Daily Cybersecurity News - June 4, 2026

Cisco released fixes for a critical flaw in Unified Communications Manager that hands attackers root access on the appliance.

The bug is an SSRF flaw in the WebDialer service that lets unauthenticated attackers write arbitrary files to the OS, which can then be leveraged to escalate privileges to root. WebDialer is off by default but commonly enabled in enterprise deployments.

CVE-2026-20230 carries a CVSS base score of 8.6, though Cisco rates it Critical due to root escalation potential. Public PoC code appeared alongside the advisory.

Affects Unified CM versions 14 and 15 on on-prem appliances and certain hosted deployments. No other Cisco products are impacted.

Public PoC code is available. Cisco has not confirmed active exploitation as of the advisory.

A single machine can now crash many web servers in seconds using a new HTTP 2 Bomb denial of service attack.

Attackers chain an HPACK compression bomb with a Slowloris-style connection hold to exhaust server memory. The attack works against multiple implementations and needs no authentication.

It targets production web servers running popular HTTP/2 stacks including those in Nginx, Apache, and cloud load balancers.

Researchers demonstrated the attack taking down a test server in under 60 seconds from one modest connection.

CISA is warning that attackers are actively exploiting flaws in the Linux kernel and Android.

The bugs allow local privilege escalation on affected systems. CVSS 7.0 and CVSS 7.8 ratings apply to the two issues.

Android devices running kernels 5.10 and 5.15 are exposed, along with some Linux servers.

CISA added both vulnerabilities to its known exploited vulnerabilities catalog in April 2025.

VS Code extension flaw lets attackers steal GitHub tokens with one click.

Researcher published full details and PoC without telling Microsoft first. Vulnerability targets how extensions handle GitHub auth flows.

Affects developers using VS Code with GitHub integration across extensions and workspaces.

PoC works in under 10 seconds on default installs.

An autonomous AI tool just surfaced a two-year-old remote code execution flaw in Redis.

CVE-2026-23479 is a use-after-free in the blocking client code. An authenticated user can trigger it to run arbitrary OS commands on the host.

The bug affects Redis from version 7.2.0 (released 2023) through 8.6.2, patched in 8.6.3 on May 5, 2026. It hits self-hosted instances where attackers already hold a low-privilege account.

The AI scanned large codebases without human guidance and found it months after the original introduction.

Hackers are tricking Meta's AI support chatbot into handing over control of other users' Instagram accounts.

Attackers simply told the chatbot they owned the target account and asked it to link their email address. The bot complied and sent a verification code, enabling a full password reset.

A VPN set to the victim's home region was used to avoid triggering Instagram's automated security flags.

The angle is lazy social engineering dressed up as automation. No code exploit needed, just convincing the AI to bypass normal verification steps that humans would catch.

A public X video already demonstrates the full flow against real accounts.

Attackers are pushing a new macOS backdoor through fake Google and YouTube ads.

They deliver FlutterShell via malvertising that leads to malicious installers. The campaign follows earlier JSCoreRunner (aka FileRipple) activity.

The shift to macOS ads shows expansion beyond Windows targets they hit before.

Operation FlutterBridge is the name researchers gave this latest stage.