Aggregator

LiteLLM 被披露存在 4 个高危安全风险，攻击者可利用漏洞链从低权限凭据逐步接管 AI Gateway 控制面，影响模型 API Key、MCP 工具凭据及下游 Agent 工作流，建议立即升级至 v1.83.14-stable。

Что заставляет мёртвую звезду светиться ярче спустя десятилетия после смерти?

可视化二进制流量编辑实操

Chinese police have dismantled several cybercrime cells tied to a new variant of the Silver Fox Trojan. The Ministry of Public Security’s cybersecurity bureau announced the crackdown this week, describing a malware operation that...

The post Silver Fox Trojan: China Cracks Down on Cybercrime Cells Across Five Provinces appeared first on Information Security News.

Oracle addresses 243 CVEs in its June 2026 Critical Security Patch Update with 245 patches, including 122 critical updates.

Key Takeaways

1. The June 2026 Critical Security Patch Update (CSPU) contains fixes for 243 unique CVEs in 245 security updates
2. 122 issues (49.8% of all patches) were assigned a critical severity rating
3. Oracle Fusion Middleware received the highest number of patches at 106, accounting for 43.3% of all patches

Background

On June 16, Oracle released its Critical Security Patch Update (CSPU) for June 2026. Beginning in May 2026, Oracle introduced CSPUs as a monthly release cycle that sits between the larger quarterly Critical Patch Updates (CPUs), addressing a focused set of high-severity issues on a faster cadence. This CSPU contains fixes for 243 unique CVEs in 245 security updates across 11 Oracle product families. Out of the 245 security updates published, 49.8% of patches were assigned a critical severity. Critical severity patches accounted for the bulk of security patches at 49.8%, followed by high severity patches at 42.4%.

This month's update includes 122 critical patches across 122 CVEs.

SeverityIssues PatchedCVEsCritical122122High104102Medium1515Low44Total245243Analysis

This month's update saw the Oracle Fusion Middleware product family contain the highest number of patches at 106, accounting for 43.3% of the total patches, followed by Oracle E-Business Suite at 55 patches, which accounted for 22.4% of the total patches.

A full breakdown of the patches for this CSPU can be seen in the following table, which also includes a count of vulnerabilities that can be exploited over a network without authentication.

Oracle Product FamilyNumber of PatchesRemote Exploit without AuthOracle Fusion Middleware10653Oracle E-Business Suite556Oracle JD Edwards2012Oracle Enterprise Manager166Oracle Siebel CRM127Oracle PeopleSoft117Oracle Virtualization100Oracle MySQL84Oracle Communications33Oracle Systems31Oracle Supply Chain11Oracle PeopleSoft zero-day exploited

On June 10, Oracle published an out-of-band Security Alert Advisory for CVE-2026-35273, a remote code execution vulnerability in Oracle PeopleSoft Enterprise PeopleTools. On June 11, researchers at Google Threat Intelligence Group (GTIG) and Mandiant published a blog post confirming that CVE-2026-35273 was exploited in the wild as a zero-day by the extortion group ShinyHunters (UNC6240). The campaign, which affected over 100 global organizations, primarily impacted organizations within the United States, 68% of which were in the higher education sector. Organizations are advised to apply the available patches as soon as possible.

Solution

Customers are advised to apply all relevant patches in this CSPU. Please refer to the June 2026 advisory for full details.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they're released. This link uses a search filter to ensure that all matching plugin coverage will appear as it is released.

Get more information

• Oracle Critical Security Patch Update Advisory - June 2026
• Oracle June 2026 Critical Security Patch Update Risk Matrices
• Oracle Advisory to CVE Map

Join Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

Even conventional digital distribution ecosystems can morph into potent vectors for infection when user-generated content is capable of executing arbitrary code. Malicious actors have recently exploited the Steam Workshop to proliferate malware disguised as...

The post Steam Workshop Flaw Exploited to Distribute Malware via Wallpaper Engine appeared first on Information Security News.

Microsoft confirmed the RoguePlanet Defender zero-day (CVE-2026-50656), a privilege escalation flaw, and is developing a security patch. Microsoft has acknowledged the RoguePlanet zero-day affecting Microsoft Defender, tracked as CVE-2026-50656 (CVSS score of 7.8). The vulnerability allows privilege escalation through the Microsoft Malware Protection Engine. The company stated it is aware of the issue and is […]

A single link to a trusted Microsoft domain could quietly turn Copilot into a data exfiltration tool. Varonis Threat Labs disclosed this flaw, naming it SearchLeak. The chain let an attacker steal emails, MFA...

The post SearchLeak: Microsoft 365 Copilot Flaw Let One Click Leak Enterprise Data appeared first on Information Security News.

分享一篇文章。

2026年6月18日，深瞳漏洞实验室监测到一则Linux Kernel组件存在权限提升漏洞的信息，漏洞编号：CVE-2026-46331，漏洞威胁等级：高危。

A vulnerability described as problematic has been identified in Cotonti 1.0.0. This vulnerability affects the function htmlspecialchars of the file modules/pfs/inc/pfs.main. Such manipulation leads to cross site scripting. This vulnerability is listed as CVE-2026-55746. The attack may be performed from remote. There is no available exploit. It is advisable to implement a patch to correct this issue.

A vulnerability has been found in stiofansisland UsersWP Plugin up to 1.2.63 on WordPress and classified as problematic. Impacted is an unknown function of the component User Registration Handler. The manipulation of the argument user_id leads to authorization bypass. This vulnerability is traded as CVE-2026-12102. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in phppoet SysBasics Customize My Account for WooCommerce Plugin up to 4.3.6 on WordPress. It has been declared as problematic. This affects the function wcmamtx_get_avatar_default of the component Shortcode Handler. Such manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-12136. The attack can be launched remotely. No exploit exists.

A vulnerability was found in phppoet SysBasics Customize My Account for WooCommerce Plugin up to 4.3.6 on WordPress. It has been rated as problematic. This impacts the function plugin_options_page of the component Admin Dashboard Page. Performing a manipulation of the argument tab results in cross site scripting. This vulnerability was named CVE-2026-12137. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in codepeople Appointment Booking Calendar Plugin up to 1.4.01 on WordPress and classified as problematic. The affected element is the function cpabc_appointments_calendar_load2 of the component Query Parameter Handler. The manipulation of the argument ID results in information disclosure. This vulnerability is known as CVE-2026-12111. It is possible to launch the attack remotely. No exploit is available.

A vulnerability categorized as critical has been discovered in mariovalney CF7 to Webhook Plugin up to 5.0.0 on WordPress. Affected is an unknown function of the component Placeholder Handler. Executing a manipulation can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-11395. The attack may be launched remotely. There is no exploit available.

A vulnerability identified as problematic has been detected in blubrry PowerPress Podcasting plugin by Blubrry up to 11.16.8 on WordPress. Affected by this vulnerability is the function update_post_meta. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-12098. Remote exploitation of the attack is possible. No exploit is available.

Development acceleration tools increasingly gain access to our most precious professional secrets. Malicious plugin creators for the JetBrains Marketplace deliberately exploited this profound zone of trust. Recently, a comprehensive report detailed how multiple JetBrains...

The post JetBrains Malicious Plugins Steal Developer API Keys appeared first on Information Security News.

Cloud machine learning platforms often conceal complex infrastructures behind a few lines of code. Unfortunately, this convenient automation created a dangerous vulnerability within the Google Vertex AI SDK for Python. Specialists from Palo Alto...

The post Google Vertex AI Vulnerability Exposed in Python SDK appeared first on Information Security News.

Richard Horne, the NCSC CEO, said three-quarters of cyber-attacks targeting UK critical infrastructure came from nation-state actors