Daily · 2026-06-17
🛡️ RoguePlanet patch in progress, 🎯 Joomla/LiteSpeed exploited, 🐍 Arista no-patch tunnel bug, 📱 Rokarolla Android malware, 💣 ShinyHunters Kodak breach, 🔥 Oracle 245 patches
Microsoft works on RoguePlanet Defender patch (CVE-2026-50656); Joomla, LiteSpeed flaws exploited and added to CISA KEV; Arista EOS tunnel bug (CVE-2026-7473) has no fix and evades scanners; Rokarolla Android trojan targets 217 banking apps; ShinyHunters claims Kodak breach with 2.2M records; Oracle ships 245 patches in second monthly CSPU. Iran-linked Handala group breaches Cal Water. Two extortion groups separately hit Novo Nordisk for $50M and $25M — neither paid.
The Arista EOS tunnel validation bypass is the day's defining story because it couples active exploitation with no available fix. CVE-2026-7473 lets attackers bypass network segmentation by sending unconfigured tunnel protocol traffic to a decapsulation IP, which the switch unwraps and forwards regardless. Arista plans no software patch, and because the flaw lives entirely in configuration, version-based scanners will miss it. The Arista EOS tunnel bypass needs configuration-level remediation and a manual inventory of tunnel endpoints.
Microsoft assigned CVE-2026-50656 to the RoguePlanet Defender race condition that spawns a SYSTEM command prompt on fully patched Windows, a week after the exploit was published; the RoguePlanet Defender flaw makes Defender's process tree a monitoring point until the engine update lands. Exploitation of the Joomla JCE Pro (CVE-2026-48907) and LiteSpeed cPanel (CVE-2026-54420) flaws continues, both on CISA's KEV; Oracle's second monthly CPU delivers 245 patches, over 100 remotely exploitable without authentication.
The rest of the day is extortion. Kodak confirmed a breach ShinyHunters claims covers 2.2 million records; Novo Nordisk was breached by two separate groups demanding $50 million and $25 million, neither paid; and Handala leaked 5 GB from California Water Service. The Rokarolla Android trojan overlays fake logins for 217 banking and crypto apps, fifteen malicious JetBrains plugins steal AI API keys, and honeypot logs captured attackers using Claude and Codex during intrusions.
Watchlist: inventory tunnel decapsulation configurations, apply Oracle and browser patches, confirm Defender engine versions, and monitor cPanel and Joomla deployments for KEV indicators.