📰 DAILY THREAT BRIEFING
Friday, June 12, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of June 12, 2026.

  1. Phishing Attack Volume Down 20%, but Risk Still Rising
    — Dark Reading

    Hackers are valuing quality over quantity, using AI to upgrade their phishing attacks rather than multiply them.
  2. Japanese energy firm loses drive with data of 10.9 million clients
    — Bleeping Computer

    Kyushu Electric Power Co., Inc. has disclosed a physical security incident that affects private data of more than 10 million customers. [..…
  3. Maine breach portal abused to publish fake data breach disclosures
    — Bleeping Computer

    In an unusual misinformation campaign, fraudulent data breach disclosures were submitted to Maine's official breach portal and publicly post…
  4. ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities
    — The Hacker News

    The ShinyHunters extortion crew exploited an unpatched flaw in Oracle PeopleSoft to break into enterprise systems, steal data, and demand pa…
  5. Oracle mitigates PeopleSoft zero-day exploited in data theft attacks
    — Bleeping Computer

    Oracle is warning about a critical PeopleSoft Suite zero-day vulnerability tracked as CVE-2026-35273 that allows unauthenticated remote cod…
  6. Max-Severity Ivanti Flaw Exploited 24 Hours After Disclosure
    — Dark Reading

    Initial methods suggest attackers had likely mapped out Ivanti's asset landscape upfront and acted quickly once the exploit became public.
  7. New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets
    — The Hacker News

    Two security teams have shown, in separate research published this week, that OpenClaw, the popular self-hosted AI agent, can be driven to r…
  8. New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files
    — The Hacker News

    Security researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a new Windows BitLocker bypass dubbed GreatXML, a d…
  9. Segmentation Works for OT If Operators Are Paying Attention
    — Dark Reading

    Operational technology security remains as difficult as ever, with even the best practice recommendation falling short.
  10. Trust No Skill: Integrity Verification for AI Agent Supply Chains
    — Unit 42

    Protect enterprise AI agents from supply chain risks by auditing third-party skills for hidden vulnerabilities and multi-stage attack chains…
  11. ISC Stormcast For Thursday, June 11th, 2026 https://isc.sans.edu/podcastdetail/9968, (Thu, Jun 11th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
  12. Who Runs the Ransomware Group ‘The Gentlemen?’
    — Krebs on Security

    A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attracting a talent…

🪲 NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (7100 in last 30 days).
Critical: 5 · High: 9 · Medium: 3 · Low: 0. View full dashboard →

  1. CVE-2026-47238
    — CVSS 6.5 (MEDIUM)

    ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 – #133, a normal authenticated user can edit another user's video subtitles because of a lack of authorization. They can upload subtitles, ed…
  2. CVE-2026-45418
    — CVSS 8.8 (HIGH)

    ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 – #132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title (English, Spanish…
  3. CVE-2026-45060
    — CVSS 9.8 (CRITICAL)

    ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 – #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter …
  4. CVE-2026-42846
    — CVSS 9.8 (CRITICAL)

    ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 – #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell …
  5. CVE-2026-49060
    — CVSS 9.8 (CRITICAL)

    Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation.

    This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.

  6. CVE-2026-44890
    — CVSS 7.5 (HIGH)

    Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads…
  7. CVE-2026-44250
    — CVSS 7.5 (HIGH)

    Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payloa…
  8. CVE-2026-44249
    — CVSS 8.1 (HIGH)

    Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect ma…
  9. CVE-2026-42653
    — CVSS 7.1 (HIGH)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS.

    This issue affects SliceWP: from n/a through 1.2.6.

  10. CVE-2026-42647
    — CVSS 9.3 (CRITICAL)

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection.

    This issue affects JoomSport: from n/a through 5.7.7.

  11. CVE-2026-39494
    — CVSS 9.3 (CRITICAL)

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection.

    This issue affects Product Filter by WBW: from n/a thro…

  12. CVE-2026-53819
    — CVSS 8.8 (HIGH)

    OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator wor…
  13. CVE-2026-53818
    — CVSS 6.6 (MEDIUM)

    OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies and before-tool-call hooks. Attackers can invoke owner-o…
  14. CVE-2026-53817
    — CVSS 8.8 (HIGH)

    OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable device tokens. Attacke…
  15. CVE-2026-53816
    — CVSS 7.2 (HIGH)

    OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compr…
  16. CVE-2026-53815
    — CVSS 6.5 (MEDIUM)

    OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploi…
  17. CVE-2026-53814
    — CVSS 8.3 (HIGH)

    OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent runs incorrectly receive owner-scoped MCP loopback authority instead of hook-appropriate scope. Attackers with a valid ho…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · June 12, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com