Rapid7

Microsoft released a record 200 security patches in June 2026's Patch Tuesday, with 30 critical vulnerabilities and public exploits for three flaws. AI tools are increasingly used to discover bugs, and researcher Nightmare Eclipse disclosed multiple zero-day exploits, including CVE-2026-49160 and CVE-2026-50507, sparking controversy over Microsoft's legal stance on researchers.

Palo Alto Networks' CVE-2026-0257 vulnerability, initially rated medium severity, was escalated to critical after active exploitation was confirmed. Attackers exploit the flaw to bypass authentication and establish unauthorized VPN connections, leveraging a publicly available TLS certificate to forge valid authentication cookies.

Palo Alto Networks disclosed a critical security flaw, CVE-2026-0257, in PAN-OS GlobalProtect that allows attackers to bypass authentication and gain unauthorized VPN access. Researchers at Rapid7 confirmed active exploitation since May 17, prompting Palo Alto to elevate the severity rating and CISA to add it to its exploited vulnerabilities catalog with a June 1 patch deadline.

A critical remote code execution (RCE) vulnerability in Gogs, a self-hosted Git service, remains unpatched despite being reported in March. The flaw allows authenticated users to exploit default installations, steal credentials, and execute arbitrary code. Rapid7 researcher Jonah Burgess disclosed the issue (GHSA-qf6p-p7ww-cwr9) and submitted a proposed fix, but Gogs maintainers have not released a patch, prompting a Metasploit module to be published.

A critical remote code execution (RCE) vulnerability has been disclosed in Gogs, an open-source self-hosted Git service, allowing authenticated users to execute arbitrary code. The flaw is rated 9.4 on the CVSS scoring system and currently lacks a CVE identifier.

Cisco is under attack by a persistent threat group exploiting a zero-day vulnerability in its Catalyst SD-WAN Controller and Manager, with a CVSS rating of 10. The vulnerability, CVE-2026-20182, allows attackers to bypass authentication and gain administrative access. Cisco has released a patch for the vulnerability.

Cisco admins must patch a max-severity make-me-admin bug affecting Catalyst SD-WAN Controller and Manager, which allows unauthenticated remote attackers to gain admin privileges. The vulnerability, CVE-2026-20182, has been exploited as a zero-day and was added to the Known Exploited Vulnerabilities catalog. Cisco strongly recommends applying available fixes.

Microsoft released software updates to address at least 118 security vulnerabilities in its various Windows operating systems and other products on Patch Tuesday. This is the first Patch Tuesday in nearly two years that Microsoft is not shipping any fixes to deal with emergency zero-day flaws. The patches include critical vulnerabilities such as CVE-2026-41089 and CVE-2026-41096.

Researchers discovered an Iranian government-backed hacking group, MuddyWater, using Chaos ransomware as a cover for their attacks. The incident was initially thought to be a Chaos ransomware attack but was later attributed to MuddyWater, tied to Iran's Ministry of Intelligence and Security. This revelation highlights the evolving tactics of state-sponsored hacking groups.

Arctic Wolf laid off 250 employees to invest more in AI and position the company for long-term strategy. The layoffs represent less than 10 percent of the total workforce. The company aims to operate more efficiently and deliver strong value to customers.

Iranian intelligence cyber unit posed as Chaos ransomware gang to hide state-sponsored espionage operation, using phishing campaign and social engineering to gain access to targets' credentials. The attackers then executed various commands and downloaded payloads, including backdoor malware. The operation was spotted by Researchers at Rapid7 earlier this year.

MuddyWater, an Iranian state-sponsored hacking group, has been attributed to a false flag ransomware attack that leverages social engineering techniques via Microsoft Teams. The attack was observed by Rapid7 in early 2026 and initiates the infection sequence. MuddyWater is also known as Mango Sandstorm, Seedworm, and Static Kitten.

A Linux vulnerability known as 'Copy Fail' is being actively exploited, allowing attackers to gain total control of a system with authenticated local access. The vulnerability was discovered by Theori using AI and affects Linux kernels built since 2017. Patches have been issued for major Linux distributions.

CISA has mandated federal agencies to patch the cPanel vulnerability CVE-2026-41940 by Sunday. Rapid7's incident responders warned that successful exploitation allows attackers full control over cPanel systems, configurations, databases, and managed websites.

cPanel's authentication bypass vulnerability (CVE-2026-41940) is being actively exploited, affecting all supported versions since 11.40 and WP Squared. CISA added it to its KEV list, while cPanel released a patch addressing the flaw, which allows attackers to inject malicious data during login to bypass authentication.