Daily · 2026-06-16
🔴 Atomic Arch 1,500+ AUR, FortiSandbox Exploited, 🎯 UNC6508 REDCap, DragonForce Teams C2, ⚠️ Vertex AI RCE, Cisco SD-WAN ZD
Atomic Arch supply-chain attack expands to 1,500+ AUR packages; FortiSandbox critical flaws now actively exploited; CISA adds LiteSpeed cPanel plugin to KEV under new BOD 26-04; DragonForce abuses Microsoft Teams TURN relays for stealth C2; Google exposes UNC6508 Chinese espionage in medical networks since 2023; Unit 42 discloses Vertex AI SDK bucket squatting RCE; Cisco patches fifth SD-WAN Manager zero-day.
The LiteSpeed cPanel plugin zero-day is the day's defining story. CVE-2026-48172 (CVSS 10.0) lets any authenticated cPanel user execute arbitrary scripts as root on shared hosting through the lsws.redisAble JSON-API endpoint, and CISA has confirmed active exploitation. CISA also added the related symlink flaw CVE-2026-54420 to its KEV catalog as the first vulnerability under the BOD 26-04 three-day remediation timeline, so unpatched hosting providers face both mass exploitation and a fast federal compliance clock. The LiteSpeed cPanel zero-day
The OptinMonster CDN supply-chain attack is the second headline. Attackers compromised Awesome Motive's CDN, modified served JavaScript, and created rogue WordPress administrator accounts, exposing more than a million sites; audit those sites for rogue admins and injected scripts. Separately, three pre-auth FortiSandbox RCEs (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) are under active exploitation, and Splunk Enterprise disclosed a pre-auth RCE (CVE-2026-20253, CVSS 9.8) in the platform most SOCs depend on.
Google's UNC6508 disclosure shows how long a disciplined espionage operation can hide: the China-linked group compromised REDCap servers at a North American medical research university in September 2023 and went undetected through November 2025, abusing content compliance rules to auto-BCC sensitive email to an attacker account. Also notable are the Quarry PhaaS behind hundreds of IRS and SSA campaigns and a SimpleHelp flaw allowing unauthenticated technician account creation.
Watchlist: patch LiteSpeed cPanel plugins and Splunk immediately, audit WordPress sites for rogue administrators, verify FortiSandbox versions, and review enterprise email rules for unexpected BCC behavior.