The Lyceum: Cyber Intelligence Daily — Jun 16, 2026
Photo: lyceumnews.com
Past 3 Days — June 16, 2026
The Big Picture
The throughline of the last three days is enterprise software that someone else was supposed to be securing. ShinyHunters' Oracle PeopleSoft zero-day jumped from American universities to the Council of Europe — and its leak deadline expires this evening. Cisco's SD-WAN platform logged its eighth actively-exploited flaw of the year, an AI gateway joined VPNs and firewalls as a standard perimeter target, and a cardiac-monitor company got robbed of patient heart data without a single CVE involved — just a phone call. Attackers are moving faster than patch cycles, and the casualties are the products nobody thought to audit.
What Just Dropped
- CVE-2026-35273 — Oracle PeopleSoft Enterprise PeopleTools: actively exploited, KEV-listed, ransomware-linked, maturity commoditized. Missing authentication on a critical web component; ShinyHunters used it to breach 100+ organizations before a patch existed.
- CVE-2026-20262 — Cisco Catalyst SD-WAN Manager: actively exploited, KEV-listed (due June 29), maturity operational. Path traversal lets an authenticated attacker write files and escalate to root on the controller.
- CVE-2026-54420 — LiteSpeed cPanel Plugin: actively exploited, KEV-listed (due June 18), maturity operational. Symlink-follow flaw lets any FTP/web-shell user become root on CloudLinux/CageFS shared hosts.
- CVE-2026-10520 — Ivanti Sentry: actively exploited, KEV-listed (due June 14, now passed), maturity operational. OS command injection with no authentication required.
- CVE-2026-42271 — BerriAI LiteLLM: actively exploited, KEV-listed, maturity operational. Command-injection chain (CVSS 9.9 per researchers) hands a low-privilege user full admin of your AI gateway.
This Week's Stories
ShinyHunters' Oracle Zero-Day Just Hit the Council of Europe — Deadline Is This Evening
What happened: ShinyHunters claims to have breached the Council of Europe — the continent's oldest intergovernmental body — and stolen more than 297 GB of data by exploiting CVE-2026-35273, a missing-authentication flaw in Oracle PeopleSoft. The group says it took over 429,000 documents from multiple Council departments and set a "final warning" deadline of June 16 to leak them — which, as of this writing, expires this evening, not yesterday. The alleged haul includes 409,000+ payslips for 10,000+ staff dating to 2011, in-house personnel files, CVs, and records carrying bank details, tax data, and medical information.
Mandiant and Google Threat Intelligence Group attribute the activity to UNC6240 (ShinyHunters), with exploitation observed between May 27 and June 9 — two weeks before Oracle's advisory. Most of the 100+ victims are US-based, and 68% sit in higher education, according to The Register.
What changes: The Council of Europe breach proves PeopleSoft has stopped being an education-sector story and become a general-purpose initial-access tool. If the group can monetize an intergovernmental body's HR database, every organization running internet-facing PeopleSoft is a target.
What to watch: Whether the dump publishes this evening tells you whether the Council quietly negotiated. If it does, European policy staff should brace for phishing that reads exactly like real HR correspondence. CVE-2026-35273 is in CISA's KEV catalog — check My Oracle Support for your PeopleTools version now.
Cisco SD-WAN's Eighth Exploited Flaw of 2026 — Patch by June 29
What happened: Cisco patched CVE-2026-20262 in Catalyst SD-WAN Manager (formerly vManage) — the dashboard that lets admins control up to 6,000 SD-WAN devices at once. The flaw stems from insufficient validation of uploaded files, letting a low-privilege remote attacker write arbitrary files and escalate to root via crafted HTTP requests. Cisco rated it 6.5 and reported "limited exploitation"; CISA added it to KEV with a June 29 federal deadline. It affects every deployment type — on-prem, Cloud-Pro, Cisco Managed, and FedRAMP.
What changes: "Attacker must already be authenticated" sounds reassuring until you remember that management-plane credentials are precisely what infostealers and earlier SD-WAN bugs harvest. This is a post-compromise escalation straight to root on the box that controls your entire WAN — from there an attacker pushes malicious configs, mirrors traffic, and plants persistent backdoors in branch routers.
What to watch: This is the eighth confirmed actively-exploited flaw in this codebase this year. The pattern — not any single CVE — is the story: someone is methodically working through Cisco SD-WAN. If exploitation surfaces in ransomware incident reports, treat SD-WAN controllers like VPNs in your hardening tier. Patch, rotate the controller's credentials, and check for unexpected users or jobs.
iRhythm: A Threat Actor Talked Its Way Into Patient Heart Data
What happened: iRhythm Holdings — maker of the Zio patch, the wearable cardiac monitor used to evaluate arrhythmias — disclosed in an SEC 8-K filing that on June 9 a threat actor contacted the company claiming to have stolen proprietary data, patient protected health information, and other personal data, demanding payment to stay quiet. iRhythm confirmed data was exfiltrated from third-party-hosted business applications. The access came through social engineering — no CVE, no zero-day, just a person manipulated into handing over credentials. Its medical devices and clinical systems were untouched, and it holds no payment-card data. On June 10 the company deemed the incident material given the data volume.
What changes: A confirmed, material PHI breach triggers HIPAA notification obligations. The lesson for defenders is uncomfortable: the most reliable initial-access vector this week required zero technical sophistication. Your patch program does nothing against a convincing phone call.
What to watch: iRhythm's formal patient notification, due in the coming days, will define scope. If the same social-engineering-into-a-third-party-SaaS pattern surfaces at another healthcare vendor, this becomes a category problem, not an iRhythm problem.
The WordPress Supply-Chain Attack That Hit 1.2 Million Sites
What happened: You didn't click anything. You didn't install anything new. Attackers compromised the content delivery network operated by Awesome Motive — the company behind OptinMonster, TrustPulse, and PushEngage — and tampered with the JavaScript those plugins serve. Any site loading those scripts delivered malicious code to visitors. If a logged-in administrator loaded the page, attackers could spin up a rogue admin account and install a hidden web shell — a backdoor that survives even after the poisoned script is pulled. Combined install base across the three plugins: over 1.2 million sites.
What changes: This is the supply-chain failure mode where the initial compromise is instant and the cleanup is slow. Removing the bad script doesn't remove the backdoor it planted. Expect downstream defacements and credential harvesting traced to this CDN breach for weeks.
What to watch: If you run any of these plugins, update now, audit your admin user list for accounts you don't recognize, and check for plugins installed in the last week. If a wave of "I never logged in but my site is backdoored" reports surfaces, the rogue-admin payload landed widely before anyone noticed.
⚡ What Most People Missed
The PeopleSoft campaign is chaining old Oracle bugs: In observed campaigns, attackers paired CVE-2026-35273 with previously patched flaws from Oracle's July 2025 Critical Patch Update to escalate privileges and slip past network segmentation. That chaining is the tell — this is a practiced playbook, not opportunistic scanning. Mandiant's full non-education victim list is still unpublished.
A second simultaneous zero-day got buried: Mandiant CTO Charles Carmakal flagged that CVE-2026-35273 is one of two zero-days being exploited in parallel — the other in Cisco Catalyst SD-WAN Manager. Everyone watching the university breach count missed that two enterprise platforms were burning at once.
A two-year-old Oracle WebLogic flaw is now an active weapon: CISA added CVE-2024-21182 to KEV on June 1 — a pre-auth, low-complexity flaw Oracle patched back in July 2024. Someone sat on a working exploit for two years and only recently deployed it at scale. No threat actor has been attributed yet, which is unusual at this severity; of 43 Oracle KEV entries over recent years, 12 ended up tied to ransomware.
An AI gateway just joined the perimeter-target club: A vulnerability chain in LiteLLM — the open-source proxy that fronts models like GPT-4 and Claude — scores CVSS 9.9 and lets a low-privileged user reach admin, run code, steal API keys, read prompts, and tamper with model responses. CISA added CVE-2026-42271 to KEV as actively exploited. Your AI risk register now needs patch SLAs and key-rotation playbooks, not just policy language.
SimpleHelp lets attackers mint their own technicians: If a SimpleHelp server uses OpenID Connect for login, an unauthenticated attacker can forge an OIDC response and create a privileged technician account — then start remote sessions, push scripts, and pivot, all looking like normal IT activity in your logs. Reconcile "who can remote in" against your actual staff roster.
From the Foreign Press
GreatXML: A Practical BitLocker Bypass Through Windows Recovery
Russian outlet Xakep detailed an exploit chain nicknamed GreatXML that abuses the Windows Recovery Environment (WinRE) and its XML configuration files to bypass BitLocker — effectively unlocking an encrypted disk without the user's password. WinRE can be booted and steered by crafted XML that controls recovery workflows; by tampering with those configs and how Windows trusts them, an attacker with physical or low-level access can coerce the system into mounting an encrypted volume in a context they control. Microsoft has published no English-language advisory specific to GreatXML, so this article is the only public technical depth right now. For Western defenders, the implication is blunt: your "lost laptop is just paperwork" assumption is only as strong as your WinRE hardening and recovery-key hygiene. Watch the Microsoft Security Response Center over the next 24–48 hours. Source: Xakep (Хакер) — Russian. No English-language coverage confirmed at time of publication.
400+ Arch Linux AUR Packages Shipped a Rootkit and Infostealer
Xakep reports that more than 400 Arch User Repository packages were compromised to distribute a combined kernel-level rootkit and information-stealer, injected after maintainer credentials were hijacked. The attackers didn't publish obviously malicious new packages — they quietly slipped code into popular existing ones, so routine updates pulled in the payload. The stealer hunts browser data, SSH keys, crypto wallets, and cloud credentials, while the rootkit hides its processes and files from normal tools. The package count and sophistication described here exceed what English-language summaries of the earlier "Atomic Arch" theme have reported, which is the real signal: this looks less like a cleanup event and more like an early-stage trust collapse in community packaging. If Arch sits anywhere near your production path — or on developer laptops holding secrets — audit AUR usage and tighten policy on unofficial repos across all distros. Source: Xakep (Хакер) — Russian. No English-language coverage confirmed at time of publication.
📅 What to Watch
- If ShinyHunters publishes the Council of Europe dump this evening, the resulting phishing against European policy staff will be indistinguishable from real HR mail — and their willingness to follow through tells you whether the Council negotiated.
- If Microsoft issues a WinRE advisory referencing GreatXML, every organization relying on BitLocker for stolen-laptop protection needs to revisit recovery-key storage — disk encryption stops being a checkbox.
- If a third research team confirms the LiteLLM-style takeover against a different AI proxy, model gateways graduate from niche research to a standard pen-test target overnight.
- If the WebLogic KEV entry (CVE-2024-21182) gets a ransomware attribution this week, expect it to overlap with the same Oracle-focused infrastructure ShinyHunters is running against PeopleSoft — one campaign, multiple Oracle products.
- If major hosting providers start force-patching the LiteSpeed cPanel plugin or rebooting tenants, the long tail of "my small-business site got hacked but I never logged in" reports will trace back to this week.
The Closer
This week: a wearable that watches your heartbeat got robbed by a guy with a telephone, the Council of Europe's payroll department learned about zero-days the hard way, and somewhere a developer ran yay -S and quietly handed a kernel rootkit the keys to production. The AI gateway you bought to centralize and secure model access turned out to be the softest target in the building — which is the kind of irony that doesn't need a punchline, just a patch.
Stay paranoid. Patch the controller.
If you know someone still telling themselves "it's encrypted, so it's fine" — forward this. Gently.
⚡ EDGE Signals
The following signals appeared in the adversarial edge sweep but were not carried forward in the primary synthesis:
- Cisco quietly added a nasty detail on June 4 and updated it again through June 9: CVE-2026-20245, a local authenticated privilege-escalation flaw with a CVSS score of 7.8, is being exploited in June 2026, and Cisco says the attacker path can involve first abusing CVE-2026-20182 or CVE-2026-20127
- CISA's addition of Oracle WebLogic flaw CVE-2024-21182 to the Known Exploited Vulnerabilities catalog looked, at first glance, like routine hygiene around an old patch. It is not. The bug was fixed by Oracle in July 2024, carries a CVSS score of 7.5, and yet CISA moved in early June 2026 because it
- ### CERT-UA's Office zero-day warning still looks like the fastest public read on GRU tradecraft [link removed]
- [8] 2026 Cyber Threat Assessment - NJCCIC - NJ.gov
URL:
Snippet: The NJCCIC works to make New Jersey more resilient to cyberattacks by promoting statewide awareness of cyber threats and widespread adoption of best practices.