Daily Cybersecurity News - June 12, 2026

CISA told federal agencies to patch an Ivanti Sentry flaw that attackers are already using.

The directive gives three days to fix the issue. It is actively exploited and covered under the new binding operational order.

Only US government systems must comply. Private organizations can ignore the deadline.

Agencies have until Sunday to complete the work.

Oracle patched a zero-day in PeopleSoft that attackers used to steal data without logging in.

CVE-2026-35273 lets unauthenticated attackers run code remotely. The flaw was actively exploited by ShinyHunters in data theft campaigns. Oracle released mitigations after public reports surfaced.

Affects multiple PeopleSoft Suite deployments running vulnerable versions. Organizations hosting the software on exposed internet servers faced the highest risk during the active exploitation window.

Public disclosure followed reports that ShinyHunters hit roughly 300 PeopleSoft instances across 100+ organizations, mostly universities.

Attackers can make OpenClaw the self-hosted AI agent run malicious code or spill secrets just by feeding it normal-looking inputs.

Imperva hid commands inside shared contacts, vCards, and location pins. A second team, Varonis, used a plain phishing email to talk the agent into forwarding cloud keys and a customer export. The agent follows the embedded instructions without checking the source.

Anyone running OpenClaw on their own servers needs to watch what data sources feed into it. Shared contacts and location feeds now count as attack surfaces.

The two research teams released working demos within days of each other.

Windows BitLocker just got a recovery partition bypass that drops attackers into a SYSTEM shell on the encrypted volume, no key needed.

The GreatXML technique abuses the WinRE state left behind by Microsoft Defender Offline Scan. An attacker with physical access plants a crafted unattend.xml on the recovery partition, reboots into WinRE, and lands an unrestricted shell on the BitLocker drive.

Researchers found the flaw by accident while testing Microsoft Defender. It took four hours to discover.

Affects standard Windows 10 and 11 setups with BitLocker enabled and a separate recovery partition. No special privileges needed beyond physical or administrative access to the drive.

Same researcher released a Microsoft Defender exploit the day before.

WatchTowr just dropped a technical breakdown and PoC for an actively exploited auth bypass in Check Point Remote Access VPN.

CVE-2026-50751 scores CVSS 9.3. It lives in the deprecated IKEv1 certificate validation logic and lets unauthenticated attackers establish VPN sessions without credentials.

Affects Security Gateways on R82, R81.20, R81.10 and older plus certain Spark firewalls using IKEv1. Hits any setup that still accepts legacy Remote Access clients.

WatchTowr also published a Detection Artefact Generator alongside the PoC.