Daily Threat Briefing
← All briefings

Linux kernel · Kestra OSS workflow orchestration platform · Budibase low-code platform

DAILY THREAT INTELLIGENCE BRIEFING Date: 2026-06-27 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

EXECUTIVE SUMMARY

The most significant new developments today are: a public working exploit for the Linux kernel “pedit COW” privilege escalation (CVE-2026-46331) and a newly detailed DirtyClone variant (CVE-2026-43503), both enabling local-to-root on Linux systems. A new SharkLoader malware campaign is deploying Cobalt Strike against government and diplomatic targets. Russian intelligence actors have escalated their Signal phishing campaign to harvest Backup Recovery Keys, enabling full account takeover. BSI published new advisories for Keycloak, PowerDNS, Google Chrome, Fluentd, and WSO2 API Manager.

CRITICAL VULNERABILITIES

NEW

CVE-2026-46331 (Linux Kernel — “pedit COW”)

  • Affected products: Linux kernel, traffic-control subsystem (act_pedit); broad distribution impact
  • Severity: CVSS not yet formally published; Red Hat rates as high
  • EPSS: Not yet available
  • Technical detail: An out-of-bounds write in the packet-editing action (act_pedit) corrupts shared page-cache memory via a copy-on-write race condition. A local unprivileged user can exploit this to overwrite cached binaries and gain root. A public, working exploit appeared within one day of CVE assignment on June 16. The attack requires local code execution but no special privileges, making it highly relevant for multi-tenant Linux environments, container hosts, and VPS infrastructure.
  • Exploitation status: Public working exploit available; no confirmed in-the-wild exploitation reported yet.
  • Remediation: Apply kernel updates from your distribution vendor as soon as available. Restrict local user access on sensitive systems. Monitor for unexpected privilege escalation events. Consider disabling act_pedit via kernel module restrictions where operationally feasible.

CVE-2026-43503 (Linux Kernel — “DirtyClone”)

  • Affected products: Linux kernel; file-backed memory via cloned network packets
  • Severity: CVSS 8.8
  • EPSS: Not yet available
  • Technical detail: Part of the DirtyFrag vulnerability family, this flaw allows a local user to corrupt file-backed memory through a cloned network packet, leading to root privilege escalation. JFrog Security Research published a working exploit walkthrough on June 25, the first public demonstration for this variant. The patch has landed in the upstream kernel but distribution backports may lag. The combination of DirtyClone and pedit COW means two distinct local-to-root paths are now publicly demonstrated simultaneously.
  • Exploitation status: Public exploit walkthrough published; no confirmed in-the-wild exploitation reported.
  • Remediation: Apply distribution kernel patches. Prioritize patching on shared infrastructure, container hosts, and systems with untrusted local users. Track JFrog advisory for updated IOCs.

CVE-2026-49869 and CVE-2026-53576 (Kestra — Authentication Filter Bypass)

  • Affected products: Kestra OSS workflow orchestration platform, versions prior to 1.0.45 and 1.3.21
  • Severity: CVSS 10.0 (both)
  • EPSS: 0.0 (newly published; no exploitation observed yet)
  • Technical detail: Two distinct authentication filter bypass vulnerabilities in Kestra’s REST API. CVE-2026-49869 exploits a path suffix check (endsWith(“/configs”)) that can be trivially satisfied by appending the string to any path. CVE-2026-53576 similarly abuses a path-ends-with “/con” check in the @Filter(“/api/v1/**”) handler. Both allow unauthenticated access to protected API endpoints. Kestra is used for data pipeline and workflow orchestration and may have access to sensitive credentials, cloud configurations, and internal systems.
  • Exploitation status: No exploitation confirmed; CVSS 10.0 with unauthenticated network attack vector warrants urgent treatment.
  • Remediation: Upgrade to Kestra 1.0.45 or 1.3.21 (or later). If immediate patching is not possible, restrict Kestra API access to trusted networks and authenticated proxies.

CVE-2026-54350 (Budibase — Unauthenticated Database Read)

  • Affected products: Budibase low-code platform, versions prior to 3.39.12
  • Severity: CVSS 10.0
  • EPSS: 0.0 (newly published)
  • Technical detail: An unauthenticated visitor to any published Budibase application can read every document from backing data sources including MongoDB, CouchDB, Elasticsearch, and DynamoDB. No authentication or session token is required. Organizations using Budibase to front internal databases may be exposing the entire contents of those stores to the internet. Additional Budibase vulnerabilities published simultaneously include a zip path traversal (CVE-2026-54352, CVSS 9.6), SSRF via DNS rebinding (CVE-2026-54353, CVSS 8.5), and a webhook injection flaw (CVE-2026-54351, CVSS 8.2).
  • Exploitation status: No exploitation confirmed.
  • Remediation: Upgrade Budibase to 3.39.12 (for CVE-2026-54350) and 3.39.9 (for the remaining three CVEs). Restrict Budibase instances to internal networks where possible.

CVE-2026-52785 (OpenProject — SQL Injection in Timestamps)

  • Affected products: OpenProject web-based project management, versions prior to 17.3.3 and 17.4.1
  • Severity: CVSS 9.9
  • EPSS: 0.0 (newly published)
  • Technical detail: A SQL injection vulnerability in OpenProject’s baseline comparison timestamps functionality allows authenticated callers to inject arbitrary SQL. Additional critical vulnerabilities published in the same batch include cache store poisoning leading to RCE (CVE-2026-52780, CVSS 9.6), an IDOR via project storage settings (CVE-2026-52782, CVSS 9.9), a CSRF enabling admin privilege assignment (CVE-2026-52784, CVSS 8.8), and a hardcoded default SECRET_KEY_BASE in the Docker image (CVE-2026-46386, CVSS 9.9). OpenProject is widely used in European public sector and enterprise environments.
  • Exploitation status: No exploitation confirmed.
  • Remediation: Upgrade to OpenProject 17.3.3 or 17.4.1. Rotate SECRET_KEY_BASE if the default Docker image value was ever used in production.

ONGOING

  • CVE-2026-12569 (PTC Windchill/FlexPLM): actively exploited; CISA KEV deadline 2026-06-28 — patch immediately.
  • CVE-2026-20230 (Cisco Unified CM): actively exploited; CISA KEV deadline 2026-06-28 — patch or isolate management interface.
  • CVE-2026-20262 (Cisco Catalyst SD-WAN Manager): actively exploited; CISA KEV deadline 2026-06-29 — patch required.
  • CVE-2026-20245 (Cisco Catalyst SD-WAN Manager): zero-day, actively exploited; apply patches.
  • golang.org/x/crypto/ssh (CVE-2026-46595 et al.): CVSS up to 10.0; update to 0.52.0.
  • CVE-2026-39955/39938/39893 (Cacti): unauthenticated SQLi/LFI; upgrade to 1.2.31.
  • CVE-2026-52806/52813 (Gogs): authenticated RCE; upgrade to 0.14.3.

EUROPEAN ADVISORIES

BSI published a new batch of advisories on 2026-06-26. New advisories (NEU) include:

WID-SEC-2026-2096 (Fluentd — hoch): Multiple vulnerabilities in the open-source log aggregator allowing remote code execution, information disclosure, and denial of service by unauthenticated remote attackers. Apply Fluentd updates; relevant for organizations using Fluentd in logging pipelines.

WID-SEC-2026-2093 (Keycloak — hoch): Multiple vulnerabilities in the widely deployed open-source identity and access management platform, including XSS, security bypass, information disclosure, and file manipulation. Apply Keycloak updates promptly given its role as an authentication gateway in many European enterprise and public sector deployments.

WID-SEC-2026-2092 (Google Chrome — hoch): Multiple vulnerabilities enabling arbitrary code execution, denial of service, and security bypass. Apply the latest Chrome update; a second Chrome update was released this week with the reason undisclosed.

WID-SEC-2026-2091 (PowerDNS — hoch): Multiple vulnerabilities in PowerDNS Authoritative Server and Recursor allowing denial of service, DNS cache poisoning, DNSSEC validation bypass, and information disclosure by unauthenticated remote attackers. Apply PowerDNS updates; directly relevant for European DNS infrastructure operators.

WID-SEC-2026-2089 (Coolify — hoch): Multiple vulnerabilities in the self-hosted cloud platform enabling arbitrary code execution, security bypass, and information disclosure. Apply Coolify updates.

WID-SEC-2026-2087 (Google Cloud Platform — hoch): CVE-2025-11919 — the default JVM on GCP instances can access temporary files of other users on the same cloud instance. Relevant for multi-tenant GCP deployments; apply available mitigations.

WID-SEC-2026-2085 (WSO2 API Manager — hoch): Multiple vulnerabilities including SQL injection, privilege escalation, RCE, XSS, and security bypass. Apply WSO2 API Manager updates; relevant for organizations using WSO2 as an API gateway.

Updated advisories (UPDATE): Flowise (WID-SEC-2025-0568, WID-SEC-2025-2048, WID-SEC-2025-0569 — kritisch, one still unpatched), LiteLLM (WID-SEC-2026-1288 — kritisch), PTC FlexPLM (WID-SEC-2026-1991 — kritisch; see Critical Vulnerabilities ONGOING), Linux Kernel (WID-SEC-2026-2077), Google Chrome/Edge (WID-SEC-2026-2071), IBM WebSphere (WID-SEC-2026-2050), MariaDB (WID-SEC-2026-1744), Oracle MySQL (WID-SEC-2026-1199), Node.js (WID-SEC-2026-2004), PostgreSQL (multiple advisories), Golang Go (WID-SEC-2026-1006), jq (WID-SEC-2026-1469) — apply outstanding patches per vendor guidance.

ACTIVE THREATS AND CAMPAIGNS

NEW — SharkLoader / StrikeShark: Cobalt Strike Loader Campaign Kaspersky published analysis of a new malware loader called SharkLoader, tracked under the campaign name StrikeShark. SharkLoader delivers Cobalt Strike Beacon on compromised hosts. Confirmed targets include a diplomatic organization in Indonesia and government organizations in Taiwan. Attribution is not yet established. The use of Cobalt Strike as a second-stage payload indicates post-exploitation objectives including lateral movement and data exfiltration. European government and diplomatic organizations should review endpoint telemetry for SharkLoader IOCs from the Kaspersky report.

STATUS CHANGE — Russian Intelligence Signal Phishing: Backup Recovery Key Theft Added The CISA/FBI campaign warning from March 2026 has been materially updated. Russian intelligence actors have added a new step: targets are now coaxed into surrendering their Signal Backup Recovery Key. Possession of this key allows the attacker to restore the full account backup, access historical private and group messages, and maintain persistent account access. The key remains valid indefinitely after handover. Organizations with personnel using Signal for sensitive communications should brief staff on this specific social engineering technique and enforce Signal PIN locks.

ONGOING — Turla STOCKSTAY: .NET backdoor targeting Ukrainian government and Italian foreign policy entities; apply GTIG IOCs to SIEM/EDR. ONGOING — CL-STA-1062 / TinyRCT: espionage campaign targeting Southeast Asian government and critical infrastructure; TTPs relevant for European defenders. ONGOING — Miasma supply chain malware: targeting npm (LeoPlatform, RStreams) and GitHub Actions; audit CI/CD pipeline dependencies. ONGOING — Microsoft-tracked hotel phishing campaign: photo ZIP lures dropping Node.js implant targeting European hospitality sector since April 2026.

SECURITY NEWS AND CONTEXT

Polymarket suffered a supply-chain attack via a compromised third-party vendor, resulting in approximately $3 million stolen from user accounts through a malicious frontend script injection; the platform has committed to full reimbursement. Threat actors are also impersonating legitimate companies via fraudulent OpenAI organization invites to trick employees into submitting sensitive information, a novel social engineering vector targeting cybersecurity firms specifically.

A popular YouTube ad-blocking Chrome extension (Adblock for YouTube, 11 million installs) was found capable of injecting arbitrary JavaScript into any page; enterprise browser administrators should review and consider blocking this extension pending further investigation.

RECOMMENDED ACTIONS

  1. Apply Linux kernel patches for CVE-2026-46331 (pedit COW) and CVE-2026-43503 (DirtyClone) immediately — public working exploits exist for both; prioritize container hosts, VPS, and multi-tenant systems.
  2. Upgrade Kestra to 1.0.45 or 1.3.21 — two CVSS 10.0 unauthenticated API bypass flaws; restrict API access to trusted networks if patching is delayed.
  3. Upgrade Budibase to 3.39.12 — unauthenticated full database read (CVSS 10.0); also apply 3.39.9 for SSRF and webhook injection fixes.
  4. Upgrade OpenProject to 17.3.3 or 17.4.1 — SQL injection, RCE via cache poisoning, IDOR, and CSRF in a single patch batch; rotate SECRET_KEY_BASE if default Docker value was used.
  5. Apply Keycloak and PowerDNS updates per BSI WID-SEC-2026-2093 and WID-SEC-2026-2091 — authentication gateway and DNS infrastructure risk.
  6. Brief staff on updated Russian Signal phishing technique — specifically the Backup Recovery Key theft step; enforce Signal PIN locks on all organizational devices.
  7. Review SharkLoader/StrikeShark IOCs from Kaspersky StrikeShark report; apply to EDR and SIEM for government and diplomatic environments.
  8. Patch PTC Windchill/FlexPLM (CVE-2026-12569) and Cisco Unified CM (CVE-2026-20230) by CISA KEV deadline 2026-06-28 if not already completed.
  9. Apply WSO2 API Manager and Fluentd updates per BSI WID-SEC-2026-2085 and WID-SEC-2026-2096.
  10. Continue remediation of previously reported items: CVE-2026-20262 (Cisco SD-WAN KEV deadline 2026-06-29), CVE-2026-20245 (Cisco SD-WAN zero-day), golang.org/x/crypto 0.52.0 update, Cacti CVE-2026-39955/39938/39893, Gogs CVE-2026-52806/52813, FortiBleed credential rotation.