Daily Threat Briefing
← All briefings

Palo Alto Networks PAN-OS · Oracle WebLogic Server · Apache Solr

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-01 Prepared for: SOC Analysts, Incident Responders, Vulnerability Management, Security Leadership

EXECUTIVE SUMMARY

Today’s briefing is dominated by several high-priority items requiring immediate attention. The Palo Alto Networks PAN-OS authentication bypass (CVE-2026-0257) is under active exploitation and has a CISA KEV remediation deadline of today. Oracle WebLogic Server (CVE-2024-21182) was added to the CISA KEV catalog with a three-day remediation window. Multiple critical IBM WebSphere Application Server vulnerabilities were disclosed, including remote code execution via deserialization. Apache Solr has a hardcoded credentials vulnerability (CVE-2026-44825) rated 9.8 CRITICAL by NVD, with a workaround available now. A significant supply chain campaign dubbed Miasma has compromised Red Hat npm packages with a credential-stealing worm. A China-aligned espionage campaign (Operation Dragon Weave) is actively targeting European entities including the Czech Republic. Dutch authorities dismantled a botnet linked to 17 million infected devices. The BSI published a large volume of updated advisories covering Linux Kernel, IBM products, Apache components, and developer toolchains.

CRITICAL VULNERABILITIES

CVE-2026-0257

  • Affected products: Palo Alto Networks PAN-OS, Prisma Access (GlobalProtect)
  • Severity: HIGH (CVSS 7.8)
  • Exploitation status: Actively exploited in the wild; added to CISA KEV on 2026-05-29; CISA remediation deadline was 2026-06-01
  • Remediation: Apply vendor patches immediately per Palo Alto Networks security advisory. If patching is not immediately possible, restrict GlobalProtect access and monitor for unauthorized VPN connections. Reference: security.paloaltonetworks.com/CVE-2026-0257

CVE-2024-21182

  • Affected products: Oracle WebLogic Server
  • Severity: HIGH (unspecified by vendor; network-accessible via T3/IIOP)
  • Exploitation status: Added to CISA KEV on 2026-06-01; exploitation status listed as unknown but KEV listing indicates confirmed risk; CISA remediation deadline 2026-06-04
  • Remediation: Apply Oracle CPU July 2024 patches immediately. Block T3 and IIOP access at the network perimeter if patching cannot be completed before the deadline.

CVE-2026-44825

  • Affected products: Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0
  • Severity: CRITICAL (NVD CVSS 9.8); HIGH per vendor (CVSS 8.1)
  • Exploitation status: No active exploitation confirmed; publicly disclosed; BSI advisory issued
  • Remediation: Immediately delete or change passwords for default template users (superadmin, admin, search, index) in security.json. Upgrade to Solr 9.11.0 or 10.1.0 when released. Only clusters bootstrapped using “bin/solr auth enable” are affected.

CVE-2026-8644 / CVE-2026-9311 / CVE-2026-9319 / CVE-2026-9330 (IBM WebSphere Application Server - consolidated)

  • Affected products: IBM WebSphere Application Server 8.5 and 9.0
  • Severity: CRITICAL (CVE-2026-8644: CVSS 9.1 identity spoofing; CVE-2026-9311 and CVE-2026-9319: CVSS 9.0 RCE via security control bypass and JAX-WS deserialization; CVE-2026-9330: CVSS 8.5 RCE via SAML SSO deserialization)
  • Exploitation status: No active exploitation confirmed; newly disclosed
  • Remediation: Apply IBM security patches referenced in IBM support pages 7274740, 7274733, 7274738. Prioritize CVE-2026-9311 and CVE-2026-9319 due to unauthenticated RCE potential. BSI advisory WID-SEC-2026-1683 covers these issues.

CVE-2026-47294

  • Affected products: Microsoft Office SharePoint
  • Severity: HIGH (CVSS 8.0)
  • Exploitation status: No active exploitation confirmed; newly disclosed
  • Remediation: Apply Microsoft security updates. Reference: msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47294

CVE-2026-7770

  • Affected products: IBM i Access Client Solutions (ACS) versions 1.1.5.0 through 1.1.9.12
  • Severity: HIGH (CVSS 8.8)
  • Exploitation status: No active exploitation confirmed; newly disclosed
  • Remediation: Apply IBM fix per support page 7274214. Restrict network access to IBM i Navigator listener where patching is delayed.

EUROPEAN ADVISORIES

The German Federal Office for Information Security (BSI / CERT-Bund) published a high volume of advisories on 2026-06-01. Key new and updated items of operational relevance include:

  • Apache Solr (WID-SEC-2026-1740, NEW): Remote unauthenticated attacker can gain full administrative access via hardcoded credentials. Aligns with CVE-2026-44825 above. Immediate action required.

  • Apache ActiveMQ (WID-SEC-2026-1741, NEW): Multiple vulnerabilities enabling XSS, information disclosure, privilege escalation, data manipulation, and code execution. Organizations running ActiveMQ should apply vendor patches promptly.

  • IBM WebSphere Application Server (WID-SEC-2026-1683, UPDATE): Covers the newly disclosed RCE and identity spoofing vulnerabilities described above. Rated HIGH.

  • IBM Business Automation Workflow (WID-SEC-2026-1752, NEW): Multiple vulnerabilities including security bypass, DoS, information disclosure, file manipulation, and XSS. Organizations using IBM BPM/BAW should review and patch.

  • Palo Alto Networks PAN-OS (WID-SEC-2026-1528, UPDATE): Covers CVE-2026-0257 and related issues. Rated HIGH. Immediate patching required given active exploitation.

  • JetBrains IntelliJ IDEA (WID-SEC-2026-1751, NEW): Multiple vulnerabilities enabling arbitrary code execution and information disclosure. Relevant for developer workstations and CI/CD environments.

  • OTRS (WID-SEC-2026-1748, NEW): Multiple vulnerabilities including SQL injection, DoS, information disclosure, and XSS. Relevant for organizations using OTRS as a ticketing or ITSM platform.

  • Laravel (WID-SEC-2026-1753, NEW): Data manipulation vulnerability exploitable by unauthenticated remote attackers. Organizations running Laravel-based applications should apply updates.

  • Linux Kernel (multiple advisories, UPDATES): Numerous updated advisories covering privilege escalation (Fragnesia, Dirty Frag), DoS, and memory corruption. Ensure kernel patching cadence is current.

  • Golang Go, PHP, Rsync, NGINX, Mozilla Firefox/Thunderbird, Samba, PostgreSQL, GnuTLS, FreeRDP, ImageMagick, Apache HTTP Server, Apache Tomcat: All received updated HIGH-severity advisories. Vulnerability management teams should verify patch status across these components.

ACTIVE THREATS AND CAMPAIGNS

Miasma Supply Chain Campaign - Red Hat npm Packages

  • A supply chain attack campaign designated Miasma has compromised packages within the @redhat-cloud-services npm namespace. The malicious packages execute at install time, harvest credentials and secrets from developer machines, target CI/CD pipeline configurations, perform encrypted exfiltration, and deploy a self-propagating worm. The campaign shares tactics with the previously observed Mini Shai-Hulud campaign.
  • Operational impact: Any developer or build system that installed affected @redhat-cloud-services npm packages should be treated as potentially compromised. Rotate all credentials, API keys, and secrets accessible from affected machines. Audit CI/CD pipeline configurations for unauthorized changes.
  • IOCs: Specific package names and hashes not yet confirmed in available data. Monitor npm advisory feeds for updated indicators.

OpenAI Codex Supply Chain Attack - codexui-android npm Package

  • A malicious npm package named codexui-android, masquerading as a remote web UI for OpenAI Codex, has been used to steal OpenAI Codex authentication tokens. The package had over 29,000 weekly downloads and remains available on npm at time of reporting.
  • Operational impact: Developers using OpenAI Codex tooling should audit installed npm packages. Revoke and rotate any OpenAI API tokens on affected systems.

Operation Dragon Weave - China-Aligned Espionage

  • A cyber espionage campaign designated Operation Dragon Weave, attributed to a China-aligned threat group, is actively targeting government, research, academic, technology, and financial services organizations in the Czech Republic and Taiwan. The campaign uses spear-phishing emails with ZIP attachments to deliver an AdaptixC2 agent.
  • European relevance: Czech Republic is an EU and NATO member. European organizations in the targeted sectors should be alert to spear-phishing lures referencing Czech or Taiwan-related topics.
  • IOCs: Specific file hashes and C2 infrastructure not confirmed in available data. Monitor for AdaptixC2 indicators.

WP Maps Pro WordPress Plugin - Active Exploitation

  • Threat actors are actively exploiting a critical vulnerability in the WP Maps Pro WordPress plugin (over 15,000 sales) to create unauthorized administrator accounts. WordPress site operators using this plugin should update immediately or deactivate the plugin until a patch is confirmed applied.

Dutch Botnet Takedown

  • Dutch authorities (Politie and NCSC) dismantled a botnet comprising at least 17 million infected devices, with over 200 command-and-control servers located in the Netherlands. The takedown is a significant law enforcement success. Organizations should review endpoint telemetry for residual infections associated with this infrastructure.

SECURITY NEWS AND CONTEXT

  • The weekly threat recap from The Hacker News highlights a convergence of authentication bypass exploitation, poisoned developer tooling, OAuth phishing campaigns, and AI-assisted attack tooling lowering attacker barriers to entry. SOC teams should ensure detection coverage for OAuth token theft and developer environment compromise scenarios.

  • The Miasma and codexui-android campaigns represent a continued and intensifying trend of supply chain attacks targeting developer toolchains and AI-adjacent tooling. Organizations with active software development pipelines face elevated risk.

  • The Dutch botnet takedown demonstrates continued European law enforcement capability against large-scale cybercriminal infrastructure. Residual infections may persist on endpoints that were part of the botnet.

RECOMMENDED ACTIONS

  1. IMMEDIATE - Patch or mitigate CVE-2026-0257 (PAN-OS GlobalProtect) today. CISA deadline has passed. Verify patch status across all PAN-OS and Prisma Access deployments. Review VPN logs for unauthorized connections.

  2. IMMEDIATE - Address Oracle WebLogic CVE-2024-21182 before the 2026-06-04 CISA deadline. Block T3/IIOP at the network perimeter as an interim control.

  3. HIGH PRIORITY - Remediate Apache Solr CVE-2026-44825. Remove or change default template user credentials in security.json on all Solr clusters bootstrapped with BasicAuth. Do not wait for the upgrade.

  4. HIGH PRIORITY - Patch IBM WebSphere Application Server for CVE-2026-9311, CVE-2026-9319, CVE-2026-9330, and CVE-2026-8644. Prioritize internet-facing or SSO-integrated instances.

  5. DEVELOPER SECURITY - Audit all npm packages installed in development and CI/CD environments for @redhat-cloud-services namespace packages and the codexui-android package. Rotate all credentials and API tokens on potentially affected systems.

  6. THREAT HUNTING - Search for AdaptixC2 indicators in network and endpoint telemetry, particularly in government, research, and financial sector organizations. Review spear-phishing email logs for ZIP attachment delivery patterns.

  7. WORDPRESS OPERATORS - Update WP Maps Pro immediately or deactivate the plugin. Audit administrator accounts for unauthorized additions.

  8. PATCH MANAGEMENT - Review BSI advisories for Apache ActiveMQ, IBM Business Automation Workflow, OTRS, JetBrains IntelliJ IDEA, and Laravel. Prioritize internet-facing and authentication-critical systems.

  9. LINUX ENVIRONMENTS - Ensure current kernel patch levels are applied, particularly for privilege escalation vulnerabilities (Fragnesia, Dirty Frag) referenced in BSI advisories.

  10. BOTNET RESIDUALS - Cross-reference endpoint and network telemetry against known indicators from the Dutch botnet takedown. Contact Dutch NCSC or Europol for IOC feeds if not already subscribed.