Daily Cybersecurity News - June 3, 2026

CISA just flagged active exploitation of two Linux kernel flaws that also hit Android devices.

CVE-2024-53150 and CVE-2024-53197 are out-of-bounds vulnerabilities in the Linux kernel's ALSA USB-audio driver that allow local attackers to escalate privileges. CVSS 7.8 and CVSS 7.0, actively exploited in the wild.

Affects kernels from 6.1 onward used in Android and various Linux distributions. Hits phones, servers, and embedded systems running those versions.

CISA added both to the KEV catalog in April 2025.

A researcher dropped exploit code for a VS Code zero day that steals GitHub tokens with one click.

The flaw lives in VS Code's webview message-passing system. Attackers can trigger silent installation of a malicious extension that extracts a GitHub OAuth token passed to github.dev, the browser-based VS Code editor. Desktop VS Code users are exposed primarily through malicious repositories rather than simple link clicks.

It affects users running recent VS Code versions with GitHub integration enabled. Anyone browsing links inside the editor or opening shared workspaces is exposed.

Public PoC was published the same day the researcher disclosed the issue.

Hackers are exploiting a flaw in the Kirki WordPress plugin to seize admin accounts without credentials.

CVE-2026-8206 lets unauthenticated users escalate privileges and hijack any account. CVSS 9.8, actively exploited in the wild.

Affects Kirki versions 6.0.0 through 6.0.6, patched in version 6.0.7.

Wordfence blocked over 222 exploitation attempts in the first 24 hours after disclosure.

Default HTTP/2 setups on major web servers let attackers knock them offline fast.

The attack chains a compression bomb with Slowloris-style connection holding. It exploits the default configuration without needing authentication or special privileges.

Major web servers are exposed under their standard HTTP/2 defaults. Any site or service running those configs can be hit.

The flaw (CVE-2026-49975) was discovered by OpenAI's Codex, which chained two attack techniques that had been known to humans for nearly a decade but never combined this way against these server stacks.

A threat actor is running an AI-built ransomware toolkit that automates Active Directory discovery and EDR evasion.

The toolkit scans environments for domain controllers, maps permissions, and generates code that blends with normal traffic. It targets Windows networks in multiple sectors.

This approach reuses common ransomware steps but adds AI to speed up reconnaissance. The actor appears to be a criminal group rather than a state cluster.

The toolkit was detected in a customer environment by Sophos and reported on June 2, 2026.

DriveSurge operators are hijacking thousands of legitimate sites to push ClickFix fake update lures at scale.

They run a traffic distribution system that silently redirects visitors from trusted domains straight into malware delivery pages. The campaign focuses on broad reach rather than any single sector or geography.

The setup reuses familiar IAB tradecraft but scales it through widespread site compromises instead of building new infrastructure from scratch.

The TDS has already touched more than 3,000 compromised sites across multiple campaigns.

Researchers built a proof of concept AI worm that picks its own exploits instead of following a script.

This stays a lab demo for now. No real-world incidents reported yet, and the work focuses on showing what reasoning models can do rather than claiming immediate danger.

The researchers tested it against simulated corporate environments with mixed success.