Previous Cyber Pulse

Week of June 08–june 14, 2026

Cyber Pulse: Top 10 Cybersecurity Stories This Week

1. Trump Signs AI Cybersecurity Executive Order, Establishing Voluntary Pre-Release Framework for Frontier Models

President Trump signed an executive order titled “Promoting Advanced Artificial Intelligence Innovation and Security” on June 2, 2026, directing federal agencies to strengthen cybersecurity across government systems and critical infrastructure. The order establishes a voluntary pre-release engagement framework requiring AI developers to submit frontier models for up to 30 days of government cybersecurity testing before broader release — without creating a mandatory licensing regime. A Treasury-led “AI Cybersecurity Clearinghouse” is also mandated to coordinate vulnerability scanning, validation, and patch distribution across industry and critical infrastructure operators.

Source: White House — Executive Order Promoting Advanced AI Innovation and Security | White House Fact Sheet — https://www.whitehouse.gov/fact-sheets/2026/06/fact-sheet-president-donald-j-trump-promotes-advanced-artificial-intelligence-inn

---

2. Anthropic Expands Project Glasswing to 150+ Critical Infrastructure Organizations Across 15+ Countries

Anthropic significantly expanded access to its powerful Claude Mythos Preview AI vulnerability-hunting model on June 2, extending Project Glasswing to approximately 150 new organizations across more than 15 countries — including power, water, healthcare, and telecommunications sectors not well-represented in the initial cohort. Partner countries include Australia, Canada, France, Germany, Japan, India, and others friendly to the United States. Since the program launched, Mythos has reportedly found 23,019 vulnerabilities across 1,000+ open-source projects, with a 90.6% confirmation rate on independent sampling.

Source: Cybersecurity Dive — https://www.cybersecuritydive.com/news/ai-anthropic-claude-mythos-project-glasswing-expand/821714/ | TechCrunch — https://techcrunch.com/2026/06/02/anthropic-scales-claude-mythos-to-critical-infrastructure-in-15-countries/

---

3. Carnival Corporation Confirms Data Breach Affecting ~6 Million Customers

Carnival Corporation, the world’s largest cruise operator, confirmed a data breach affecting nearly 5,995,277 people after the ShinyHunters extortion group claimed responsibility for stealing customer data via social engineering of a single employee account on April 14, 2026. The exposed data includes names, email addresses, dates of birth, genders, loyalty program details, and government-issued identification numbers including passport and driver’s license numbers in some cases. Affected individuals in the United States are being offered 24 months of free credit monitoring through TransUnion, while ShinyHunters also leaked approximately 7.5 million Mariner Society loyalty program records.

Source: SecurityWeek — https://www.securityweek.com/carnival-data-breach-exposed-6-million-people/ | Malwarebytes — https://www.malwarebytes.com/blog/data-breaches/2026/05/carnival-confirms-data-breach-impacting-nearly-6-million

---

4. Google & FBI Warn of Silent Ransom Group Escalating to Physical In-Person Office Intrusions

Google’s Mandiant and Google Threat Intelligence Group published a joint report on June 5 accusing Silent Ransom Group (SRG) — also known as Luna Moth, Chatty Spider, and UNC3753 — of escalating its attacks on US law firms by sending imposters posing as IT support staff directly to victims’ offices to steal data using USB drives or enable remote access. The FBI separately confirmed “multiple instances of individuals impersonating IT support who gained or attempted to gain physical, in-person access to victim companies’ offices and/or devices.” The group, active since 2022, focuses on data theft and extortion without deploying ransomware encryption, and has targeted dozens of victims from January through May 2026.

Source: TechCrunch — https://techcrunch.com/2026/06/05/google-and-fbi-warn-of-ransomware-group-that-sends-fake-it-workers-to-hack-victims-in-person/ | FBI Advisory — https://www.ic3.gov/CSA/2026/260526.pdf

---

5. EU Cyber Resilience Act: Conformity Assessment Body Notification Rules Take Effect June 11, 2026

The EU Cyber Resilience Act’s (CRA) Chapter IV provisions — governing the notification of conformity assessment bodies — became applicable on June 11, 2026, marking the first major enforcement milestone of the regulation that entered into force in December 2024. This is immediately followed by manufacturers’ vulnerability reporting obligations taking effect September 11, 2026, with full compliance for all other CRA requirements due December 11, 2027. Organizations globally that sell digital products in the EU must ensure their supply chains, SBOM practices, and vulnerability handling processes align with these deadlines to avoid fines of up to €15 million or 2.5% of global annual turnover.

Source: European Commission — https://digital-strategy.ec.europa.eu/en/policies/cra-summary | Open Regulatory Compliance Working Group — https://orcwg.org/cra/

---

6. CISA Adds Oracle WebLogic CVE-2024-21182 to KEV Catalog with Emergency June 4 Deadline

CISA added CVE-2024-21182 — an unauthenticated remote access vulnerability in Oracle WebLogic Server (versions 12.2.1.4.0 and 14.1.1.0.0) via T3/IIOP protocols — to its Known Exploited Vulnerabilities (KEV) catalog on June 1, 2026, with a tight federal agency remediation deadline of June 4. The two-year-old vulnerability (patched in Oracle’s July 2024 Critical Patch Update) being added to KEV now signals a significant population of unpatched WebLogic instances still in production enterprise and government environments. WebLogic’s widespread deployment in financial services, government, and large enterprise environments makes it a high-value target for both ransomware operators and nation-state espionage actors.

Source: Threat Modeling — https://threat-modeling.com/vulnerability-intelligence-report-june-2-2026/ | CISA KEV Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

---

7. CISA Adds SolarWinds Serv-U DoS Flaw CVE-2026-28318 to KEV Catalog

CISA added CVE-2026-28318 (CVSS 7.5), a high-severity denial-of-service vulnerability in SolarWinds Serv-U multi-protocol file server software, to its Known Exploited Vulnerabilities catalog on June 5, citing evidence of active exploitation via specially crafted unauthenticated POST requests using Content-Encoding: deflate. The issue has been addressed in SolarWinds Serv-U version 15.5.4 HF1, and FCEB agencies have until June 19, 2026 to remediate. This marks another critical Serv-U flaw to be actively exploited in the wild, following a history of Cl0p ransomware gang activity against Serv-U vulnerabilities.

Source: The Hacker News — https://thehackernews.com/2026/06/cisa-adds-actively-exploited-solarwinds.html

---

8. ShinyHunters Leaks Charter Communications Data Affecting 4.9 Million Customers

Charter Communications (parent company of Spectrum) had its customer data published by ShinyHunters after the group’s May 27 ransom deadline passed without engagement from the company. The breach — which began with a vishing attack that compromised a Microsoft Entra account, enabling access to Charter’s Salesforce environment — exposed 4.9 million unique email addresses along with names, phone numbers, physical addresses, and an internal employee directory subset of approximately 85,000 records with job titles. Charter denied that CPNI or sensitive personal information was exfiltrated, but the data has since been confirmed in HaveIBeenPwned.

Source: eSecurity Planet — https://www.esecurityplanet.com/threats/shinyhunters-alleges-42m-records-stolen-from-charter-communications/ | HaveIBeenPwned — https://haveibeenpwned.com/Breach/Charter

---

9. Microsoft Confirms Exploitation of Exchange Server CVE-2026-42897 — No Patch Available Yet

Microsoft reported active exploitation of CVE-2026-42897, a critical CVSS 8.1 spoofing vulnerability affecting Microsoft Exchange Server’s Outlook Web Access component (a cross-site scripting issue). As of Patch Tuesday week, no patch is available; Microsoft’s interim mitigation relies on the Exchange Emergency Mitigation Service, which provides automatic protection and is enabled by default on most Exchange deployments. Organizations are urged to verify the service is running, and a formal patch is expected in the June 2026 Patch Tuesday cycle on June 9.

Source: Help Net Security — https://www.helpnetsecurity.com/2026/06/05/june-2026-patch-tuesday-forecast/

---

10. Italian Authorities Extradite Chinese Hacking Suspect to US in Connection with COVID Research Theft

Italy extradited a Chinese national to the United States this week sought by American authorities for hacking allegations that include the theft of medical research data related to COVID-19, according to Italian law enforcement. The case highlights the continued US-China cyber espionage confrontation and the ongoing role of allied law enforcement cooperation in pursuing nation-state-adjacent cybercriminals. The suspect’s identity and the specific targets of the stolen COVID research were not immediately publicly disclosed.

Source: Reuters — https://www.reuters.com/technology/cybersecurity/

Threat Radar: Top 10 Active Threats, APTs & Dark Web Alerts (This Week)

1. ShinyHunters — Mass Credential-Phishing & Vishing Extortion Campaigns (Global/UAE Exposure)

ShinyHunters continued its aggressive vishing and social engineering campaigns this week, confirmed responsible for the Carnival Corporation (6M records) and Charter Communications (4.9M records) breaches, as well as the Instructure Canvas breach exposing data on 30+ million students. The group’s modus operandi — voice phishing (vishing) to compromise Microsoft Entra accounts, then pivot into Salesforce and cloud environments — poses direct risk to UAE enterprises with Microsoft 365 and Salesforce deployments. ShinyHunters operates a “pay-or-leak” dark web portal and has demonstrated a willingness to re-attack non-paying victims (as seen in the Instructure double-breach).

Source: eSecurity Planet — https://www.esecurityplanet.com/threats/shinyhunters-alleges-42m-records-stolen-from-charter-communications/

---

2. Qilin — Most Active Ransomware Group in May/June 2026 (97 Claimed Attacks)

Qilin remained the most active ransomware group globally in May 2026, claiming 97 attacks (a slight 10% decline from April’s 108) with nine independently confirmed incidents. Operating under a Ransomware-as-a-Service (RaaS) model with LockBit and DragonForce cartel ties, Qilin employs BYOVD (Bring Your Own Vulnerable Driver) attacks to disable EDR tools and uses double-extortion tactics. The group targets education, government, healthcare, and critical infrastructure globally — sectors heavily represented in the UAE’s digital transformation agenda.

Source: Industrial Cyber — https://industrialcyber.co/ransomware/global-ransomware-activity-rises-modestly-in-may-as-qilin-the-gentlemen-and-dragonforce-lead-attacks/

---

3. DragonForce — 20.8 TB of Stolen Data in May, Active UAE Targeting

DragonForce claimed the largest data haul of any ransomware group in May 2026, reporting more than 20.8 TB of stolen data across 51 claimed attacks — a 3x data advantage over competitors. The group has directly targeted UAE entities, most notably its March 2026 attack on Ahmed Mubarak Debt Collection in the UAE, and remains part of the LockBit–Qilin–DragonForce cartel sharing tools, infrastructure, and negotiation playbooks. DragonForce’s combination of hacktivist flair and criminal extortion makes it particularly relevant to Gulf region organizations.

Source: Industrial Cyber — https://industrialcyber.co/ransomware/global-ransomware-activity-rises-modestly-in-may-as-qilin-the-gentlemen-and-dragonforce-lead-attacks/ | Dexpose.io — https://www.dexpose.io/dragonforce-compromises-ahmed-mubarak-debt-collection-in-uae-cyberattack/

---

4. Webworm (China-Aligned APT) — EchoCreep & GraphWorm Backdoors Targeting European Governments

ESET Research disclosed this week that China-aligned Webworm has deployed two new custom backdoors — EchoCreep (using Discord for C2) and GraphWorm (using Microsoft Graph API/OneDrive for C2 and data exfiltration) — against government organizations in Belgium, Italy, Poland, Serbia, and Spain. The use of legitimate cloud platforms (Discord, Microsoft Graph) for C2 communications is a significant evasion technique that bypasses traditional network security detection relying on domain/IP blocklists. Researchers decrypted over 400 Discord messages and found evidence of reconnaissance against 50+ targets.

Source: ESET Research — https://www.eset.com/us/about/newsroom/research/eset-research-china-aligned-webworm-european-governments-targeted/ | The Hacker News — https://thehackernews.com/2026/05/webworm-deploys-echocreep-and-graphworm.html

---

5. Silent Ransom Group (Luna Moth) — Physical Infiltration of Law Firms with USB-Based Data Exfiltration

Silent Ransom Group has escalated beyond remote social engineering to physically sending imposters dressed as IT support staff into victim law firms’ offices to insert USB drives or enable remote access directly on target computers. Active from January through May 2026 targeting “dozens” of law firms, the group also uses phishing emails and vishing calls as primary vectors, with physical intrusion as a fallback when remote attempts fail. FBI indicators include unauthorized remote access tool installations (Zoho Assist, AnyDesk, RustDesk) and unidentified individuals attempting computer access.

Source: FBI CSA — https://www.ic3.gov/CSA/2026/260526.pdf | Help Net Security — https://www.helpnetsecurity.com/2026/05/27/fbi-silent-ransom-group-law-firms-social-engineering/

---

6. Iran-Aligned Threat Actors — Continued Surge in AI-Enhanced Espionage & Destructive Operations Against UAE/Gulf

Iran-linked threat actors remain in an elevated operational tempo targeting UAE and Gulf infrastructure, with between 500,000 to 700,000 daily cyberattack attempts recorded against UAE strategic sectors — many state-sponsored. Dr. Mohammed Al Kuwaiti (UAE Cybersecurity Council) confirmed that hostile actors, including Iran, are using AI platforms such as ChatGPT and other tools for reconnaissance, vulnerability identification, phishing message improvement, and malware development. Separate reporting from Proofpoint and Check Point shows groups like Handala (Void Manticore), MuddyWater, and TA453 (Charming Kitten/APT42) sustaining high-tempo operations.

Source: CXO Insight ME — https://www.cxoinsightme.com/business/industries/government/uae-warns-of-ai-driven-cyber-attacks-during-regional-crisis/ | Industrial Cyber — https://industrialcyber.co/critical-infrastructure/iran-linked-cyber-espionage-surges-across-middle-east/

---

7. GREYVIBE (Russia-Aligned) — First Confirmed Dual-Platform AI-Assisted Campaign Using ChatGPT & Gemini

Russia-aligned threat actor GREYVIBE is actively using both ChatGPT and Google Gemini to accelerate phishing content generation, malware development, and post-compromise activity — confirmed by Check Point Research as the first double-platform AI-assisted adversarial campaign in Check Point’s 2026 corpus. The group is primarily targeting Ukrainian organizations but the technique and infrastructure are transferable, representing a template for AI-augmented adversarial operations globally. This development validates the UAE Cybersecurity Council’s warnings about AI being weaponized by hostile state-linked actors.

Source: Cybersecurity Insiders — https://www.cybersecurity-insiders.com/carnival-corporation-data-breach-account-compromise-june-2026/

---

8. ChatGPhish — Cross-Site Prompt Injection Turns ChatGPT into a Phishing Delivery Surface

Permiso Security disclosed a technique dubbed “ChatGPhish” (XPIA) on May 29, 2026, demonstrating that any web page a user asks ChatGPT to summarize can inject attacker-controlled links, fake OpenAI security alerts styled in ChatGPT’s own UI, QR code redirects, and tracking pixels (leaking IP, User Agent, and timing) directly inside the trusted chatgpt.com interface. OpenAI marked the initial disclosure “Not Reproducible” and has not assigned a CVE or confirmed a patch timeline. With hundreds of millions of ChatGPT users globally — including corporate employees using it to summarize documents — this represents a significant, unpatched social engineering amplifier.

Source: Cloud Security Alliance — https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA_research_note_chatgphish_prompt_injection_phishing_20260602.pdf | Gblock — https://www.gblock.app/articles/chatgphish-permiso-chatgpt-markdown-rendering-phishing-may-2026

---

9. Fortinet-Reported Large-Scale Exploitation of Citrix NetScaler CVE-2026-3055

Fortinet’s threat intelligence team confirmed large-scale active exploitation of CVE-2026-3055 (CVSS 9.8), an out-of-bounds memory read vulnerability in Citrix NetScaler ADC and NetScaler Gateway when configured as a SAML Identity Provider (IDP). NetScaler appliances serve as the primary remote access and application delivery gateway for thousands of organizations — exploiting this vulnerability gives attackers a privileged perimeter position from which to intercept authentication, manipulate SAML assertions, and pivot into internal networks. This follows the well-established pattern of NetScaler vulns (cf. CVE-2023-4966 CitrixBleed) being aggressively weaponized at scale within days of public disclosure.

Source: Threat Modeling — https://threat-modeling.com/vulnerability-intelligence-report-june-2-2026/

---

10. TGR-STA-1030 (Likely China) — 70+ Government Agencies & Critical Infrastructure Breached Across 37 Countries

Palo Alto Networks Unit 42 reported that an Asian government-linked threat actor it tracks as TGR-STA-1030 has breached at least 70 government agencies and critical infrastructure organizations across 37 countries in an espionage campaign focused on rare earth minerals, trade deals, and economic partnerships — with reconnaissance conducted against government networks in 155 countries. The group has targeted law enforcement agencies, finance ministries, and trade departments. While not directly attributed to China, the objectives align closely with PRC strategic priorities, and Gulf states’ energy and trade departments fall within the reconnaissance perimeter.

Source: Cybersecurity Dive — https://www.cybersecuritydive.com/news/asian-governments-espionage-campaign-breached-critical-infrastructure-in-3/811472/

Patch Priority: Top 10 Critical Vulnerabilities to Watch

1. CVE-2026-41089 | CVSS 9.8 | Microsoft Windows Netlogon (Windows Server 2012–2025) | Patched

Summary: A stack-based buffer overflow (CWE-121) in the Windows Netlogon service allows an unauthenticated remote attacker to execute arbitrary code on any domain-joined Windows Server via a crafted network packet — with a successful exploit against a domain controller granting full Active Directory control. The Belgian government’s Centre for Cybersecurity issued an urgent exploitation warning, confirming real-world attacks are underway; security researchers compare it to Zerologon (2020) in severity and impact.

Source: Threat Modeling — https://threat-modeling.com/vulnerability-intelligence-report-june-2-2026/ | LinkedIn Intelligence Briefing — https://www.linkedin.com/pulse/june-1-2026-tech-ai-cybersecurity-intelligence-briefing-sanchez-3rywc

---

2. CVE-2026-3055 | CVSS 9.8 | Citrix NetScaler ADC & Gateway (All versions prior to 13.1-62.23 / 14.1-60.58) | Patched

Summary: An out-of-bounds memory read vulnerability in NetScaler ADC and Gateway when configured as a SAML Identity Provider allows remote code execution; Fortinet confirmed large-scale active exploitation is ongoing across the internet. Citrix appliances are the network perimeter gateway for thousands of organizations including UAE government and financial institutions — compromise provides privileged access to SAML authentication flows and internal networks.

Source: Threat Modeling — https://threat-modeling.com/vulnerability-intelligence-report-june-2-2026/

---

3. CVE-2026-0257 | CVSS 7.8 | Palo Alto Networks PAN-OS (GlobalProtect) — PAN-OS 10.2, 11.1, 11.2, 12.1 | Patched

Summary: An authentication bypass in the GlobalProtect portal and gateway allows unauthenticated attackers to forge authentication override cookies and establish unauthorized VPN sessions; Rapid7 MDR confirmed active exploitation across “numerous customers” with the earliest observed attack on May 17, 2026. CISA added this to the KEV catalog on May 29 with a June 1 federal deadline — organizations still running unpatched versions are actively at risk of unauthorized network access.

Source: Palo Alto Unit 42 — https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ | Rapid7 — https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/

---

4. CVE-2026-41103 | CVSS 9.1 | Microsoft SSO Plugin for Jira & Confluence | Patched (May 2026 Patch Tuesday)

Summary: A critical elevation of privilege vulnerability in the Microsoft Single Sign-On Plugin for Jira and Confluence allows an unauthorized attacker to forge identity and sign in without Microsoft Entra ID authentication, gaining full access to or the ability to modify data in Jira/Confluence environments. Rated “Exploitation More Likely” by Microsoft, this is particularly dangerous for UAE organizations and enterprises using Atlassian platforms integrated with Azure AD/Entra ID.

Source: Tenable — https://www.tenable.com/blog/microsofts-may-2026-patch-tuesday-addresses-118-cves-cve-2026-41103

---

5. CVE-2026-41089 + CVE-2026-8644 / CVE-2026-9311 / CVE-2026-9319 | CVSS 9.0–9.1 | IBM WebSphere Application Server 8.5 & 9.0 | Patched

Summary: Three critical IBM WebSphere vulnerabilities disclosed simultaneously on June 1 include CVE-2026-8644 (identity spoofing/auth bypass), CVE-2026-9311 (RCE via security control bypass), and CVE-2026-9319 (RCE via deserialization of untrusted data in JAX-WS endpoints with WS-Security). A compromised WebSphere instance can expose backend databases, message queues, and integrated enterprise systems — particularly dangerous given WebSphere’s deep penetration in banking, insurance, government services, and ERP platforms.

Source: Threat Modeling — https://threat-modeling.com/vulnerability-intelligence-report-june-2-2026/

---

6. CVE-2024-21182 | CVSS 7.5 | Oracle WebLogic Server 12.2.1.4.0 & 14.1.1.0.0 | Patched (CISA KEV — Deadline June 4)

Summary: An unauthenticated remote access vulnerability in Oracle WebLogic’s Core component via T3/IIOP protocols allows unauthorized access to critical data or full server compromise; despite being patched in July 2024, CISA’s June 1 KEV addition confirms sustained exploitation of unpatched enterprise instances. Federal agencies faced a June 4 remediation deadline — non-federal organizations, particularly in Gulf financial and government sectors with WebLogic deployments, should treat this as emergency-patch status.

Source: Threat Modeling — https://threat-modeling.com/vulnerability-intelligence-report-june-2-2026/

---

7. CVE-2026-42897 | CVSS 8.1 | Microsoft Exchange Server (OWA) | Unpatched — Mitigation Available

Summary: A critical cross-site scripting spoofing vulnerability in Microsoft Exchange Server’s Outlook Web Access is being actively exploited with no patch yet available as of this reporting period; Microsoft’s Exchange Emergency Mitigation Service (EEMS) provides automatic protection and organizations must ensure this service is running and up to date. A formal patch is anticipated in June 9 Patch Tuesday — organizations should verify EEMS is enabled and monitor Exchange access logs for anomalous OWA activity.

Source: Help Net Security — https://www.helpnetsecurity.com/2026/06/05/june-2026-patch-tuesday-forecast/

---

8. CVE-2026-44825 | CVSS 8.1 | Apache Solr 9.4.0–9.10.1, 10.0.0 | Patched

Summary: Apache Solr’s Basic Authentication setup tool silently installs additional template user accounts (superadmin, admin, solr, readonly) with publicly known default credentials alongside user-specified accounts — allowing unauthenticated remote attackers with internet access to an exposed Solr instance to authenticate with full administrative privileges. Solr is widely deployed as the search backend for e-commerce platforms, content management systems, and enterprise data lakes including those in use across UAE’s digital economy sectors.

Source: Threat Modeling — https://threat-modeling.com/vulnerability-intelligence-report-june-2-2026/

---

9. CVE-2026-8206 | CVSS 9.8 | Kirki WordPress Plugin (v6.0.0–6.0.6) | Patched

Summary: An unauthenticated account takeover vulnerability in the Kirki WordPress page builder plugin allows any attacker to trigger a password reset for any WordPress user including administrators by supplying a valid username with an attacker-controlled email address — requiring just a single HTTP request with no prior authentication. This trivially executable attack endangers any WordPress site running affected Kirki versions, with implications for the thousands of UAE business and government websites built on WordPress.

Source: Threat Modeling — https://threat-modeling.com/vulnerability-intelligence-report-june-2-2026/

---

10. CVE-2026-28318 | CVSS 7.5 | SolarWinds Serv-U 15.5.4 and prior | Patched (CISA KEV — Deadline June 19)

Summary: A denial-of-service vulnerability in SolarWinds Serv-U multi-protocol file server (CWE-400: Uncontrolled Resource Consumption) crashes the service via unauthenticated POST requests with Content-Encoding: deflate — actively exploited in the wild and added to CISA KEV on June 5, 2026, with a federal agency deadline of June 19. Serv-U has a history of critical vulnerabilities exploited by the Cl0p ransomware gang, making this platform a high-priority patching target for any organization running it for MFT or file transfer services.

Source: The Hacker News — https://thehackernews.com/2026/06/cisa-adds-actively-exploited-solarwinds.html

CVE Watch: Top 10 CVEs — Severity, Impact & Patch Status

CVE ID	Severity	CVSS	Product	Impact	Patch Status	Source
CVE-2026-41089	Critical	9.8	Microsoft Windows Netlogon (Server 2012–2025)	Unauthenticated RCE via stack buffer overflow; full AD domain takeover. Belgian CCB exploitation warning confirmed.	Patched — Apply latest CU	Threat Modeling
CVE-2026-3055	Critical	9.8	Citrix NetScaler ADC & Gateway (SAML IDP)	RCE via out-of-bounds read; large-scale active exploitation confirmed by Fortinet. Perimeter network compromise.	Patched — v13.1-62.23 / 14.1-60.58	Threat Modeling
CVE-2026-8206	Critical	9.8	Kirki WordPress Plugin v6.0.0–6.0.6	Unauthenticated account takeover via password reset to attacker email; full site admin access.	Patched — Update beyond v6.0.6	Threat Modeling
CVE-2026-41103	Critical	9.1	Microsoft SSO Plugin for Jira & Confluence	Forged identity bypass of Entra ID authentication; unauthorized data access/modification in Atlassian suite.	Patched — May 2026 Patch Tuesday	Tenable
CVE-2026-8644	Critical	9.1	IBM WebSphere App Server 8.5 & 9.0	Identity spoofing / authentication bypass via CWE-290; enables impersonation of any authenticated user.	Patched — IBM Fix Pack	Threat Modeling
CVE-2026-9311	Critical	9.0	IBM WebSphere App Server 8.5 & 9.0	RCE via security control bypass (CWE-94 Code Injection); unauthenticated remote code execution.	Patched — IBM Fix Pack	Threat Modeling
CVE-2026-9319	Critical	9.0	IBM WebSphere App Server 8.5 & 9.0	RCE via deserialization of untrusted data in JAX-WS endpoints with WS-Security (CWE-502).	Patched — IBM Fix Pack	Threat Modeling
CVE-2026-42897	Critical	8.1	Microsoft Exchange Server (OWA / XSS)	Active exploitation of cross-site scripting in Outlook Web Access; spoofing/session hijack. No patch yet — EEMS mitigation active.	Unpatched — EEMS Mitigation Active	Help Net Security
CVE-2026-44825	High	8.1	Apache Solr 9.4.0–9.10.1 / 10.0.0	Hardcoded default admin credentials silently installed by setup tool; full unauthenticated admin access.	Patched — Upgrade or delete template users	Threat Modeling
CVE-2026-0257	High	7.8	Palo Alto PAN-OS GlobalProtect	Authentication bypass via forged cookie; unauthorized VPN sessions established. CISA KEV. Actively exploited.	Patched — See Unit 42 Advisory	Palo Alto Unit 42

Attack Tracker: Top 10 Cyber Attacks (UAE, Gulf & Global)

1. UAE | DDoS & Hacktivist Operations | 313 Team / Liwa Thar Allah / Iranian-linked Groups

Region/Country: UAE | Attack Type: DDoS, Website Defacement, Financial Services Disruption | Threat Actor: 313 Team, Liwa Thar Allah, Fad Team (Iran-linked hacktivist collectives)

Summary: CloudSEK documented coordinated cyber disruption attempts against 10 financial institutions including major UAE and Saudi banks, seven aviation entities, government ministries, and telecoms providers between late May and early June 2026, in response to regional geopolitical tensions. In the UAE, some online and phone banking services experienced disruptions attributed to region-wide IT service disruptions, with the Iranian-linked hacktivist groups publicly claiming the operations on Telegram channels.

Source: The National News — https://www.thenationalnews.com/future/technology/2026/03/02/cyberwar-and-military-escalation-converge-as-middle-east-digital-infrastructure-under-attack/

---

2. UAE | AI-Enhanced Ransomware & Phishing | Iran-Linked APT Groups

Region/Country: UAE (Strategic Sectors) | Attack Type: AI-Enhanced Phishing, Ransomware Attempts, Network Infiltration | Threat Actor: Iran-Linked State-Sponsored Actors

Summary: The UAE Cybersecurity Council publicly confirmed that the country continues to face 500,000 to 700,000 cyberattack attempts daily against strategic sectors, with state-backed actors leveraging AI platforms including ChatGPT to develop offensive tools, conduct reconnaissance, and execute deepfake-based social engineering. Dr. Mohammed Al Kuwaiti confirmed that attempts include network infiltration, ransomware deployment, and systematic phishing campaigns targeting national platforms — representing a “qualitative shift” in threat sophistication.

Source: CXO Insight ME — https://www.cxoinsightme.com/business/industries/government/uae-warns-of-ai-driven-cyber-attacks-during-regional-crisis/ | Reuters — https://www.reuters.com/world/uae-foils-cyber-attacks-state-news-agency-says-2026-02-21/

---

3. UAE | Ransomware (Prior Week Context) | DragonForce

Region/Country: UAE — Dubai Financial Services | Attack Type: Ransomware, Data Exfiltration | Threat Actor: DragonForce

Summary: DragonForce’s March 2026 attack on Ahmed Mubarak Debt Collection (AMDC) — a UAE-licensed debt collection firm — remained active in dark web leak threat status during the current week, with the group warning of data publication if demands were not met. With over 20.8TB claimed stolen globally in May 2026 alone and the LockBit–Qilin–DragonForce cartel structure in full operation, UAE financial services firms remain a primary regional target for this group’s double-extortion campaigns.

Source: Dexpose.io — https://www.dexpose.io/dragonforce-compromises-ahmed-mubarak-debt-collection-in-uae-cyberattack/

---

4. Gulf Region (Saudi Arabia, UAE, Jordan) | Espionage Campaign | OilRig (APT34)

Region/Country: Gulf Region (Saudi Arabia, UAE, Jordan, Israel) | Attack Type: Spear-Phishing, Multi-Stage Espionage | Threat Actor: APT-C-49 / OilRig / APT34 (Iran-linked)

Summary: Help AG’s threat intelligence for the Middle East documented APT34 (OilRig) conducting spear-phishing campaigns using macro-enabled Excel files themed on regional events, with multi-stage attack chains leveraging compiled C# code, GitHub data retrieval, Google Drive steganography, and Telegram Bot API for C2 with persistence via scheduled tasks. The group continues to systematically target Gulf government, energy, and defense sectors as part of Iran’s sustained regional intelligence collection campaign.

Source: Help AG — https://www.helpag.com/top-middle-east-cyber-threats-06-may-2026/

---

5. Middle East / UAE (Military Personnel) | Wiper Malware, Social Engineering | Handala (Void Manticore)

Region/Country: UAE, Israel, Jordan, Regional Military Personnel | Attack Type: Social Engineering, Wiper Malware, Data Theft | Threat Actor: Handala (Void Manticore / Storm-0842 / BANISHED KITTEN)

Summary: Handala continued targeting military personnel across the Middle East this week via WhatsApp messages from spoofed business numbers warning of missile and drone strikes, combined with the publication of personal data from 2,379 personnel on Telegram. The group has previously claimed to have wiped over 200,000 systems globally by leveraging compromised Microsoft Intune Global Administrator accounts, using multiple wiper variants including BiBi Wiper, Hamsa, CoolWipe, and ChillWipe.

Source: Help AG — https://www.helpag.com/top-middle-east-cyber-threats-06-may-2026/

---

6. Global / USA | Data Breach via Social Engineering | ShinyHunters

Region/Country: Global (USA) | Attack Type: Vishing, Social Engineering, Data Exfiltration | Threat Actor: ShinyHunters

Summary: The ShinyHunters group’s breach of Carnival Corporation (5.99 million customers affected) via a single compromised employee account used on April 14, 2026, was formally disclosed this week after the group published the data and sent notifications to affected customers starting May 27. This breach — combined with the Charter Communications (4.9M records), Instructure Canvas (30M+ students), and other ShinyHunters campaigns — establishes the group as the most prolific data extortion threat actor of 2026.

Source: SecurityWeek — https://www.securityweek.com/carnival-data-breach-exposed-6-million-people/

---

7. USA | Supply Chain Attack on Open Source Ecosystem | Unknown (Suspected Nation-State)

Region/Country: Global (impacting OpenAI, Vercel, Bitwarden, Aqua Security Trivy, Checkmarx) | Attack Type: Supply Chain Attack, Backdoor Injection, Credential Theft | Threat Actor: Unknown / Suspected Nation-State

Summary: A series of ongoing, overlapping supply chain attacks on open source developers compromised major tools including Aqua Security’s Trivy vulnerability scanner, Bitwarden password manager, and Checkmarx, allowing attackers to steal credentials, passwords, and sensitive tokens from any user of the backdoored software — then using stolen credentials to breach downstream companies including OpenAI and Vercel. With a new hack almost every week throughout 2026, the open source software ecosystem remains a critical vulnerability surface for organizations relying on third-party dependencies.

Source: TechCrunch — https://techcrunch.com/2026/06/03/the-worst-hacks-and-breaches-of-2026-so-far/

---

8. USA | FBI Wiretap System Breach | China (Suspected Salt Typhoon / PRC-linked)

Region/Country: USA (FBI, Virgin Islands) | Attack Type: Espionage, Surveillance System Compromise | Threat Actor: PRC-linked / Suspected Chinese State Actors

Summary: The FBI’s April 2026 classification of the breach of its DCS-3000 (Red Hook) Digital Collection System Network as a “major incident” under FISMA — attributed to Chinese hackers who accessed the system via a third-party commercial ISP — continued to reverberate this week during Congressional oversight activities. Phone numbers of FBI wiretap surveillance targets were confirmed exposed, with intelligence agencies still assessing whether active counterintelligence cases were compromised.

Source: NextGov — https://www.nextgov.com/cybersecurity/2026/04/suspected-chinese-breach-fbi-system-exposed-surveillance-targets-phone-numbers/ | HS Today — https://www.hstoday.us/fbi/fbi-labels-china-linked-hack-of-surveillance-system-a-major-cyber-incident/

---

9. USA (Legal Sector) | In-Person Physical Intrusion + Data Exfiltration | Silent Ransom Group

Region/Country: USA (Law Firms) | Attack Type: Social Engineering, Physical Intrusion, Data Theft & Extortion | Threat Actor: Silent Ransom Group (Luna Moth / UNC3753)

Summary: Silent Ransom Group’s campaigns targeting US law firms from January–May 2026 involved dozens of victims across insurance, finance, and healthcare in addition to legal firms, with physical infiltration — fake IT support personnel entering offices to connect USB drives or enable remote access — representing a novel and alarming escalation of ransomware-adjacent extortion tactics. Google Mandiant and the FBI jointly published threat assessment reports this week, with FBI confirming multiple confirmed instances of physical office intrusions.

Source: TechCrunch — https://techcrunch.com/2026/06/05/google-and-fbi-warn-of-ransomware-group-that-sends-fake-it-workers-to-hack-victims-in-person/

---

10. Europe (Belgium, Italy, Poland, Serbia, Spain) | Government Espionage | Webworm (China-Aligned APT)

Region/Country: Europe — Multiple EU Governments + South Africa | Attack Type: APT Espionage, Backdoor Deployment, C2 via Legitimate Platforms | Threat Actor: Webworm (China-Aligned)

Summary: ESET Research disclosed this week that Webworm — a China-aligned APT — deployed custom backdoors (EchoCreep via Discord C2 and GraphWorm via Microsoft Graph API/OneDrive) against government organizations in Belgium, Italy, Poland, Serbia, Spain, and a South African university, with over 400 Discord C2 messages decrypted and reconnaissance confirmed against 50+ targets. The use of legitimate cloud platforms to masquerade C2 traffic is a direct challenge to organizations relying solely on domain/IP-based detection — including UAE government entities using Microsoft 365 environments.

Source: ESET Research — https://www.eset.com/us/about/newsroom/research/eset-research-china-aligned-webworm-european-governments-targeted/

AI Watch: Top 10 AI Innovations Shaping Cyber & Tech

1. Trump Executive Order on AI & Cybersecurity — Voluntary Pre-Release Benchmarking Framework for Frontier AI Models

President Trump’s June 2 executive order establishes a classified 60-day benchmarking process to assess the advanced cyber capabilities of AI models, led by NSA with support from CISA, NIST, Treasury, and the White House. AI developers are asked to voluntarily provide government access for up to 30 days of review before releasing frontier models to “other trusted partners” — without creating a mandatory licensing or clearance requirement. A Treasury-led AI Cybersecurity Clearinghouse will coordinate AI-identified vulnerability scanning, validation, and patch distribution across critical infrastructure. This fundamentally changes how enterprise security teams should model AI model risk.

Source: White House — https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/ | Axios — https://www.axios.com/2026/06/02/trump-signs-new-ai-executive-order

---

2. Anthropic Expands Project Glasswing — Claude Mythos Preview Now Covering Power, Water, Healthcare & Telecom

Anthropic’s June 2 Project Glasswing expansion to 150 new organizations in 15+ countries represents the single most consequential AI-in-cybersecurity development this week, extending autonomous vulnerability hunting into power grids, water utilities, healthcare systems, and telecommunications networks globally. Claude Mythos Preview has demonstrated the ability to chain multiple vulnerabilities into sophisticated exploit paths that in sequence achieve outcomes no single bug could achieve alone — a capability that, if turned adversarially, would fundamentally compress defensive response windows. The new cohort is required to meet specific security criteria before access is granted.

Source: CNBC — https://www.cnbc.com/2026/06/02/anthropic-mythos-ai-project-glasswing.html | Cybersecurity Dive — https://www.cybersecuritydive.com/news/ai-anthropic-claude-mythos-project-glasswing-expand/821714/

---

3. AI Models Now Face Government Cyber Test Benchmarks — Security Assurance Becomes a Release Gate

This week’s White House directive moves frontier AI model distribution beyond capability announcements: security evaluation, usage controls, patch coordination, and trusted-partner access are now part of the pre-release calculus. The NSA is expected to take the lead on the classified benchmarking process, with CISA developing the operational clearinghouse framework within 30 days. For enterprise security leaders, this signals that AI model adoption plans should now include a review-buffer window and that frontier models may not be available on announced timelines pending security evaluation outcomes.

Source: YouTube Research Signal — https://www.youtube.com/watch?v=p1B_iJQsSms

---

4. Google Gemini 3.5 Flash Generally Available — Frontier Agentic Performance at 4× Speed, Default in Gemini App

Google launched Gemini 3.5 Flash at Google I/O 2026 (May 19), making it generally available globally this week as the default model across the Gemini app, AI Mode in Google Search, Google Antigravity, and the Gemini API. 3.5 Flash outperforms Gemini 3.1 Pro on challenging coding and agentic benchmarks including Terminal-Bench 2.1 (76.2%), GDPval-AA (1,656 Elo), and MCP Atlas (83.6%), while running at 4× the output speed of comparable frontier models — making it immediately relevant for security automation, threat intelligence processing, and agentic security workflows. Gemini 3.5 Pro, expected in June, promises to address 3.5 Flash’s regression on long-context and hard-reasoning benchmarks.

Source: Google Blog — https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-5/

---

5. OpenAI Daybreak Initiative — Secure-by-Design AI Coding Assistant Compresses Security Review from Hours to Minutes

OpenAI launched the Daybreak initiative (unveiled May 12, fully operational this week) based on GPT-5.5-Cyber and Codex Security to help developers build secure software from the ground up — covering threat model generation from codebases, vulnerability discovery in isolated environments, automated patch proposals, and regression test generation. The initiative’s promise of compressing “hours of manual security analysis into minutes” has direct implications for AppSec teams and DevSecOps pipelines in UAE organizations managing large codebases and compliance requirements. As of May 2026, OpenAI’s Trusted Access for Cyber (TAC) program includes hundreds of organizations and thousands of individual defenders.

Source: Infosecurity Magazine — https://www.infosecurity-magazine.com/news/openai-daybreak-secure-by-design/

---

6. ChatGPhish — Cross-Site Prompt Injection Against ChatGPT Exposes Hundreds of Millions of Users to Phishing

Permiso Security’s ChatGPhish disclosure (published May 29, widely propagated this week) demonstrates that ChatGPT’s web summarization feature can be weaponized to inject phishing links, fake OpenAI security alerts, QR code redirects, and passive tracking pixels directly inside the trusted chat interface — with no patch from OpenAI and no CVE assigned. The Cloud Security Alliance published a formal research note on June 2 documenting the four distinct attack primitives, confirming the vulnerability class affects any LLM assistant that auto-renders Markdown from third-party context. For UAE enterprises that have deployed ChatGPT for employee productivity, this is an unpatched social engineering vector requiring immediate user awareness action.

Source: Cloud Security Alliance — https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/06/CSA_research_note_chatgphish_prompt_injection_phishing_20260602.pdf

---

7. GREYVIBE Threat Actor Demonstrates Production-Grade Dual-Platform AI-Assisted Adversarial Operations

Check Point Research’s confirmation of GREYVIBE as the first threat actor to operationally combine ChatGPT and Google Gemini for phishing content generation, malware development, and post-compromise activity marks a qualitative shift in the adversarial AI threat landscape. This is no longer a theoretical or experimental capability — AI-generated phishing is confirmed as production-grade adversarial infrastructure. For UAE security teams, this reinforces the UAE Cybersecurity Council’s warnings and validates the urgency of deploying AI-powered defensive tools to match AI-empowered offensive capabilities.

Source: Cybersecurity Insiders — https://www.cybersecurity-insiders.com/carnival-corporation-data-breach-account-compromise-june-2026/

---

8. EU OpenAI Access Offer — OpenAI Proactively Offers EU Cybersecurity Model Access, Anthropic Lags

The European Commission this week confirmed OpenAI’s proactive offer to provide EU access to its cybersecurity-focused models through the OpenAI EU Cyber Action Plan — positioning OpenAI ahead of Anthropic in European regulatory engagement while Anthropic has not yet discussed model access with EC officials. This development has direct implications for UAE organizations pursuing EU market access and for multi-national security teams weighing AI vendor selection based on regulatory alignment. OpenAI’s TAC program provides tiered access based on trust level and mission needs.

Source: Reuters/Sahm Capital — https://www.sahmcapital.com/news/content/update-1-eu-says-openai-offers-to-open-access-to-cybersecurity-model-anthropic-not-there-yet/

---

9. Gemini Spark — Google Launches 24/7 Autonomous Personal AI Agent Operating Continuously Across Apps

Google introduced Gemini Spark at I/O 2026 — a 24/7 autonomous personal AI agent powered by Gemini 3.5 Flash that runs continuously on phones and laptops (even while turned off), operating across Gmail, Calendar, Drive, YouTube, Maps, and third-party apps. Currently in trusted tester rollout with a beta opening to AI Ultra subscribers in the US, Gemini Spark represents the first mass-market deployment of agentic AI with autonomous background action capability. For security professionals, this raises critical questions about data sovereignty, enterprise DLP policy enforcement, and the expanded attack surface created by always-on AI agents with broad app permissions.

Source: Google Blog — https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-3-5/

---

10. xAI Grok 5 on Track for Q3 2026 — Colossus 2 (1.5 GW) Training with ~6T Parameter MoE Architecture

xAI’s Grok 5 remains in training on the expanded Colossus 2 supercomputer (scaled from 1 GW to 1.5 GW in April 2026), with reported specifications including ~6 trillion parameters Mixture-of-Experts (MoE) architecture, 1.5 million token context, and native multimodal capabilities — positioning it as a potential rival to Claude Mythos and GPT-5.5 in advanced cyber capability benchmarks. Current probability assessments place a June 2026 release at low probability (12–33%), with Q3 2026 the most likely window. For UAE sovereign AI initiatives and enterprise AI strategy, Grok 5’s eventual release will materially reshape the frontier model landscape.

Source: WaveSpeed AI — https://wavespeed.ai/blog/posts/june-2026-ai-launch-wave/