Daily Threat Briefing
← All briefings

Mirasvit Full Page Cache Warmer · Oracle WebLogic Server · Android Framework

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-04 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership Classification: TLP:CLEAR

EXECUTIVE SUMMARY

The past 72 hours have seen a high volume of actionable threat activity. CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, including an actively exploited Android Framework flaw and a long-standing Oracle WebLogic Server vulnerability now confirmed under active attack. A critical unauthenticated remote code execution flaw in Mirasvit Full Page Cache Warmer (Magento ecosystem) was also added with a tight remediation deadline. The German BSI issued a large wave of updated advisories covering Linux Kernel, Golang, GnuTLS, Mozilla Firefox, PHP, and Samba, among others. On the threat campaign front, Gamaredon continues to exploit a WinRAR path traversal flaw against Ukrainian targets, a China-aligned group (Dragon Weave) is targeting Czech Republic and Taiwan government and academic sectors, and a malspam campaign is abusing Google DoubleClick to deliver the DesckVB RAT. Supply chain threats remain elevated, with the Miasma campaign compromising Red Hat npm packages. Several high-impact vulnerabilities in enterprise web infrastructure, including an HTTP/2 Bomb denial-of-service affecting NGINX, Apache, IIS, and Envoy, and a Redis use-after-free RCE, require prompt attention.

CRITICAL VULNERABILITIES

CVE-2026-45247

  • Affected products: Mirasvit Full Page Cache Warmer (Magento/Adobe Commerce extension)
  • Severity: Critical (CWE-502, Deserialization of Untrusted Data)
  • Exploitation status: Actively exploited; added to CISA KEV on 2026-06-03
  • Remediation: Apply vendor patch immediately. Unauthenticated attackers can achieve RCE by supplying a crafted serialized PHP object in the CacheWarmer cookie. CISA due date: 2026-06-06. Discontinue use if patch is unavailable.

CVE-2024-21182

  • Affected products: Oracle WebLogic Server (multiple versions)
  • Severity: High (CVSS 7.5)
  • Exploitation status: Actively exploited; added to CISA KEV on 2026-06-01; confirmed by CISA and corroborated by open-source reporting
  • Remediation: Apply Oracle Critical Patch Update from July 2024 immediately. Restrict T3 and IIOP protocol access at the network perimeter. Unauthenticated attackers with network access can fully compromise the server.

CVE-2025-48595

  • Affected products: Android Framework (June 2026 Android Security Bulletin)
  • Severity: High (CVSS 8.4, integer overflow leading to local privilege escalation)
  • Exploitation status: Actively exploited in the wild; added to CISA KEV on 2026-06-02
  • Remediation: Apply Google June 2026 Android security update. No user interaction required for exploitation. Prioritize managed Android devices in enterprise environments.

CVE-2022-0492

  • Affected products: Linux Kernel (cgroups v1 release_agent feature)
  • Severity: High (CWE-287/CWE-862, improper authentication enabling privilege escalation)
  • Exploitation status: Actively exploited; added to CISA KEV on 2026-06-02
  • Remediation: Apply kernel patches per vendor guidance. Check container environments specifically, as this flaw is frequently exploited for container escape. Verify cgroups v1 exposure in cloud and virtualized workloads.

CVE-2026-35075

  • Affected products: Industrial device (vendor unspecified in advisory VDE-2026-039, published by CERT VDE)
  • Severity: Critical (CVSS 9.8)
  • Exploitation status: No active exploitation confirmed; newly published
  • Remediation: Unauthenticated remote attacker can recover a hardcoded default password from firmware and gain full device access. Apply vendor firmware update immediately. Isolate affected devices from internet-facing networks.

CVE-2026-35082 / CVE-2026-35083 / CVE-2026-35084 / CVE-2026-35085

  • Affected products: Same industrial device family (CERT VDE advisory VDE-2026-039)
  • Severity: High (CVSS 8.7-8.8)
  • Exploitation status: No active exploitation confirmed; newly published
  • Remediation: Multiple post-authentication vulnerabilities including path traversal (arbitrary file read), stack buffer overflows in dali-devconfig and gdv-serverconfig (root RCE), and arbitrary file deletion. Apply firmware patches. Restrict network access to management interfaces.

CVE-2026-20230

  • Affected products: Cisco Unified Communications Manager (Unified CM) and Unified CM SME
  • Severity: High (CVSS 8.6); Cisco rates impact as Critical due to potential root escalation via SSRF-written files
  • Exploitation status: No active exploitation confirmed; newly published
  • Remediation: Apply Cisco security advisory fix. Note: WebDialer service must be enabled for exploitation; disable WebDialer if not required as an immediate mitigation.

CVE-2026-23479

  • Affected products: Redis 7.2.0 through all stable branches prior to May 2026 patch
  • Severity: High (use-after-free enabling authenticated RCE)
  • Exploitation status: Patched; no confirmed active exploitation reported
  • Remediation: Update Redis to the patched release (May 5, 2026 fix). Authenticated users can execute arbitrary OS commands on the host. Restrict Redis access to trusted clients only.

HTTP/2 Bomb (CVE not yet assigned at time of reporting)

  • Affected products: NGINX, Apache HTTPD, Microsoft IIS, Envoy, Cloudflare Pingora (default HTTP/2 configurations)
  • Severity: High (remote denial of service)
  • Exploitation status: Proof-of-concept published; no confirmed in-the-wild exploitation reported
  • Remediation: Review vendor-specific mitigations and configuration hardening guidance. Monitor vendor advisories for patches. Consider rate-limiting HTTP/2 streams as an interim control.

EUROPEAN ADVISORIES

BSI CERT-Bund issued a significant volume of security advisories on 2026-06-03, all rated HIGH. Key highlights for European defenders:

  • Golang Go: Multiple updated and new advisories (WID-SEC-2026-0548, -0345, -1006, -1776) covering unspecified attacks, denial of service, code execution, and security bypass. Organizations using Go-based services or toolchains should apply the latest Go runtime updates.

  • GnuTLS (WID-SEC-2026-1312): Multiple vulnerabilities enabling security bypass, information disclosure, and denial of service. Relevant for Linux-based enterprise systems and embedded devices using GnuTLS for TLS.

  • Mozilla Firefox and Firefox ESR (WID-SEC-2026-1296, -1503, -1606): Multiple vulnerabilities including potential code execution, sandbox escape, and security bypass. Apply latest Firefox and Thunderbird updates immediately across all managed endpoints.

  • PHP (WID-SEC-2026-1433): Multiple vulnerabilities including RCE, SQL injection, XSS, and denial of service. Patch PHP installations in web application environments.

  • Linux Kernel (multiple advisories): Extensive updates covering privilege escalation, denial of service, memory corruption, and code execution. Includes specific named vulnerabilities Dirty Frag and Fragnesia. Prioritize kernel patching on internet-facing and critical infrastructure Linux systems.

  • Progress Software Sitefinity (WID-SEC-2026-1783): New advisory covering multiple vulnerabilities allowing security bypass affecting confidentiality, integrity, and availability. Organizations using Sitefinity CMS should apply vendor patches promptly.

  • MISP (WID-SEC-2026-1778): New advisory for a security bypass vulnerability exploitable by unauthenticated remote attackers. Relevant for threat intelligence teams running MISP instances. Apply update immediately.

  • Samba (WID-SEC-2026-1686): Multiple vulnerabilities enabling RCE, denial of service, file manipulation, and security bypass. Patch Samba deployments in Active Directory and file-sharing environments.

  • Phoenix Contact industrial controller (VDE-2026-060, CVE-2026-41032): Unauthenticated adjacent attacker can download controller log files disclosing restricted information. Relevant for OT/ICS environments. Apply vendor mitigation and restrict network access to controllers.

CERT-EU published its monthly Cyber Brief 26-06 (May 2026) on 2026-06-02, providing an executive-level overview of the most relevant cybersecurity developments for EU institutions. No specific new technical advisories were issued by CERT-EU in the past 72 hours.

ACTIVE THREATS AND CAMPAIGNS

Gamaredon / WinRAR Exploitation (CVE-2025-8088)

  • The Russian state-linked Gamaredon group continues to exploit a WinRAR path traversal vulnerability (CVE-2025-8088) to deliver GammaPhish HTA payloads, which subsequently deploy GammaWorm (a self-propagating worm) and GammaSteel (a data theft tool). The campaign is primarily targeting Ukrainian entities but poses a spillover risk to European organizations with Ukrainian business relationships or shared infrastructure. Defenders should ensure WinRAR is fully patched and monitor for HTA execution from archive extraction paths.

Operation Dragon Weave (China-aligned)

  • A cyber espionage campaign attributed to a China-aligned threat actor is targeting government, research, academic, technology, and financial services sectors in the Czech Republic and Taiwan. The campaign delivers an AdaptixC2 agent via spear-phishing emails with ZIP attachments. European organizations, particularly in the Czech Republic and those with ties to targeted sectors, should review email gateway controls and monitor for AdaptixC2 indicators. Attribution confidence is moderate based on open-source reporting.

DesckVB RAT via Google DoubleClick Malspam

  • A newly identified malspam campaign is abusing Google’s DoubleClick domain as a redirect layer to evade email and web security controls before routing victims to attacker-controlled infrastructure delivering the DesckVB remote access trojan. The use of a trusted Google domain significantly reduces detection rates in environments relying on domain reputation. SOC teams should review email filtering rules and consider inspecting redirect chains through trusted domains.

Miasma Supply Chain Attack (npm / Red Hat)

  • The Miasma campaign has compromised packages under the @redhat-cloud-services npm namespace to steal credentials and secrets from developer machines and deliver a self-propagating worm. The attack uses install-time execution, credential harvesting, CI/CD pipeline targeting, and encrypted exfiltration. Development teams and DevOps pipelines consuming Red Hat npm packages should audit dependencies immediately and rotate any credentials present on affected systems.

Weedhack Malware-as-a-Service

  • Active since January 2026, the Weedhack MaaS campaign targets Minecraft players via YouTube, distributing malware disguised as Minecraft clients and mods. Over 3,800 samples have been identified. While primarily consumer-focused, the campaign represents a credential and system access risk for enterprise environments where personal devices or accounts are shared with corporate infrastructure.

Google Gemini Android Prompt Injection

  • Researchers disclosed that poisoned notifications from WhatsApp, Slack, SMS, Signal, Instagram, or Messenger could hijack Google Gemini’s voice assistant on Android, enabling actions such as opening windows, impersonating contacts, initiating calls, or poisoning long-term memory. No malicious app is required. This is relevant for organizations using Android devices with Gemini enabled in enterprise contexts. Confidence: high based on published research.

Microsoft 365 Android Token Exposure

  • A leftover debug flag in production builds of several Microsoft 365 Android apps disabled token-sharing restrictions, allowing any app on the same device to obtain the signed-in user’s account token without authentication. Microsoft has been notified; patch status should be confirmed before deploying or continuing use of affected apps on managed devices.

Windows Search URI NTLMv2 Hash Leak (Unpatched)

  • An unpatched vulnerability in the Windows search: URI handler can be exploited to leak NTLMv2 hashes to an attacker. Related to CVE-2026-33829 (Windows Snipping Tool ms-screensketch URI handler). No patch available at time of reporting. Mitigate by blocking outbound SMB at the perimeter and considering disabling NTLM where feasible.

Dashlane Brute-Force Incident

  • Dashlane disclosed that encrypted vaults of fewer than 20 personal-plan users were downloaded following a brute-force attack targeting 2FA on May 31, 2026. Vaults remain encrypted. Organizations using Dashlane for enterprise password management should verify their deployment tier is unaffected and review account activity logs.

SECURITY NEWS AND CONTEXT

  • AI-assisted vulnerability discovery is accelerating the threat landscape. CVE-2026-23479 in Redis was found by an autonomous AI tool and had remained undetected for over two years. Separately, the HTTP/2 Bomb vulnerability was discovered by OpenAI Codex. This trend indicates that AI tooling is now being used on both offensive and defensive sides to identify flaws faster than traditional research cycles.

  • One-click GitHub OAuth token theft via VS Code and GitHub.dev was disclosed, allowing attackers to steal tokens with read/write access to private repositories through a single crafted link. Developer workstations and CI/CD pipelines are at risk. GitHub has been notified; review OAuth token scopes and monitor for unauthorized repository access.

  • CERT-EU Cyber Brief 26-06 highlights that the overall threat landscape in May 2026 remained elevated, with continued focus on espionage campaigns targeting EU institutions and member state government entities.

RECOMMENDED ACTIONS

  1. PATCH IMMEDIATELY: Apply Oracle WebLogic patches for CVE-2024-21182. Restrict T3/IIOP access at the firewall as an additional control. CISA due date has passed.

  2. PATCH IMMEDIATELY: Apply Google June 2026 Android security update across all managed Android devices to address actively exploited CVE-2025-48595.

  3. PATCH IMMEDIATELY: Remediate Mirasvit Full Page Cache Warmer (CVE-2026-45247) on all Magento/Adobe Commerce deployments. CISA due date is 2026-06-06.

  4. LINUX KERNEL: Prioritize kernel patching across all Linux systems, particularly internet-facing hosts. Review cgroups v1 configurations for CVE-2022-0492 exposure in container and cloud environments.

  5. INDUSTRIAL/OT: Review CERT VDE advisory VDE-2026-039 and VDE-2026-060. Isolate affected industrial devices from public networks and apply firmware updates. Audit for default credentials.

  6. SUPPLY CHAIN: Audit npm dependencies for @redhat-cloud-services packages. Rotate credentials and secrets on any developer machines that installed affected packages. Review CI/CD pipeline integrity.

  7. EMAIL SECURITY: Update detection rules to flag redirect chains through trusted domains such as DoubleClick. Brief users on the DesckVB RAT malspam campaign.

  8. DEVELOPER SECURITY: Warn development teams about the GitHub.dev one-click token theft attack. Enforce short-lived OAuth tokens and monitor for anomalous repository access.

  9. NTLM HARDENING: Block outbound SMB (ports 445/139) at the network perimeter to mitigate the unpatched Windows Search URI NTLMv2 hash leak. Evaluate NTLM deprecation where operationally feasible.

  10. THREAT INTEL PLATFORMS: Apply the MISP security bypass patch (BSI WID-SEC-2026-1778) immediately on all internal MISP instances. Unauthenticated exploitation is possible.

End of Daily Threat Intelligence Briefing - 2026-06-04 Sources: CISA KEV, NVD, BSI CERT-Bund, CERT-EU, The Hacker News, CERT VDE