Daily · 2026-06-12
🚨 Ivanti CVE-2026-10520 KEV, 🔴 Oracle PeopleSoft ShinyHunters, 💰 AudiA6 Dismantled, 🪟 GreatXML BitLocker Bypass, 🤖 LangGraph RCE Chain, 🇰🇷 Coupang $409M Fine
CISA adds Ivanti Sentry CVE-2026-10520 to KEV under first BOD 26-04 3-day deadline; Oracle releases PeopleSoft mitigations as Mandiant confirms ShinyHunters targeting 100+ orgs; AudiA6 crypto laundering service dismantled in 11-country operation; GreatXML becomes 8th Nightmare Eclipse zero-day targeting BitLocker; LangGraph checkpointer RCE chain disclosed; Coupang hit with record $409M fine in South Korea. Patch Ivanti Sentry immediately, apply Oracle PeopleSoft mitigations, audit OIDC trust policies.
Oracle's confirmation that the PeopleSoft zero-day is the engine of the ShinyHunters data theft campaign makes it the day's defining story. CVE-2026-35273 is unauthenticated remote code execution in PeopleTools, exploited since late May across more than 100 organizations, 68 percent of them US institutions of higher education, and Oracle has shipped mitigations rather than a patch. With the entry vector in PSEMHUB endpoints and staging through MeshCentral agents, university IT teams are the front line and should treat any exposed PeopleSoft instance as compromised.
The Ivanti Sentry flaw became the first vulnerability subject to CISA's BOD 26-04 three-day deadline, formalizing risk-based federal patching after attackers backdoored exposed gateways within a day of disclosure. Law enforcement dismantled AudiA6, a cryptocurrency laundering service that moved $380 million for ransomware groups, and South Korea fined Coupang a record $409 million over a breach affecting 37.55 million customers. Two AI-agent findings stand out: a chained SQL injection to msgpack deserialization in LangGraph's checkpointer yields unauthenticated RCE on self-hosted agent persistence, and GreatXML, the eighth Nightmare Eclipse release, turns a Defender offline scan into a BitLocker backdoor with no patch.
Watchlist: block external access to PSEMHUB, rebuild Ivanti Sentry instances, patch LangGraph checkpointers, and verify the integrity of recovery partitions on high-value laptops.