Cybersecurity Radar — 2026-06-14

---

🔴 Critical Alerts

Microsoft June 2026 Patch Tuesday: 206 Vulnerabilities Including 3 Zero-Days and Wormable RCE

Microsoft released fixes for 206 vulnerabilities on June 10, 2026, marking the largest Patch Tuesday release in program history. The update includes 39 critical-severity flaws, three publicly disclosed zero-day vulnerabilities, and CVE-2026-45657—a wormable Windows Kernel remote code execution flaw with CVSS score 9.8. At least one zero-day is actively exploited in attacks. Organizations should prioritize patching this kernel RCE and other critical flaws immediately.

Check Point VPN Zero-Day Actively Exploited by Qilin Ransomware Gang

Check Point has confirmed that a critical remote access VPN vulnerability affecting their Remote Access VPN and Mobile Access deployments is being actively exploited in zero-day attacks. The company has released security updates and attributed the attacks to Qilin, a Russian-speaking ransomware gang. This VPN flaw serves as an entry point for ransomware deployment across targeted organizations.

CISA Orders Agencies to Patch Ivanti Sentry Flaw Within 3 Days

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a binding operational directive requiring federal agencies to patch an actively exploited Ivanti Sentry vulnerability within three business days. This represents an emergency-level response to an in-the-wild exploitation campaign.

---

Threat Landscape

Chrome V8 Zero-Day CVE-2026-11645 Exploited in Active Attacks

Google released security updates for 74 Chrome vulnerabilities on June 9, 2026, including CVE-2026-11645, a high-severity V8 JavaScript engine out-of-bounds memory access flaw that is being actively exploited in the wild. Users should update Chrome immediately to the patched version.

Windows Defender RoguePlanet Zero-Day Grants SYSTEM Privileges

Security researcher Nightmare Eclipse has publicly released a proof-of-concept exploit named RoguePlanet targeting a race condition vulnerability in Microsoft Windows Defender. The zero-day allows local privilege escalation to SYSTEM level, enabling attackers to gain full system control on vulnerable machines. Patch immediately or disable Windows Defender until a fix is available.

AI Coding Agents Under Attack: New Class of Exploits Discovered

Cybersecurity researchers have identified a new attack class that tricks AI-powered coding assistants into executing arbitrary code on developer machines. These attacks leverage the trust relationship between developers and AI tools, potentially compromising source code repositories and development environments at scale.

OpenSSL Patches 18 Vulnerabilities, Many Found by AI

OpenSSL released updates addressing 18 vulnerabilities, including many discovered using AI-driven vulnerability research techniques. This signals a shift toward automated security analysis in cryptographic library maintenance.

Oracle PeopleSoft CVE-2026-35273 Exploited; Zero-Day Status Unclear

Oracle released mitigations for CVE-2026-35273 affecting PeopleSoft following reports of exploitation by the ShinyHunters group. The company has not confirmed whether this is a zero-day vulnerability.

---

Vulnerabilities & Patches

June 2026 Patch Tuesday Reaches Historic 198–208 CVEs Across Vendors

Multiple security vendors confirm Microsoft's June Patch Tuesday as the largest release ever, with between 198 and 208 vulnerabilities requiring customer action. N-able reports 198 CVEs (32 critical, 166 important), while other sources cite figures up to 208. Adobe and other vendors also released significant updates. The enormous volume reflects AI-assisted vulnerability discovery accelerating the pace of flaw detection.

---

Breaches & Incidents

Silent Ransom Group (Luna Moth) Hits Law Firms via Social Engineering

Fox Rothschild and Weil Gotshal law firms suffered data breaches as part of a coordinated social engineering campaign targeting law firms in late May 2026. The FBI has attributed the attacks to a hacker group known as Silent Ransom Group or Luna Moth, which uses phone-based social engineering to trick employees into granting VPN access.

---

Industry & Policy

AI Acceleration Collapses Exploit Timeline to 24 Hours; Patching Remains 43 Days Behind

Industry analysis reveals that AI has compressed the time from vulnerability disclosure to working exploit down to just 24 hours in 2026, while the average time-to-patch across organizations remains 43 days. This gap is driving CISOs to adopt breach and attack simulation (BAS) platforms and shift budget from traditional vulnerability management to adversary simulation testing.

---

What to Watch

• Microsoft wormable kernel RCE (CVE-2026-45657, CVSS 9.8): Patch immediately — this flaw can spread laterally without user interaction and has no known active exploits yet, but the window is closing rapidly given the record patch volume creating noise for defenders.
• Qilin ransomware VPN campaign escalation: Organizations using Check Point VPN or similar remote access solutions should expect follow-up reconnaissance and lateral movement; monitor for unusual VPN login patterns and privileged account activity.
• AI-driven vulnerability discovery acceleration: The shift to AI-assisted flaw detection will further compress the exploit timeline; organizations must shift from reactive patching to proactive breach simulation and continuous vulnerability management.

---

Reader Action Items

1. Prioritize Microsoft Patch Tuesday immediately: Update Windows Kernel (CVE-2026-45657), Windows Defender (RoguePlanet), and all Office products within 48 hours. Use Windows Update for servers or WSUS for enterprise deployments. Test in non-production first due to the record volume of updates.

2. Verify and patch VPN and remote access infrastructure: Check Point customers must apply VPN security updates now. For all organizations: review VPN access logs for anomalies, enforce multi-factor authentication on all remote access, and disable legacy authentication protocols (NTLM, Basic Auth).

3. Update Chrome, OpenSSL, and PeopleSoft immediately: Chrome V8 (CVE-2026-11645) is actively exploited in the wild. OpenSSL and Oracle PeopleSoft patches are available. Prioritize in this order: Chrome browsers, VPN appliances, web servers, then business applications. Allocate 72 hours for completion across production and non-critical systems.