Cybersecurity Radar — 2026-06-15

🔴 Critical Alerts

Microsoft June 2026 Patch Tuesday: 206 Vulnerabilities, Six Zero-Days

Microsoft released fixes for 206 vulnerabilities across its software portfolio on Patch Tuesday (June 10), including 39 Critical flaws and six publicly disclosed zero-day vulnerabilities—one already under active exploitation. This marks the largest Patch Tuesday release on record. Organizations must prioritize patching of actively exploited flaws immediately and schedule deployment of Critical updates within 7 days.

Chrome V8 Zero-Day CVE-2026-11645 Under Active Exploitation

Google released security updates addressing 74 vulnerabilities in Chrome, including CVE-2026-11645, a high-severity out-of-bounds memory access flaw in the V8 JavaScript engine. The vulnerability is being actively exploited in the wild. Users should update to the latest Chrome version immediately.

Threat Landscape

Silent Ransom Group (Luna Moth) Strikes Law Firms via Social Engineering

A string of social engineering-based ransomware attacks in late May 2026 targeted multiple law firms, including Fox Rothschild and Weil Gotshal & Manges, with the FBI attributing the campaign to the Silent Ransom Group (also tracked as Luna Moth). The attacks leveraged sophisticated social engineering tactics to gain initial access. Firms are now facing lawsuits over the breaches. Law and professional services firms should heighten email security, implement multi-factor authentication on all external-facing systems, and conduct red team exercises targeting attorney and staff communications.

Data Breaches Hit Universities and French Government (June 5–11)

A busy week of breaches saw compromises affecting multiple universities, the French government, and the file-sharing platform Flock, alongside other organizations. Breach scope and exposed data volumes vary by incident. All affected users should monitor credit reports and enable fraud alerts. Organizations should mandate password resets for all users and conduct forensic investigations to determine exposure scope.

2 sources

images.unsplash.com

images.unsplash.com

law.com

law.com

Vulnerabilities & Patches

Microsoft's 39 Critical Vulnerabilities Include RCE Flaws

Of the 206 flaws patched in June 2026, 39 are rated Critical, with multiple remote code execution (RCE) vulnerabilities affecting Windows, Exchange, and other core products. Full CVE details and CVSS scores are available in Microsoft's official security update guide. Administrators should test patches in non-production environments before broad deployment.

Check Point VPN Critical Flaw Linked to Qilin Ransomware Gang

Check Point released mitigations for a critical remote access VPN vulnerability exploited in zero-day attacks. The flaw has been linked to the Qilin ransomware gang. Organizations using Check Point Remote Access VPN or Mobile Access should apply patches immediately and review logs for exploitation indicators.

AI Accelerating Vulnerability Discovery—Patch Timelines Compressed

Artificial intelligence is fundamentally changing vulnerability research velocity. AI-driven tools now compress exploit development timelines to 24 hours from vulnerability disclosure, while average patch deployment takes 43 days—creating a dangerous 42-day exposure window. Organizations must adopt zero-trust architecture, behavioral analytics, and breach assumption mindsets. CISOs are shifting budget toward breach and attack simulation (BAS) platforms to test defenses proactively rather than rely solely on patching.

Breaches & Incidents

Multi-Organization Breach Week: Universities, Government, SaaS Platforms Affected (June 5–11)

Data breaches across the week of June 5–11 affected multiple higher education institutions, French government entities, and the Flock platform. This represents a continuation of heightened targeting of educational and government sectors. Affected institutions should prioritize notification of impacted users per GDPR and local privacy laws, engage forensic investigators, and implement enhanced access controls.

Silent Ransom Group Ransomware Campaign Against Law Firms (May 2026)

Law firms Fox Rothschild and Weil Gotshal & Manges were successfully compromised via social engineering attacks attributed to the Silent Ransom Group (Luna Moth). The incidents resulted in lawsuits against the firms for inadequate security. Professional services firms face elevated risk due to valuable intellectual property and client data. Firms should deploy email authentication (SPF/DKIM/DMARC), restrict privilege escalation, and implement EDR (Endpoint Detection & Response) solutions across all employee devices.

Industry & Policy

CISA Issues Binding Operational Directive on Ivanti Sentry Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a binding operational directive mandating federal agencies patch an actively exploited Ivanti Sentry vulnerability within three days. This underscores government urgency around critical flaw remediation and may signal sector-wide escalation. Agencies and critical infrastructure operators should treat CISA directives as immediate action items.

AI-Driven Vulnerability Discovery Reshaping Security Budgets and TTPs

The acceleration of vulnerability discovery through AI is forcing organizations to rethink security investment strategies. Traditional vulnerability management is "broken," according to security leaders, as the speed of exploit development now outpaces patching capacity. Budget allocation is shifting toward continuous breach simulation, behavioral detection, and incident response readiness. This represents a fundamental industry pivot from prevention-first to resilience-first postures.

What to Watch

• Microsoft Exchange and Windows RCE exploits: The six zero-days in Microsoft's June patch include actively exploited flaws; watch for waves of post-patch attacks leveraging unpatched systems.
• Chrome and browser exploits: V8 zero-day (CVE-2026-11645) is in active exploitation; browser update adoption rates will determine attack prevalence over the next 7–10 days.
• Social engineering campaigns targeting professional services: Silent Ransom Group's success against law firms signals expanding targeting of high-value sectors; expect similar campaigns against healthcare, finance, and consulting firms in coming weeks.

Reader Action Items

1. Immediate: Deploy Microsoft patches — Prioritize the actively exploited zero-day fixes and all 39 Critical vulnerabilities. Test in a non-production lab environment immediately, then schedule production rollout within 48 hours for critical systems.

2. Urgent: Update Chrome and enforce browser updates — Push CVE-2026-11645 patches to all user browsers via MDM/organizational policy. Block users on outdated Chrome versions from accessing sensitive web applications.

3. Strategic: Shift from patching to resilience planning — Given AI's 24-hour exploit compression, accept that zero-day exploitation is inevitable. Implement BAS (breach and attack simulation) platforms, deploy behavioral EDR, and conduct quarterly red team exercises to validate your ability to detect and respond to active intrusions faster than patch cycles can keep up.

This briefing reflects information published after 2026-06-13 from primary cybersecurity news sources, vendor advisories, and government agencies. For real-time alerts, subscribe to CISA.gov and vendor security bulletins.