VulnHub

Nissan Americas has been impacted by a significant data breach linked to a zero-day vulnerability in Oracle’s PeopleSoft software, identified as CVE-2026-35273. This vulnerability has led to a series of attacks, with researchers connecting it to a group known as UNC6240, which is believed to be exploiting the weakness. The breach raises serious concerns about the security of sensitive employee information and operational data within Nissan Americas and potentially other organizations using the same software. As attackers continue to exploit this vulnerability, affected companies must act quickly to secure their systems and protect their data from further unauthorized access.

The Microsoft Defender vulnerability identified as CVE-2026-33825 has been actively exploited in ransomware attacks before any patches were made available. This zero-day vulnerability poses a significant risk to users of Microsoft Defender, as attackers have been able to take advantage of this flaw to deploy ransomware. The situation is urgent, as organizations using this security software may find themselves vulnerable to data breaches and financial loss. Experts strongly recommend that all users of Microsoft Defender remain vigilant and apply any available security updates as soon as they are released to mitigate potential risks. Immediate action is crucial to protect sensitive information from being compromised by malicious actors.

An anonymous researcher has released zero-day exploits for several software products, raising concerns among users and developers. Notably, a critical vulnerability in libssh2 (CVE-2026-55200) allows attackers to execute code remotely without authentication. Additionally, a flaw in self-hosted Gitea Docker deployments (CVE-2026-20896) permits authentication bypass, enabling attackers to impersonate users and potentially take over Git servers. This incident is significant as it exposes serious weaknesses in widely used software, which could lead to unauthorized access and data breaches if not addressed promptly. Organizations using these products should be vigilant and take immediate steps to secure their systems.

A new security vulnerability, CVE-2026-48558, has been identified in SimpleHelp, a remote support software. This critical flaw, which has a maximum severity score of 10.0, allows attackers to bypass authentication during the OpenID Connect (OIDC) flow. As a result, these attackers have been exploiting this weakness to deploy two malware families: TaskWeaver and Djinn Stealer. The situation poses significant risks for users of SimpleHelp, as the malware could lead to data theft and further system compromises. Organizations using this software should take immediate action to secure their systems against this ongoing threat.

Attackers are currently exploiting a vulnerability in SimpleHelp, identified as CVE-2026-48558, which allows for an authentication bypass. This vulnerability has been patched, but it is actively being used to deploy Djinn Stealer malware on victim systems. Djinn Stealer is a versatile piece of malware that targets various operating systems, including Windows, macOS, and Linux. It collects sensitive credentials from a wide range of applications, including cloud services, source control, and cryptocurrency wallets. The situation poses a significant risk to users of SimpleHelp, particularly managed service providers, as the malware can compromise sensitive data and systems.

A serious vulnerability, identified as CVE-2026-46817, has been discovered in Oracle E-Business Suite, allowing remote attackers to gain unauthorized access to Oracle Payments. This flaw has a high severity rating of 9.8 on the CVSS scale and is currently being exploited in real-world attacks, according to cybersecurity firm Defused Cyber. Organizations using Oracle E-Business Suite need to be particularly vigilant, as this vulnerability can lead to significant financial and operational risks. The situation is critical, and immediate action is necessary to protect sensitive payment information and other related data from unauthorized access. Users and administrators should prioritize addressing this vulnerability to mitigate potential breaches.

A serious vulnerability affecting Oracle E-Business Suite, identified as CVE-2026-46817, is currently being exploited by attackers. This flaw, which has a CVSS score of 9.8, relates to improper privilege management and authentication issues in Oracle Payments. If exploited, this vulnerability could allow unauthorized users to take control of affected instances, posing a significant risk to organizations using the software. The situation calls for immediate attention, as the vulnerability is actively being targeted in the wild. Companies using Oracle E-Business Suite should prioritize addressing this flaw to protect their systems and data from potential breaches.

Hackers are taking advantage of a serious vulnerability (CVE-2026-48558) in SimpleHelp, a remote support software, to deploy a new type of malware known as Djinn Stealer. This malware is capable of stealing information across multiple operating systems, including Windows, macOS, and Linux. Users of SimpleHelp are at risk as the flaw allows attackers to infiltrate systems and extract sensitive data without detection. The emergence of this undocumented malware raises concerns about the security of remote support tools, as they are commonly used by businesses and individuals for remote access. It is crucial for users to remain vigilant and apply any necessary updates to protect their information.

Hackers are actively exploiting a serious vulnerability, identified as CVE-2026-46817, in the Oracle E-Business Suite (EBS) financial application. This flaw poses a significant risk to businesses using the software, as it allows unauthorized access to sensitive financial data. Threat intelligence firm Defused reported that the attacks are already underway, making it crucial for organizations to take immediate action to protect their systems. Users of Oracle EBS should prioritize updating their software and implementing any available security patches to mitigate the risk of exploitation. The urgency of this situation highlights the ongoing need for vigilance in cybersecurity practices, especially for widely used enterprise applications.

A recently released proof-of-concept has exposed a serious vulnerability, CVE-2026-55200, in the libssh2 library, which is widely used for client-side SSH connections. This flaw allows a malicious SSH server to cause memory corruption on a client connecting to it, potentially leading to code execution without needing user credentials or interaction. The vulnerability impacts all versions of libssh2 up to 1.11.1 and has been rated with a CVSS score of 9.2, indicating its severity. Users of affected versions are at risk of exploitation, making it crucial for them to take immediate action. Given the nature of this flaw, it poses a significant threat to systems relying on libssh2 for secure connections.

A newly discovered vulnerability in the Linux kernel, identified as CVE-2026-46331 and dubbed 'pedit COW', poses a significant risk by allowing unprivileged local users to gain root access on affected systems. This flaw resides in the traffic-control subsystem, specifically in the packet-editing action (act_pedit), which can lead to an out-of-bounds write that corrupts shared page-cache memory. The public release of a working exploit occurred just a day after the vulnerability was disclosed on June 16, raising concerns about its potential for exploitation. Red Hat has classified this flaw as important, emphasizing the urgency for users to assess their systems and apply necessary security measures. Given the rapid emergence of exploits, organizations using Linux systems should prioritize patching and monitoring for unusual activity to mitigate the risk of unauthorized access.