TBS Monthly Security Bulletin – June 2026
Root exploits for every mainstream Linux distribution, a firewall zero-day that ran for nearly a month, six poisoned software supply chains, and phishing kits that never ask for a password. This is what shaped the threat landscape in May 2026 — and what to patch first.
The June 2026 edition of the Telelink Business Services Monthly Security Bulletin, curated by our Advanced Security Operations Center (ASOC), analyses 63 security stories from the past month. The headline risks: two actively exploited Linux privilege-escalation chains (Copy Fail, CVE-2026-31431, and Dirty Frag, CVE-2026-43284 / CVE-2026-43500), an exploited Palo Alto Networks PAN-OS zero-day (CVE-2026-0300), a critical 18-year-old NGINX flaw (CVE-2026-42945), a wave of supply-chain compromises from PyPI to npm to Composer, and a roughly 37-fold surge in device-code phishing against Microsoft 365. The full report is free to download below.
What mattered most in May 2026
Six developments define this edition. Each one is covered in depth — with technical analysis, indicators of compromise and mitigation guidance — in the full bulletin.
Copy Fail and Dirty Frag put root up for grabs
A logic bug in the kernel’s crypto interface — Copy Fail (CVE-2026-31431) — lets any local user corrupt the page cache of files they can merely read, escalating to root with a 732-byte script that works unmodified on virtually every distribution shipped since 2017. CISA added it to the KEV catalog within a day. Its successor, Dirty Frag, chains two further page-cache write flaws and works even where Copy Fail mitigations are applied. Nothing touches the disk, so file-integrity monitoring sees nothing.
A month inside the firewall
Suspected state-sponsored actors exploited a PAN-OS Authentication Portal zero-day (CVE-2026-0300) for close to a month before patches shipped — gaining root on internet-facing firewalls, deploying tunneling tools and wiping logs. In the same window, Ivanti EPMM (CVE-2026-6973) was hit in zero-day attacks, and Cisco and Fortinet pushed maximum- and critical-severity fixes. Edge devices remain attackers’ favourite door.
Six poisoned wells in a single month
Attackers backdoored PyTorch Lightning on PyPI, trojanized DAEMON Tools installers on the official site, swapped JDownloader downloads for a Python RAT, planted credential stealers in node-ipc on npm, rewrote hundreds of Git tags on Laravel Lang Composer packages, and published a rogue Checkmarx Jenkins plugin. The common goal: harvest cloud keys and CI/CD secrets at the source developers trust.
AI is now attacker tooling — and attack surface
Google’s threat intelligence team documented the first zero-day exploit it assesses was developed with an AI model, while a scan of one million exposed AI services found chatbots, Ollama APIs and agent platforms running with no authentication at all. Attackers even bought Google ads pointing to genuine claude.ai shared chats that talked Mac users through installing infostealers on themselves.
Phishing kits that never ask for a password
Device-code phishing has grown roughly 37-fold this year, according to research cited in the bulletin. Kits such as Tycoon2FA and the FBI-flagged Kali365 platform trick users into approving legitimate Microsoft OAuth device logins — handing attackers valid tokens that bypass MFA entirely. Microsoft’s Storm-2949 case study shows where that access leads: Azure key vaults, SQL databases and mass OneDrive exfiltration.
One vendor token, dozens of breaches
The ShinyHunters group leaked data on more than 119,000 Vimeo users and 197,000 Zara customers — both stolen through compromised third-party Anodot integration tokens — and claims roughly 275 million records from the Canvas / Instructure education breach. The common thread is not perimeter failure but the access your vendors hold.
Patch priorities for June
Ranked by real-world risk: confirmed in-the-wild exploitation first, then critical flaws on internet-facing software with public proof-of-concept code.
| # | Vulnerability | Affects | Why it matters | Action |
|---|---|---|---|---|
| 01 | CVE-2026-31431Copy Fail | Linux kernel (all major distros since 2017) | Exploited in the wild; in CISA’s KEV catalog. Trivial, reliable local root. | Update kernels (6.18.22 / 6.19.12 / 7.0+) |
| 02 | CVE-2026-43284 · -43500Dirty Frag | Linux kernel (xfrm-ESP, RxRPC) | Public PoC; limited exploitation observed. Bypasses Copy Fail mitigations. | Patch; blocklist esp4 / esp6 / rxrpc modules until then |
| 03 | CVE-2026-0300PAN-OS Auth Portal | Palo Alto PA- / VM-Series firewalls | Zero-day exploited ~1 month by suspected state actors; unauthenticated root RCE. | Patch; restrict or disable the Authentication Portal |
| 04 | CVE-2026-6973Ivanti EPMM | Endpoint Manager Mobile ≤ 12.8.0.0 | Zero-day exploited (requires admin credentials). | Update to 12.6.1.1 / 12.7.0.1 / 12.8.0.1; rotate admin credentials |
| 05 | CVE-2026-42945“NGINX Rift” | NGINX OSS 0.6.27–1.30.0, NGINX Plus | 18-year-old heap overflow, CVSS 9.2; trivial DoS, potential RCE, PoC published. | Update to 1.30.1 / 1.31.0 (Plus R32 P6 / R36 P4) or use named regex captures |
| 06 | CVE-2026-23918Apache HTTP/2 | Apache HTTP Server 2.4.66 | Double-free in mod_http2; easy DoS, demonstrated RCE path. | Update to 2.4.67 |
| 07 | CVE-2026-4670MOVEit Automation | Progress MOVEit Automation | Critical unauthenticated auth bypass; 1,400+ instances exposed online. MFT is a favourite ransomware target. | Upgrade to 2025.1.5 / 2025.0.9 / 2024.1.8 |
| 08 | CVE-2026-20223Cisco Secure Workload | On-prem Secure Workload | Maximum severity: unauthenticated Site Admin via internal REST APIs. No workaround. | Update to 3.10.8.3 / 4.0.3.17 |
| 09 | CVE-2026-8732WP Maps Pro | WordPress plugin ≤ 6.1.0 | Exploited now to create rogue admin accounts — thousands of attempts blocked daily. | Update to 6.1.1 |
The June deadline hiding in every Windows fleet
The Secure Boot certificates that Windows devices have shipped with since 2011 begin expiring on June 24, 2026 (KEK CA), followed by the UEFI CA on June 27 and the Production PCA in October. Machines that fail to transition to the new 2023-dated certificates will keep booting — but will silently stop receiving future boot-level protections against bootkits such as BlackLotus.
Most updated PCs migrate automatically through Windows Update. The risk sits in older hardware needing OEM firmware updates, systems that bypassed Windows 11 requirements, and unusual firmware configurations. The bulletin walks through the verification steps for both home users and fleet administrators, including the Windows event IDs (1801 / 1808) that confirm whether each device has completed the rollover.
52 more stories worth your time
- →Operation Saffron dismantles First VPN, an anonymization service used by 25 ransomware groups
- →The Gentlemen ransomware dissected: a self-propagating Go encryptor with five lateral-movement methods
- →DragonForce hides command-and-control traffic inside Microsoft Teams TURN relays
- →MuddyWater uses Chaos ransomware as a decoy for Iranian state espionage
- →Ghostwriter targets Ukrainian government bodies with geofenced PDF phishing and Cobalt Strike
- →BitLocker bypass and SYSTEM-level Windows zero-days published by the “Chaotic Eclipse” researcher
- →TCLBanker banking trojan self-spreads through victims’ WhatsApp and Outlook accounts
- →Pwn2Own Berlin 2026: Windows 11, Edge and AI tooling fall for $523,000 on day one
- →Browser-based data loss: why nearly half of sensitive file uploads go to unsanctioned accounts
- →39 seconds — the fastest observed time from initial access to data exfiltration
What security teams should do now
Patch the exploited list first. Copy Fail, Dirty Frag, PAN-OS CVE-2026-0300 and Ivanti EPMM CVE-2026-6973 are being used in real attacks today. Everything else in the table above follows.
Treat your software supply chain as an attack surface. Pin dependency versions, verify installer signatures, and rotate every secret after any suspect package or installer touches a build system.
Close the device-code phishing door. Disable or restrict the OAuth device-code flow with Conditional Access, require admin consent for third-party apps, and continuously monitor OAuth grants — not just at the moment they are approved.
Harden the network edge. Restrict management portals to trusted zones, forward device logs off-box, and assume firewalls, VPNs and MDM servers are targets that deserve endpoint-grade monitoring.
Verify the Secure Boot rollover across your Windows estate before June 24 — and match detection speed to attacker speed. When exfiltration can start in 39 seconds, manual-only response is a losing strategy.
Read the complete bulletin
All 63 stories in full — with technical deep-dives, indicators of compromise, patch tables and source links for every article.
Monthly Security Bulletin — June 2026
Frequently asked questions
What does the June 2026 Monthly Security Bulletin cover?
It reviews 63 security stories from the past month, curated by Telelink Business Services’ Advanced Security Operations Center: actively exploited vulnerabilities (Copy Fail, Dirty Frag, the PAN-OS zero-day CVE-2026-0300), six software supply-chain compromises, AI-related threats, identity attacks such as device-code phishing, and major data breaches at Vimeo, Zara and Canvas / Instructure.
Which vulnerabilities should be patched first?
Prioritize flaws already exploited in the wild: Linux kernel Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284, CVE-2026-43500), Palo Alto PAN-OS CVE-2026-0300 and Ivanti EPMM CVE-2026-6973. Then address critical internet-facing issues: NGINX CVE-2026-42945, Apache HTTP Server CVE-2026-23918, MOVEit Automation CVE-2026-4670 and Cisco Secure Workload CVE-2026-20223.
What are Copy Fail and Dirty Frag?
Both are Linux local privilege-escalation techniques that corrupt the kernel’s in-memory page cache to gain root without modifying any file on disk. Copy Fail abuses the AF_ALG crypto interface; Dirty Frag chains flaws in the IPsec (xfrm-ESP) and RxRPC subsystems and works even on systems that applied Copy Fail mitigations. The response is patched kernels — and blocklisting the esp4, esp6 and rxrpc modules until updates land.
What is device-code phishing and how can it be stopped?
Attackers generate a legitimate Microsoft OAuth device code and socially engineer the victim into approving it on microsoft.com/devicelogin. The attacker then receives valid access tokens without ever stealing a password — bypassing MFA. Defenses include disabling or restricting the device-code flow through Conditional Access, requiring admin consent for third-party apps, and monitoring Entra sign-in logs for device-code authentications.
Where can I download the full bulletin?
The complete PDF is free to download on this page — no registration required. For tailored bulletins covering your organization’s critical assets, contact the ASOC team at [email protected].
24×7 monitoring, human triage and tailored threat bulletins — for a fixed monthly fee
The Advanced Security Operations Center by Telelink delivers visibility, attack detection and expert recommendations as a service, sized for small, medium and large organizations alike.
