Daily Threat Briefing
← All briefings

Microsoft Defender · PTC Windchill PDMLink · libssh2

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-18 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

Today’s most significant new developments are a Dropping Elephant espionage campaign using a China-themed lure and a heavily reworked memory-resident RAT with full IOCs published, a “FortiBleed” credential leak exposing VPN credentials for 73,932 Fortinet devices, and a critical RCE vulnerability in PTC Windchill PDMLink and FlexPLM via Java deserialization. The Microsoft Defender RoguePlanet zero-day (CVE-2026-50656) has now received a formal CVE assignment. Multiple critical WordPress plugin flaws were published in bulk by Patchstack.

CRITICAL VULNERABILITIES

NEW

CVE-2026-50656 (Microsoft Defender / Malware Protection Engine — RoguePlanet)

  • Affected products: Microsoft Defender, Microsoft Malware Protection Engine (all current Windows versions)
  • Severity: CVSS 7.8
  • EPSS: Not yet scored
  • Technical detail: Previously disclosed as the RoguePlanet zero-day, this local privilege escalation flaw in the Microsoft Malware Protection Engine has now received a formal CVE assignment. A local attacker can exploit the vulnerability to elevate privileges on affected systems. Given Defender’s near-universal deployment across Windows enterprise environments, the attack surface is exceptionally broad. No patch is currently available; BSI advisory WID-SEC-2026-1976 remains marked UNGEPATCHT.
  • Exploitation status: Publicly disclosed; no confirmed in-the-wild exploitation reported. Patch not yet available.
  • Remediation: No vendor patch available. Restrict local user privileges, enforce application control policies, and monitor for anomalous Defender process behavior. Apply patch immediately upon Microsoft release.

STATUS CHANGE: CVE-2026-50656 is the formal CVE assignment for the RoguePlanet zero-day first reported 2026-06-17. CVSS score now confirmed at 7.8. No other material change; patch still unavailable.

CVE-2026-12569 (PTC Windchill PDMLink / FlexPLM)

  • Affected products: PTC Windchill PDMLink versions 11.0 M030 through 13.1.3.0; PTC FlexPLM versions 11.0 M030 through 13.0.3.0
  • Severity: CVSS 9.3
  • EPSS: 0.00 (newly published)
  • Technical detail: A critical RCE vulnerability exists in PTC’s Windchill product lifecycle management and FlexPLM retail planning platforms via deserialization of untrusted data. An unauthenticated remote attacker can send a crafted request to trigger unsafe Java deserialization, achieving arbitrary code execution on the server. Windchill PDMLink is widely deployed in manufacturing, aerospace, defense, and automotive sectors, including European industrial organizations. The broad version range affected (spanning multiple major releases) increases exposure significantly.
  • Exploitation status: No confirmed exploitation. Newly published.
  • Remediation: Apply PTC-issued patches immediately. Restrict network access to Windchill and FlexPLM management interfaces. Review server logs for anomalous deserialization-related requests. Consult PTC support for patch availability per version.

CVE-2026-55200 / CVE-2026-55199 (libssh2)

  • Affected products: libssh2 through version 1.11.1 (all platforms)
  • Severity: CVE-2026-55200 CVSS 9.2 (out-of-bounds write); CVE-2026-55199 CVSS 8.2 (pre-auth DoS)
  • EPSS: 0.00 (newly published)
  • Technical detail: CVE-2026-55200 is an out-of-bounds write in ssh2_transport_read() that fails to enforce upper bounds on the packet_length field, allowing remote attackers to achieve memory corruption and potentially RCE. CVE-2026-55199 is a pre-authentication denial of service in the SSH_MSG_EXT_INFO handler that allows a malicious SSH server to crash the client. libssh2 is embedded in a very large number of applications, language runtimes, and system tools across Linux, macOS, and Windows environments. Both are fixed in specific commits; no versioned release has been published yet.
  • Exploitation status: No confirmed exploitation. Newly published.
  • Remediation: Apply the upstream patches (commits 7acf3df for CVE-2026-55200 and 1762685 for CVE-2026-55199). Monitor for distribution-level packages. Audit applications that bundle libssh2 and prioritize patching internet-facing SSH client implementations.

CVE-2026-54388 / CVE-2026-54387 / CVE-2026-55202 (Tinyproxy)

  • Affected products: Tinyproxy through version 1.11.3
  • Severity: CVE-2026-54388 and CVE-2026-54387 CVSS 9.3; CVE-2026-55202 CVSS 8.8
  • EPSS: 0.00 (newly published)
  • Technical detail: Three distinct HTTP request smuggling and access control vulnerabilities affect Tinyproxy. CVE-2026-54388 involves failure to reject requests with multiple conflicting Content-Length headers, forwarding all duplicates to the backend. CVE-2026-54387 fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, enabling request smuggling to backend systems. CVE-2026-55202 allows unauthenticated access to the Tinyproxy stats page via Host header injection. Tinyproxy is commonly deployed as a lightweight HTTP proxy in Linux environments and embedded systems. All three are fixed in specific upstream commits.
  • Exploitation status: No confirmed exploitation. Newly published.
  • Remediation: Apply upstream patches (commits 364cdb6, ff45d3b, and 09312a1 respectively). Restrict access to the Tinyproxy stats page. Review proxy deployments for exposure to untrusted clients.

ONGOING

  • CVE-2026-48907 (Joomla JCE plugin): Actively exploited; CISA KEV deadline 2026-06-19 — patch today.
  • CVE-2026-48616 (Rocket.Chat): Unauthenticated file access; upgrade to patched branch version.
  • CVE-2026-20262 (Cisco Catalyst SD-WAN Manager): Actively exploited zero-day; CISA KEV deadline 2026-06-29; patch immediately.
  • CVE-2026-0257 (Palo Alto PAN-OS GlobalProtect): Actively exploited authentication bypass; apply PAN-OS patches.
  • CVE-2026-42271 (LiteLLM): KEV deadline 2026-06-22; upgrade to v1.83.7-stable.
  • CVE-2026-5027 (Langflow): Actively exploited; isolate from internet.
  • CVE-2026-50751 (Check Point Security Gateway): Actively exploited; apply hotfix sk185033.
  • CVE-2026-11645 (Google Chrome V8): Actively exploited; update to 149.0.7827.103 or later.

EUROPEAN ADVISORIES

BSI published several new advisories on 2026-06-17. New entries of note:

WID-SEC-2026-1983 (PJSIP): New high-severity advisory covering multiple vulnerabilities in the PJSIP open-source SIP and media stack, enabling DoS and data manipulation. PJSIP is embedded in many VoIP applications and communication platforms. Apply available updates.

WID-SEC-2026-1981 (Zammad): New high-severity advisory for the open-source helpdesk platform Zammad, covering privilege escalation to administrator, security bypass, data manipulation, information disclosure, and DoS. Zammad is widely used in German-speaking organizations. Apply the latest Zammad release immediately and review administrator account activity.

WID-SEC-2026-1976 (Microsoft Defender / RoguePlanet): Covered in Critical Vulnerabilities.

WID-SEC-2026-1975 / WID-SEC-2026-1974 / WID-SEC-2026-1970 (LiteLLM, vllm, Langflow): Previously reported; no material change. Apply updates and restrict management interface exposure.

WID-SEC-2026-1982 (Rockwell Automation FactoryTalk Historian Site Edition): New high-severity advisory covering security bypass, DoS, and data manipulation. Relevant to organizations with OT/IT convergence environments. Apply Rockwell patches and review historian interface exposure.

BSI NIS2 Registration Deadline: BSI has issued a formal reminder that organizations subject to NIS2 must register by end of July 2026. Organizations that have not yet registered should treat this as an urgent compliance action.

Update advisories for vm2 (WID-SEC-2026-1349), IBM WebSphere Application Server (WID-SEC-2026-1762), Mozilla Firefox and Thunderbird (WID-SEC-2026-1606 / WID-SEC-2026-1503), Apache HTTP Server (WID-SEC-2026-1824), Linux Kernel (multiple), Red Hat OpenShift, Splunk Enterprise, and Golang Go were refreshed; apply vendor patches per prior guidance.

ACTIVE THREATS AND CAMPAIGNS

NEW — Dropping Elephant: China-Themed Loader Chain with Memory-Resident RAT Rapid7 has published a detailed analysis of a new Dropping Elephant campaign using a spearphishing LNK disguised as a China energy-sector contract document (GRES-3 project). The delivery chain uses PowerShell staging, DLL side-loading via the legitimate Microsoft binary Fondue.exe, AES-256-CBC payload decryption, and Donut shellcode to load a fully reworked 32-bit RAT entirely in memory. The RAT patches AMSI, WLDP, and ETW before execution, uses Salsa20-encrypted C2 communications over HTTPS to gcl-power[.]org, and supports directory listing, file upload/download, screenshot capture, and shell execution. Attribution to Dropping Elephant is based on shared command-handler structure, screenshot logic, and beaconing patterns.

Key behavioral IOCs: LNK spawning conhost.exe then PowerShell; files staged in C:\Users\Public\; scheduled task named GoogleErrorReport executing Fondue.exe every minute; Fondue.exe loading APPWIZ.cpl from C:\Users\Public\ rather than a system directory.

Key network IOCs: chinagreenenergy[.]org (staging server), gcl-power[.]org (C2, HTTPS/443), URI paths /prjozifvkpkfhkr/gedhagammgjvvva/ (command poll) and /prjozifvkpkfhkr/spxbjdhxtapivrk/ (screenshot exfil).

Key file IOCs: GRES3001.lnk (SHA-256: a8ecbd9c049044ca4990a0e5960d19ce782a3b42d7763e9693d7c91ead24a0b7), APPWIZ.cpl loader (914da75a4ad6d70db856a2bc318d8828f28894622f017ee78d470b4794faafa6), final RAT (7099c33933716c00c1f4bdb0281c230b981c76b23d7d1c83abc6f58968267d54).

Defenders should verify whether endpoint tooling detects memory-resident payloads and in-process security control patching.

NEW — FortiBleed: Fortinet VPN Credential Leak A data leak dubbed “FortiBleed” has exposed VPN credentials for approximately 73,932 Fortinet and FortiGate firewall URLs. The origin and mechanism of the leak are not yet confirmed. Organizations using Fortinet VPN products should treat all VPN credentials as potentially compromised, rotate credentials immediately, review VPN access logs for unauthorized sessions, and enforce MFA on all VPN access points.

ONGOING: Mastra npm supply chain attack (easy-day-js) — audit @mastra dependencies, rotate secrets. ONGOING: Malicious JetBrains Marketplace AI plugins — remove unverified plugins, rotate AI API keys. ONGOING: Coordinated SSH brute-force activity — review SSH exposure, enforce key-based authentication and fail2ban or equivalent.

SECURITY NEWS AND CONTEXT

UK NCSC CEO Statement: NCSC Director Richard Horne stated at RUSI’s Annual Security Lecture that hostile states are linked to approximately three-quarters of cyber attacks affecting UK critical infrastructure, underscoring the elevated nation-state threat environment relevant to European operators.

Crypto Clipper Campaign: An unknown threat actor is distributing clipboard-hijacking malware via fake reviews on legitimate news sites, GitHub, SourceForge, and YouTube, using a WordPress phishing hub as the central distribution point. Block execution of unsigned binaries from user-writable paths.

RECOMMENDED ACTIONS

  1. Patch Joomla JCE plugin (CVE-2026-48907) today — CISA KEV deadline is 2026-06-19; audit for webshells.
  2. Block Dropping Elephant IOCs at perimeter and endpoint: domains chinagreenenergy[.]org and gcl-power[.]org; hunt for GoogleErrorReport scheduled task and Fondue.exe in C:\Users\Public\.
  3. Rotate all Fortinet VPN credentials immediately in response to FortiBleed leak; enforce MFA on VPN; review access logs for unauthorized sessions.
  4. Apply PTC patches for CVE-2026-12569 (Windchill PDMLink / FlexPLM); restrict management interface network access.
  5. Apply libssh2 upstream patches for CVE-2026-55200 and CVE-2026-55199; audit applications bundling libssh2.
  6. Apply Tinyproxy upstream patches for CVE-2026-54388, CVE-2026-54387, and CVE-2026-55202; restrict stats page access.
  7. Apply Zammad updates per BSI WID-SEC-2026-1981; review administrator account activity.
  8. Register with BSI under NIS2 before end of July 2026 if not yet completed.
  9. Monitor Microsoft Security Response Center for RoguePlanet (CVE-2026-50656) patch release; apply immediately when available.
  10. Continue remediation of previously reported items: Cisco SD-WAN CVE-2026-20262, PAN-OS CVE-2026-0257, LiteLLM CVE-2026-42271 (KEV deadline 2026-06-22), Langflow CVE-2026-5027, Check Point CVE-2026-50751, Chrome CVE-2026-11645.