🪟🔨 BlueHammer Ransomware, 🛡️ SimpleHelp Djinn Stealer, 💼 Oracle EBS 0-Day, 🏢 Nissan PeopleSoft Update, 📱 Supreme Court Geofence Ruling

The SimpleHelp exploit chain is the day's defining story. Attackers are actively abusing CVE-2026-48558, an authentication bypass in SimpleHelp's remote monitoring platform, to create technician accounts and deploy TaskWeaver plus Djinn Stealer, a previously undocumented cross-platform infostealer that targets AI developer credentials, cloud provider keys, git and package manager secrets, and cryptocurrency wallets. Roughly a thousand internet-exposed servers ran vulnerable configurations, and for MSPs an RMM compromise is effectively access to every downstream environment. SimpleHelp exploitation

The Oracle E-Business Suite flaw is the second headline. Exploitation of CVE-2026-46817, a CVSS 9.8 unauthenticated takeover in the File Transmission component, began with no public proof of concept, which points to attackers reverse-engineering Oracle's May CPU; Shadowserver tracks over 450 exposed instances. Separately, CISA confirmed ransomware gangs are exploiting BlueHammer (CVE-2026-33825), the Microsoft Defender privilege escalation patched in April, making any unpatched endpoint a lateral movement vector to SYSTEM. Oracle EBS exploitation

On the ICS side, CISA's advisory on Daktronics LED display controllers documents an unauthenticated path traversal and default admin credentials on internet-exposed highway signs and billboards, which adds up to root-level device control and content tampering; patches are available. The DFIR Report's 44-hour intrusion chain, from a Bing search for ManageEngine to Akira ransomware, is a reminder that SEO poisoning now feeds full ransomware operations.

Watchlist: SimpleHelp updates with technician session invalidation and credential rotation, the Oracle May CPU on EBS, April Patch Tuesday verification, and internet-facing controller inventories.