The StratQuad Daily Brief

CVE-2026-33112 in Microsoft SharePoint allows authenticated remote code execution and appears in NHS Digital alerting today.

Microsoft has patched a Defender zero-day known as RoguePlanet disclosed after June Patch Tuesday, though the signal does not name a CVE or specify the vulnerability class.

CISA added four vulnerabilities to the KEV catalogue today, led by CVE-2026-48282, a path traversal flaw in Adobe ColdFusion that permits arbitrary code execution.

Google and the FBI have disrupted NetNut, a residential proxy network built on millions of compromised devices and used by criminals to route malicious traffic through legitimate consumer connections.

CVE-2026-45659 in Microsoft SharePoint Server is under active exploitation, allowing authenticated attackers to achieve remote code execution via network access.

CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities catalogue, a deserialization flaw in Microsoft SharePoint Server that allows authorised attackers to execute code remotely and is now confirmed under active exploitation.

CVE-2026-48558 in SimpleHelp RMM allows unauthenticated remote attackers to bypass authentication and gain full technician-level access to managed endpoints; NHS Digital issued CC-4804 yesterday and CISA added the vulnerability to the Known Exploited Vulnerabilities catalog overnight.

CVE-2026-48558, an authentication bypass in SimpleHelp's OIDC flow that accepts identity tokens without verifying cryptographic signatures, has been added to CISA's Known Exploited Vulnerabilities catalogue following evidence of active exploitation.

Microsoft reports a phishing campaign running since April 2026 against hospitality organisations using fake guest complaint emails to deliver TonRAT with resilient persistence mechanisms.

CISA and the FBI updated their public service announcement warning that Russian Intelligence Services continue to target commercial messaging applications in phishing campaigns, the second such alert since March.

Mandiant reports active zero-day exploitation of CVE-2026-20245 in Cisco Catalyst SD-WAN Manager at a service provider in early 2026, marking the lead item today.

Microsoft published an incident report documenting two separate threat actors operating simultaneously inside a single compromised environment, each deploying distinct tooling and evasion techniques that complicated attribution and detection.

EclecticIQ reports an SEO poisoning campaign impersonating Gemini and Claude Code to distribute infostealers via search results.

ESET published a detailed technical breakdown of The Gentlemen ransomware operation's GentleKiller suite, a centralised EDR-killer toolset that weaponises BYOVD exploits to disable endpoint security before encryption, corroborated by the group's own leaked internal data from May.

Google Threat Intelligence reports a North Korea-nexus actor has compromised the widely used Axios NPM package in a supply chain attack, targeting a library with millions of weekly downloads.

CISA and the NCSC have both issued urgent advisories following global targeting of Fortinet firewalls and VPN gateways in a campaign designated FortiBleed, which involves the exposure of compromised credentials for approximately 74,000 internet-accessible Fortinet devices across government and private sector organisations.

CVE-2026-20253 in Splunk Enterprise allows remote unauthenticated attackers to create arbitrary files and potentially execute code, flagged by NHS Digital as medium severity but carrying full compromise risk.

CVE-2026-48907 in Widget Factory Joomla Content Editor added to CISA's KEV catalogue today following active exploitation.

Google Threat Intelligence Group has disclosed UNC6508, a China-nexus actor that spent over a year inside North American academic, medical, and military research networks, compromising externally facing web applications and deploying custom malware to reach sensitive internal systems focused on artificial intelligence, cyber, medical, and national defence research.

Oleksii Lytvynenko, a Ukrainian national extradited from Ireland, pleaded guilty in the United States to conspiracy to commit wire fraud for his role in Conti ransomware attacks that targeted victims worldwide.

CVE-2026-35273 in Oracle PeopleSoft Enterprise PeopleTools entered the CISA KEV catalogue yesterday following active exploitation by the ShinyHunters actor targeting the education sector.

CISA added CVE-2026-10520, an OS command injection flaw in Ivanti Sentry, to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation.