Cybersecurity Radar — 2026-06-04

---

🔴 Critical Alerts

Google Android June 2026 Security Patch — CVE-2025-48595 Zero-Day in Active Exploitation

Google has released the June 2026 Android security bulletin addressing 124 security vulnerabilities, including one zero-day flaw (CVE-2025-48595) that is actively being exploited in targeted attacks. The vulnerability is an Android Framework elevation of privilege issue affecting Android 14, 15, and 16. Devices running these versions should prioritize immediate patching to mitigate active exploitation risk.

Recommended action: Apply Google's June 2026 Android security patch immediately to all affected devices. Check device Settings > System > System Update for availability and install without delay.

Device Code Phishing Surge — 37x Spike in Criminal Adoption

BleepingComputer reported on June 2, 2026, that device code phishing has escalated from an espionage-grade technique to a mainstream criminal commodity. The threat has seen an unprecedented 37x spike in detections, with 18 distinct phishing kits now available and every major Account-in-the-Middle (AiTM) vendor adding device code phishing capabilities to their platforms. This represents a critical shift in attack democratization, lowering barriers for non-sophisticated threat actors to conduct credential harvesting campaigns.

Recommended action: Organizations should implement conditional access policies that flag or block legacy authentication methods. End users should be trained to recognize device code phishing prompts and never share device codes via email or unsolicited messages.

---

Threat Landscape

SideCopy APT Targets Afghanistan's Ministry of Finance with Xeno RAT

On June 2, 2026, cybersecurity researchers disclosed details of a spear-phishing campaign attributed to the Pakistan-aligned SideCopy threat group. The campaign targets Afghanistan's Ministry of Finance using an open-source remote access trojan (Xeno RAT). The attack demonstrates continued state-aligned interest in South Asian government infrastructure and financial systems. Typical indicators include weaponized documents delivered via targeted emails with government impersonation themes.

Qilin Ransomware Claims Attack on German Political Party Die Linke

In March 2026, the Russian-speaking ransomware group Qilin claimed responsibility for a cyberattack on Die Linke, a German democratic socialist political party, threatening to publish stolen data unless ransom is paid. This incident underscores the continued targeting of political organizations and demonstrates ransomware operators' willingness to engage in extortion involving sensitive political data.

---

Vulnerabilities & Patches

Palo Alto Networks CVE-2026-0257 Under Active Exploitation

CyberScoop reported on June 2, 2026, that attackers are actively exploiting CVE-2026-0257, a Palo Alto Networks vulnerability that initially received low severity ratings but has escalated to urgent status. The gap between initial assessment and active exploitation highlights how quickly seemingly mild vulnerabilities can become critical threats when weaponized.

Recommended action: Organizations using Palo Alto Networks products should immediately check vendor advisories for CVE-2026-0257 and apply available patches. Implement network segmentation to isolate affected systems until patching is complete.

Microsoft Reaches Olive Branch with Security Researchers Over Zero-Day Disclosure

After days of public criticism from the security community regarding Microsoft's handling of zero-day vulnerability disclosure and researcher relations, Redmond has dialed back its rhetoric and stated that vulnerability hunters are not subject to legal threat under the company's policies. This de-escalation signals potential policy shifts in how the industry's largest vendor approaches coordinated vulnerability disclosure.

---

Breaches & Incidents

Instructure Canvas Attack — ShinyHunters' Eight-Month Campaign Pattern Emerges

Krebs on Security reported that May 2026's major breach of Instructure (Canvas learning management platform) represents the escalation of a planned attack pattern. ShinyHunters had been systematically working against Instructure's environment for at least eight months prior, with an earlier incident at the University of Pennsylvania in late 2025 now understood as the first phase of a coordinated multi-stage compromise.

---

Industry & Policy

Two Competing Vulnerability Assessment Reports Highlight Root Cause Debate

SecurityWeek reported on June 2, 2026, that two new industry reports offer competing explanations for cybersecurity's growing crisis: one emphasizes inadequate visibility into exploitable vulnerabilities, while the other points to poor operational control of existing defenses. As AI accelerates cyberattack velocity, the debate over whether defenders lack inventory or execution capability carries significant implications for resource allocation and defensive strategy.

---

What to Watch

• Google Pixel and Samsung Android devices: Monitor rollout status of June 2026 security patch for CVE-2025-48595; organizations managing large device fleets should prioritize deployment verification by end of week.
• Device code phishing expansion: Watch for enterprise email filters being overwhelmed by phishing kits now that AiTM vendors have commoditized this technique—consider deploying behavioral detection for anomalous authentication flows.
• Microsoft zero-day disclosure policy: Track upcoming Microsoft guidelines on researcher engagement and vulnerability disclosure timelines—policy clarity could reshape coordinated disclosure norms across the industry.

---

Reader Action Items

1. Immediate (Today): Apply Google's June 2026 Android security patch to all company-owned and BYOD devices running Android 14, 15, or 16. Verify patch deployment status in your mobile device management (MDM) console.

2. This Week: Conduct device code phishing tabletop exercise with your security awareness team and email administrators. Review your conditional access policies to ensure legacy authentication is blocked or flagged for review.

3. This Month: Review your zero-day vulnerability disclosure contacts with major vendors (Microsoft, Google, Apple, Palo Alto Networks) and document their current SLA expectations for coordinated disclosure so your security team is aligned when the next critical zero-day emerges.

Sources:

• The Hacker News
• CSIS Significant Cyber Incidents
• Krebs on Security
• SOCRadar