Daily · 2026-06-11
Ivanti Sentry exploited, Exchange zero-day patched, ShinyHunters hits 100+ orgs, Miasma source leaked, JDY expands, BOD 26-04, Langflow exploited
Ivanti Sentry CVE-2026-10520 exploited within hours of patch. Exchange Server zero-day CVE-2026-42897 actively exploited. ShinyHunters hits 100+ PeopleSoft orgs including Nottingham University (454K affected). Miasma worm source code open-sourced with destructive dead-man switch. CISA BOD 26-04 mandates 3-day patch cadence. Langflow CVE-2026-5027 exploited in attacks on 7K exposed instances. Apply patches urgently for Ivanti, Exchange, Langflow, and UpdraftPlus.
The Ivanti Sentry saga is the day's defining story: patched Tuesday, exploited Wednesday. The CVSS 10.0 command injection in the secure mobile gateway was weaponized within 24 hours of the patch release, and Shadowserver found that attackers had backdoored virtually every reachable exposed instance. For internet-facing appliances the disclosure date is the exploitation date, and unpatched instances are best treated as compromised and rebuilt from known-good firmware.
Microsoft's emergency updates for the Exchange Server OWA zero-day close out CVE-2026-42897, an actively exploited spoofing flaw in Outlook Web Access that CISA has tracked since mid-May, while the ShinyHunters PeopleSoft campaign passed 100 victim organizations and the University of Nottingham confirmed 454,600 students exposed. The Miasma worm's source code is now public, with a dead man switch that deletes home directories when stolen tokens are revoked, and GitHub's npm v12 plan to block dependency install scripts by default is a direct answer to campaigns like it.
Watchlist: rebuild exposed Sentry instances, patch Exchange before the federal deadline, treat PeopleSoft endpoints as actively targeted, and start planning the npm v12 migration.