👉 Takeaway

If PeopleSoft is in your stack, apply Oracle’s interim mitigations immediately. Review for indicators of compromise going back to May 27. Do not wait for a patch before acting on this.

 

Zero-day / Cybercrime

Operation Ghost Hook dismantled “Outsider,” a Chinese phishing-as-a-service network that sold Telegram bot subscriptions for $88 per week. Fake package delivery notices, fake toll violations, fake parking tickets. AI-generated custom lures per target. By shutdown: 3.9 million stolen credit cards, 55 countries, $1.9 billion in documented losses. FBI, Google, and Lumen seized domains, the Shopify storefront, and roughly $100K in crypto.

→ The $88/week price point is the detail to sit with. This was not sophisticated nation-state infrastructure. It was a franchise.

Vulnerability

CVE-2026-20253 lets an unauthenticated attacker overwrite a Python script via a PostgreSQL sidecar endpoint. Splunk then repeatedly executes that script as the service account. CVSS 9.8. Affected versions: Splunk Enterprise 10.0.0-10.0.6 and 10.2.0-10.2.3. No active exploitation confirmed yet, but the full exploit chain is public. Patched versions 10.0.7 and 10.2.4 are available now. Splunk Cloud is not affected.

→ “No active exploitation yet” and “full exploit details are public” rarely share a timeline for long. Patch now.

Espionage

Denis Nikolayevich Obrezko faces charges for conspiracy to commit unauthorized computer access as part of Void Blizzard (aka Laundry Bear), a Kremlin-linked group targeting US government agencies, defense contractors, and critical infrastructure. The method: stolen session tokens routed through US commercial proxy services to mask origin. The Dutch National Police confirmed their force was infiltrated by the group in September 2024.

→ Void Blizzard’s proxy routing through legitimate US services is a reminder that traffic origin is not a reliable indicator by itself.

 

AI misuse

Varonis researchers disclosed CVE-2026-42824, a chained exploit they named “SearchLeak” that converted Microsoft 365 Copilot into a silent exfiltration tool. Three links in the chain: parameter injection into Copilot prompts, an HTML rendering race condition, and a Bing SSRF CSP bypass. The victim clicks one crafted link. Copilot silently pulls their email, OneDrive files, and SharePoint documents and ships the contents to an attacker endpoint via Bing. The victim sees nothing. Patched in early June 2026.

→ Copilot is not the only example. Any AI assistant with document access and browser integration is a candidate for this attack class.

AI enforcement

CFAKE.com and SOCFAKE.com are down. The two sites had 14,000 identified victims, 300,000 images, 7,000 videos, 200,000 user accounts, and 4 million monthly views. French national Cyrille B., 47, was arrested in Nice and faces trial July 7 with potential penalties of 7 years and €500,000. This is the first major enforcement action under the TAKE IT DOWN Act, the new US federal law specifically criminalizing non-consensual deepfake pornography.

→ The law named the crime. Whether enforcement can scale to the volume is a different question.

 

Surveillance

At a Madison County, NC Board of Commissioners meeting, Chairman Michael Garrison refused to allow individual residents opposing Flock Safety license plate readers to testify. They could send one spokesperson or nothing. The county sheriff had been running Flock since at least March, logging 1,200-plus database searches in 60 days. The board’s position on oversight: “We don’t control the sheriff’s budget. We give him X dollars.” Citizens had no formal avenue left.

→ The Flock contract playbook: sign first, hold the meeting after, answer questions never.

Data leak

Flock Safety’s system was inadvertently indexing law enforcement license plate search queries, including the officers’ stated reasons for each search, through public search engines. Joseph Cox at 404Media confirmed it is not a theoretical risk. Sensitive surveillance data in public search results is a chain-of-custody failure with real implications for ongoing investigations and officer safety.

→ Two Flock stories in one week is a pattern. Watch this company.

Regulation

California AB 2564 would prohibit businesses from offering different prices based on personal data surveillance. The EFF and Consumer Reports are co-sponsoring. The documented targets: Princeton Review’s racial pricing algorithm, Uber and Lyft neighborhood-based fares, Tinder’s age-based subscription tiers. The bill passed the California Assembly and is in the California State Senate. Enforcement via AG prosecution and private right of action.

→ California passing this would set de facto national standards the way CCPA did. Senate vote is the one to watch.

 

Practical play

CISA BOD 26-04: A Four-Factor Framework for Deciding Which Vulnerabilities Get Fixed in 3 Days

Most patch programs run on “CVSS score = urgency.” CISA’s Binding Operational Directive 26-04 gives defenders a more practical triage model. Four factors determine how fast you must act: (1) is the asset internet-facing, (2) is the CVE in the KEV catalog, (3) is it auto-exploitable without user interaction, (4) how much system control does exploitation grant. Vulnerabilities that hit all four factors get a 3-day remediation window. Supplementary signals: EPSS probability scores, Global CVE data, and NIST’s new LEV metric. One known gap: the framework is oriented around internet-facing assets, so internal network vulnerabilities are not in scope.

→ Start with KEV-listed CVEs on internet-facing systems. If a vuln hits all four factors, you have 3 days — not 30.

Further reading: HelpNetSecurity

 

👉 Takeaway

Identity agencies are high-value targets precisely because their data is foundational. Compromise a passport agency and you have undermined the root of trust for everyone in the registry. Age is not a security control.