack compromises 32 packages under the @redhat-cloud-services scope through CI/CD pipeline manipulation; malware leverages preinstall hooks for automatic execution and multi-layer obfuscation to evade detection.
The BSI advisory contains no CVE number and no technical details about the vulnerability; the specific weakness and affected kernel versions cannot be identified.
BSI warns of multiple vulnerabilities in Microsoft Defender and Malware Protection Engine enabling privilege escalation, code execution, and denial of service , core security components require timely patching.
Copilot in Microsoft 365 enables data theft through simple interaction without advanced technical knowledge, presenting immediate risk to organizations with Copilot features enabled.
Remcos RAT campaign employs VHDX containers and multi-layered obfuscation to evade EDR solutions and process-monitoring rules; email-delivered ZIP vector remains largely undetected.
BSI update on multiple vulnerabilities in FortiSandbox with variable exploitability , patches should be applied promptly given the product's position in the security perimeter.
GhostTree uses recursive NTFS junctions to force Microsoft Defender scans into infinite loops, hiding malware from detection,an active evasion technique against production-critical security tools.
Ransomware operators exploit legitimate Microsoft Teams relay infrastructure to obfuscate command-and-control communications, bypassing traditional network-based security controls.
No changes in this category.
No changes in this category.
Unknown threat actors are actively exploiting an authentication bypass in Palo Alto VPN gateways to gain unauthorized access , a critical risk for networked manufacturing organizations in the DACH region whose partners or suppliers operate such systems.
North Korean APT groups exploit developer recruitment and code review themes to compromise developers and deploy malware through trusted development tools.
A China-linked APT group employs a novel technique: manipulating Google Workspace rules on compromised systems to auto-forward emails rather than direct exfiltration,this evades detection and could be replicated against European research and industrial networks.
Chinese espionage group operates persistent backdoor infrastructure in critical systems since at least 2023, targeting data theft with national security implications.
The vulnerability allows attackers to bypass the PDF sandbox via crafted documents with embedded JavaScript and execute arbitrary code , a significant risk for PDF processing in production environments.
Year-long undetected Chinese APT campaign systematically targets research institutions to exfiltrate data on AI, cyber-offensive capabilities, and defense technology,a pattern that should alert European research and technology organizations to similar targeting risk.
The BSI warning documents multiple security vulnerabilities in both browsers used in the company without specific CVE references; this suggests a vulnerability aggregation warning that is regularly updated.
BSI warns of multiple vulnerabilities in Adobe Acrobat/Reader without naming specific CVEs in this update; patching is recommended.
Three chained bugs enabled attackers to exfiltrate emails, calendar entries, and indexed files from Microsoft 365 Copilot Enterprise Search via a single click on a trusted Microsoft link, bypassing standard anti-phishing filters.
Attackers can abuse Microsoft 365 Copilot through crafted inputs to exploit user permissions and steal sensitive data in a single action.
Weekly summary of multiple unrelated vulnerabilities without description of a coordinated campaign; UniFi exploits and Chrome 0-day are relevant to the company, but the article provides no new attack scenarios or attribution intelligence.
A long-maintained BadIIS variant is distributed as commodity malware among Chinese-speaking cybercrime groups, with evasion updates targeting specific security vendors such as Norton.