Daily Cybersecurity News - June 16, 2026

Attackers can hijack Vertex AI model uploads and run code across tenant boundaries.

The flaw lives in the Python SDK's handling of model uploads to Google Cloud Storage. An attacker registers a bucket with a name the SDK later resolves, then supplies a malicious pickle file that executes on the victim's project during deserialization.

Any user running the affected Vertex AI SDK version against a shared or guessable bucket name is exposed. Cross-tenant reach means one compromised project can affect others in the same organization.

The attack chain relies on a single pickle deserialization step inside the model loading routine.

Attackers are exploiting critical flaws in Fortinet's FortiSandbox threat detection platform right now.

CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 let unauthenticated attackers run remote code or escalate privileges via command injection and path traversal. CVSS 9.1 each. Patches released in April, with actively exploited observed in the past 24 hours.

Affects FortiSandbox 4.4.x and 5.0.x appliances, VMs, and cloud instances used for malware analysis. No prior exploitation noted for one of the bugs before this wave.

CVE-2026-25089 exploit appears AI-generated and non-functional per researchers.

Cisco patched a Cisco Catalyst SD WAN Manager flaw that attackers already used for root escalation.

CVE-2026-20262 let an authenticated attacker with write access overwrite files and escalate to root. CVSS 6.5 (medium), with zero-day exploitation before disclosure.

Affects SD WAN vManage deployments running vulnerable versions. Any organization using Cisco's SD WAN controller is exposed.

Public PoC surfaced within days of the advisory.

A China-linked group spent over a year stealing credentials from US academic researchers without getting caught.

The initial entry vector is unknown; once in, they deployed the InfiniteRed malware, which harvested REDCap login credentials and exfiltrated research data.

The campaign reused classic credential theft tactics but stayed quiet for so long that standard detection missed it entirely. Google only found it after the actor had already hit multiple sites.

Google disrupted the operation after it compromised dozens of institutions across the US.

An attacker poisoned the Arch User Repository with malicious packages targeting Arch Linux users.

They adopted ~1,500 orphaned packages through AUR's ownership-transfer process, keeping their real names and history, then rewrote the build scripts to pull a backdoor on install.

The move is straightforward supply-chain abuse rather than novel tradecraft, and Arch responded by freezing new account registrations to stop further uploads.

Attackers reused the same package-naming tactic seen in prior AUR incidents from 2024.

ScarCruft is sending spear-phish emails that fake Microsoft security alerts to drop NarwhalRAT on targets.

The lures mimic account breach warnings and trick users into running a payload that installs the North Korean remote access trojan. Victims appear concentrated in government and research sectors.

The campaign recycles familiar phishing themes but pairs them with a fresh RAT variant. ScarCruft has used similar social engineering for years, yet the tooling here shows incremental updates rather than wholesale reinvention.

Active since at least early 2026 with multiple confirmed deliveries tracked in open reporting.

DragonForce ransomware operators used Microsoft Teams to slip past corporate defenses in a recent attack on a major company.

They routed command and control traffic through a legitimate Teams visitor token, making malicious activity appear as normal internal chat. The group deployed ransomware after gaining initial access.

This Teams trick is familiar from other ransomware crews. The novelty here is hiding the full C2 channel inside an existing corporate collaboration tool instead of using custom domains.

Symantec says this is the first known time Teams TURN relay infrastructure has been abused this way in the wild.