Daily · 2026-06-10
🔴 RoguePlanet Defender Zero-Day, 🚫 Arista EOS Unpatched, 📊 Record Patch Tuesday 206, 🐍 Shai-Hulud 471 Artifacts, 🇫🇷 Tchap Breach 650K Messages
Critical: RoguePlanet Microsoft Defender zero-day grants SYSTEM on fully patched Windows; Arista EOS actively exploited with no patch planned. Major: Record 206-vulnerability Patch Tuesday with 3 zero-days fixed; Shai-Hulud supply chain expands to 471 artifacts across 100+ npm/PyPI packages; France's Tchap government messaging breached (650K messages, 73K accounts). Also: Ivanti Sentry CVSS 10.0 RCE, Veeam Backup RCE, ServiceNow data exposure, OpenSSL High-Severity UAF found by AI, OpenClaw AI agent falls for phishing, Unit 42 cloud logging defense evasion deep dive, CISA revamps vulnerability prioritization.
RoguePlanet is the day's defining story: a race condition in Microsoft Defender that spawns a SYSTEM command prompt on fully patched Windows 10 and 11, released by the Nightmare Eclipse researcher hours after Patch Tuesday. ThreatLocker validated the exploit against current builds, Microsoft has published no CVE or advisory, and without application allowlisting there is no complete compensating control. The disclosure lands alongside a record Patch Tuesday of 206 vulnerabilities including three zero-days, a volume that outpaces most teams' ability to absorb it.
The Ivanti Sentry command injection at CVSS 10.0 matters because it is unauthenticated root code execution on a mobile gateway, and the Arista EOS tunnel bypass matters because the vendor refused to patch an actively exploited flaw that CISA added to KEV; both force operational mitigations instead of a routine update. The supply chain picture keeps widening as Shai-Hulud passes 100 packages and 471 malicious artifacts across npm and PyPI, and the Veeam flaw giving authenticated domain users remote code execution on backup servers is a direct ransomware enabler.
Watchlist: apply Patch Tuesday and Defender updates when they ship, treat Defender processes as high-value telemetry, implement the Arista configuration guidance, rebuild exposed Sentry instances, and audit backup servers joined to the domain.