Daily Cybersecurity News - June 29, 2026

Attackers have started exploiting a critical flaw in Oracle E-Business Suite financial systems.

CVE-2026-46817 sits in the File Transmission component of Oracle Payments. Unauthenticated attackers reach it over HTTP and take over the service. CVSS 9.8, actively exploited per Defused honeypot data.

Affects EBS versions 12.2.3 through 12.2.15. Shadowserver sees over 450 instances exposed online, many in the US and Europe.

First exploitation attempts appeared over the weekend with no prior public PoC reported.

A new Linux kernel flaw gives unprivileged local users root access on most distributions.

DirtyClone is a DirtyFrag-family Linux kernel flaw tracked as CVE-2026-43503, CVSS 8.8. It lets a local user corrupt file-backed memory through cloned network packets and gain root.

Systems without the May 21 kernel fix or distro backports are exposed, especially multi-tenant servers, CI runners, container hosts, and Kubernetes clusters where untrusted users can create namespaces.

JFrog published the first working exploit walkthrough for this DirtyClone variant.

Hackers are exploiting a critical flaw in SimpleHelp to push new cross-platform infostealer malware.

They chain the recently disclosed CVE 2026-48558 with deployment of Djinn Stealer, a previously undocumented tool hitting Windows, macOS, and Linux systems. The same campaigns also drop TaskWeaver malware.

The angle here is the rapid shift from disclosure to active exploitation. Attackers moved fast on a remote code execution vector in a remote support tool that many organizations still expose publicly.

Blackpoint investigated at least one intrusion where attackers exploited CVE-2026-48558 to deploy TaskWeaver and Djinn Stealer.

Over 236000 websites built with the legitimate DCloud Uni App framework now run crypto investment scam templates.

Scammers use these templates to create fake cryptocurrency exchanges and multi-language pig butchering sites that drain wallets.

The framework itself is benign and open source from China, but attackers mass-deploy its templates at scale.

Infoblox traced the campaign to clusters reusing the same template variants across thousands of domains.

Microsoft yanked 119 malicious Edge extensions that hid payloads inside normal image and font files.

The operation used steganography to conceal credential stealers and ad fraud code. Extensions stayed quiet for days after install, then activated to grab logins and run fraud.

The approach is familiar. Attackers have hidden code in media files for years. What stands out here is the scale inside a major browser store.

Microsoft named the campaign StegoAd and said the extensions ran for months before detection.

A New York Times investigation reportedly ties the 2025 Jaguar Land Rover cyberattack to Russian hackers, but investigators have not determined whether they were state operators, criminals, or acting with tacit government approval.

They deployed novel ransomware timed to disrupt production and used deliberate steps to hide their tracks. The target is a major UK automotive manufacturer.

The strategic timing stands out compared to typical smash-and-grab ransomware. Attribution masking also feels more deliberate than most criminal crews bother with.

Experts point to infrastructure and behavioral patterns seen in prior Kremlin-linked operations.

AI coding agents can be tricked into running attacker code from a clean looking GitHub repo.

Mozilla's 0DIN team showed the attack works against agents like Claude Code. A poisoned prompt hidden in a normal file makes the agent execute commands on the developer's machine without any obvious malicious code.

The report is a short technical warning from Mozilla researchers rather than a large vendor survey, so it lacks broad statistics or long term trend data.

The proof of concept targets Claude Code specifically and requires the developer to point the agent at the malicious repository.