The Lyceum: Cyber Intelligence Daily — Jun 22, 2026

• Rotate every developer secret now if any workstation or CI/CD pipeline ran npm install after June 16 — North Korea's Sapphire Sleet backdoored 144 Mastra AI packages in 88 minutes to harvest cloud, LLM, and crypto credentials during installation.
• Patch NGINX immediately to 1.31.2 or 1.30.3 — F5 shipped rare out-of-band fixes for two unauthenticated critical RCE flaws (CVE-2026-42530, CVE-2026-42055) in Plus, Open Source, Gateway Fabric, and Instance Manager.
• Treat exposed WebLogic as compromised, not just unpatched — CVE-2024-21182's federal remediation deadline expires tonight while honeypots still log active payloads on ports 7001/7002.

North Korea's Sapphire Sleet (BlueNoroff/APT38) hijacked a stale contributor account ("ehindero") and on June 17 republished 142 packages in the @mastra npm scope, each carrying "easy-day-js," a near-clone of dayjs. A postinstall hook ran an obfuscated dropper, disabled TLS verification, and executed a detached second stage — during installation, so importing the package was never required. @mastra/core alone draws ~918,000 weekly downloads; the affected scope exceeds 1.1 million. Roll back to pre-incident versions and rotate npm, GitHub, cloud, LLM, CI/CD, and SSH credentials, plus move wallet funds to clean devices. TechTimes · Microsoft · Orca

On June 18, F5 released out-of-band fixes for a use-after-free in the HTTP/3 QUIC module (CVE-2026-42530) and a heap buffer overflow reachable when HTTP/2 or gRPC proxying is enabled (CVE-2026-42055), both CVSS 9.2. Anyone running NGINX as an API gateway, Kubernetes ingress, or load balancer is exposed. Neither is confirmed exploited, but last month's "NGINX Rift" went from disclosure to active exploitation in days. Update to 1.31.2/1.30.3; if you can't, disable HTTP/3 (remove quic from listen directives) and remove ignore_invalid_headers off while shrinking large_client_header_buffers. Inventory ingress controllers and service-mesh sidecars, not just frontends. The Hacker News

CISA added this pre-auth data-access flaw (reachable over T3/IIOP) to KEV on June 1 with a June 22 deadline — though Oracle patched it in its July 2024 Critical Patch Update. Exploitation has climbed since mid-May, with honeypots logging payloads delivering crypto miners, Cobalt Strike beacons, and Sodinokibi ransomware. Any internet-exposed instance since mid-May should be treated as potentially compromised; patching closes the door but doesn't undo prior access. Review logs for unusual T3/IIOP inbound predating your patch. This is also the first real test of CISA's BOD 26-04, which compresses remediation for the most dangerous exploited flaws to three days. The Hacker News

Fortinet now attributes the ~74,000 leaked firewall credentials to old credentials still working and brute-forced accounts lacking MFA — not a fresh bug. CISA confirms threat actors are actively using them to reach government and private networks. There may be nothing to patch — just years of credential-hygiene debt. Reset admin/VPN passwords, kill active sessions, enable MFA, and hunt for lateral movement. The Hacker News

• If GreyNoise or Shodan shows scanning against NGINX HTTP/3 or gRPC endpoints in the next 48 hours, it means the NGINX Rift precedent holds and weaponization is days, not weeks, away.
• If Sapphire Sleet's Mastra victim list surfaces a named crypto exchange or AI-infrastructure provider within two weeks, it means the group has pivoted from individual developers to the cloud environments they build — a qualitatively different threat, mirroring the Axios pattern.
• If the Oracle WebLogic federal miss rate is significant, it means BOD 26-04's three-day clock faces its first credibility test — watch for an emergency directive or public compliance report within the week.