Daily · 2026-06-04
🚨Cisco UC PoC, 🐧Linux Container KEV, 🎯TA4922 Atlas RAT, 💻Lazarus npm, 📊Stock Exchange Espionage, 🤖AI Skill Scanner Bypass
Cisco Unified CM critical SSRF with public PoC exploit code — patch now; CISA adds 3-year-old Linux kernel container escape (CVE-2022-0492) to KEV with active exploitation confirmed; TA4922 Chinese hacker group deploys Atlas RAT across Europe with more campaigns than any other tracked actor; Lazarus Group runs npm brandjacking campaign with persistent Node.js backdoors; Stock exchange executive's mailbox stolen for 5 months in tightly focused espionage operation; Trail of Bits demonstrates all major AI skill scanners can be trivially bypassed — structural supply chain risk for agentic AI.
CISA's addition of CVE-2022-0492 to the KEV catalog is the day's defining story. The four-year-old Linux kernel flaw enables container escape through the cgroups v1 release_agent feature, active exploitation was confirmed this week, and every Kubernetes or Docker environment on an older kernel is in scope. Federal agencies face a June 5 remediation deadline, and cgroups v2 is not affected.
The second headline is a 150-day espionage operation against a senior executive at a major global stock exchange. Symantec and Carbon Black detail incremental mailbox theft with an Aspose-based infostealer run at two-to-four-week intervals, exfiltration through Dropbox and OneDrive, and persistence disguised as Adobe and Lenovo services. The initial access vector remains unknown, which keeps the risk open for the exchange and anyone watching the tradecraft.
Mass exploitation continues on the web. Everest Forms Pro's unauthenticated RCE drew 29,300+ blocked attacks with a persistent admin-account payload, and Cisco's Unified CM SSRF with a public PoC needs WebDialer disabled or patched. Trail of Bits showed that all three major AI skill scanners can be trivially bypassed, and four credential-harvesting campaigns hit open source ecosystems in two weeks. Microsoft's Secure Boot certificates start expiring June 27, and devices left on the 2011 chain will silently lose the ability to update DBX revocation lists.
Watchlist: cgroup v1 patching, Everest Forms Pro updates, Secure Boot certificate migration, and AI skill procurement.