Daily Cybersecurity News - June 1, 2026

Windows Netlogon just got a critical remote code execution bug that attackers are already using in the wild.

CVE-2025-26633 lets remote attackers run code on domain controllers by sending crafted RPC requests over the Netlogon protocol. CVSS 9.0, actively exploited after the April patch.

Affects Windows Server 2016 through 2025 domain controllers. Any environment still running unpatched DCs faces direct remote takeover risk.

Belgium's national cyber authority issued the active exploitation warning on Friday.

WordPress sites running WP Maps Pro are getting hit with unauthenticated admin account creation.

The flaw sits in the plugin's user registration flow. Attackers send a crafted request that bypasses checks and adds a new admin user. Public PoC available.

Affects WP Maps Pro versions up to and including 6.1.0 (patched in 6.1.1) on any WordPress install. Targets self-hosted sites, shared hosting, and managed WordPress environments alike.

Attackers have already created admin accounts on multiple live sites.

A 19-year-old flaw in the Linux kernel gives low-privileged users root access on vulnerable systems.

The CIFSwitch issue lives in the kernel's handling of certain switch operations. Low-privileged users can trigger it for privilege escalation. Public PoC available.

It affects kernels dating back nearly two decades across major distributions and container setups.

PoC code was released alongside the disclosure.

Palo Alto Networks PAN-OS has an authentication bypass that attackers used for weeks after disclosure.

CVE-2026-0257 lets unauthenticated users reach management interfaces on exposed firewalls. Exploitation started four days after the public advisory.

Affects PAN-OS devices reachable from the internet. Firewalls in perimeter or management roles face the highest risk.

Attackers maintained access for weeks before wider detection.

Websites can now fingerprint your SSD from JavaScript alone.

The FROST technique measures tiny timing differences in browser storage writes. It detects drive model and firmware without permissions or user interaction. Researchers showed it works across major browsers on Windows, macOS, and Linux.

Hits any site that loads JavaScript on consumer laptops and desktops with common NVMe and SATA drives. No special hardware or elevated access needed.

Tests distinguished 40 different SSD models with over 90 percent accuracy in controlled runs.

A new supply chain campaign is poisoning RedHat npm packages with malicious code that hits developers pulling dependencies.

Attackers published tainted versions of popular packages. The malware, called Mini Shai Hulud, runs on install and steals credentials and tokens from the build environment.

The move is familiar for npm abuse but stands out for targeting RedHat's ecosystem specifically, where package trust is usually higher. Overlap with prior npm poisoning clusters is unclear.

Mini Shai Hulud is open sourced in the Wiz report for direct analysis.

FSB-linked Gamaredon is hiding a worm inside NTFS alternate data streams to spy on Ukrainian targets.

The worm spreads via shared folders and USB drives. It stays fileless by storing its payload in the extra data streams Windows keeps on files. Targets are Ukrainian government and military networks.

The trick is old-school tradecraft. Gamaredon has used similar hiding methods for years. This version just adds worm behavior to the mix.

They have run this operation against Ukraine since at least 2014.