Daily · 2026-06-02
Android 0‑day exploited, WebLogic CISA KEV, Instagram AI bot defacement, Dashlane vault theft, TrapDoor supply chain, PHANTOMPULSE blockchain RAT
97 articles ingested. Critical: Android Framework zero-day (CVE-2025-48595) actively exploited — patch Android 14–16 devices immediately. CISA adds Oracle WebLogic CVE-2024-21182 to KEV. Instagram Meta AI exploit escalates — Obama White House, Space Force accounts defaced. Dashlane confirms <20 encrypted vaults downloaded. Major supply chain attacks: TrapDoor (34 packages across npm/PyPI/Crates.io with AI context poisoning) and Red Hat npm Miasma (96 backdoored versions, 309 GitHub repos). PHANTOMPULSE RAT analysis reveals blockchain C2 on Ethereum/Base/Optimism and hardware breakpoint defense evasion. Gamaredon fileless campaign uses NTFS ADS and cloud dead-drops against Ukraine. Screening Serpens deploys 6 new RAT variants with AppDomainManager EDR bypass. HP Poly VoIP phones (CVE-2026-0826), Magento cache plugin (CVE-2026-45247), and StrongDM (CVE-2026-4387) all have critical patches available.
The actively exploited Android zero-day is the day's defining story. CVE-2025-48595, an integer overflow in the Android Framework, yields local privilege escalation to SYSTEM with zero user interaction, and Google's June bulletin patches 30+ framework CVEs across Android 14 through 16. The same bulletin covers an ADB TLS authentication bypass with public PoCs. Hundreds of millions of devices are in scope, and the security patch level that matters is 2026-06-05.
The supply chain thread is the day's second theme. An attacker compromised a Red Hat employee's GitHub account and backdoored 32 packages through OIDC trusted publishing, infecting 309 repositories with a Miasma variant that steals CI secrets and publishing tokens. TrapDoor, a cross-ecosystem campaign, planted 34 packages across npm, PyPI, and Crates.io, including AI context poisoning that injects instructions into Cursor and Claude Code configuration files.
North Korean and Iranian operations continue to iterate. Elastic's PHANTOMPULSE analysis shows a RAT that derives its C2 from blockchain transactions and evades memory scanners with hardware breakpoints; defenders can redirect the implant fleet by posting a crafted transaction to the same ledger. Gamaredon's fileless GammaWorm campaign against Ukraine and Screening Serpens' six new RAT variants with AppDomainManager hijacking round out an active APT picture, and CISA added Oracle WebLogic CVE-2024-21182 to KEV for unauthenticated T3/IIOP exploitation.
Watchlist: Android patch levels, npm token rotation and OIDC auditing, blockchain-derived C2 detection, and WebLogic T3/IIOP exposure.