DJBSEC's CyberNews 2026-06-09

Today’s daily news covers the following categories: Malware Threat Intelligence Vulnerability Ransomware Policy & Legislation

---

Shai-Hulud Campaign Trojanizes 19 Science-Focused PyPI Packages

Malware Researchers have uncovered a new Shai-Hulud supply chain campaign that compromised 19 Python packages hosted on PyPI and targeted scientific and research communities. The malicious packages were designed to appear legitimate while secretly executing malware on developer and researcher systems. Once installed, the packages could steal credentials, establish persistence, and provide attackers with access to development environments. The incident highlights the growing risk facing open-source ecosystems as attackers increasingly target trusted software repositories. Developers are being urged to audit dependencies carefully and verify package authenticity before installation.

New Pink Hacking Group Targets Enterprise Users

Threat Intelligence Security researchers are tracking a newly identified threat actor known as the Pink Hacking Group that is actively targeting enterprise users. The group appears to be focused on gaining initial access through a combination of social engineering, credential theft, and exploitation techniques. Analysts say the threat actor is rapidly expanding its infrastructure and operational capabilities. Early campaigns indicate a focus on corporate environments where access can be monetized or leveraged for additional attacks. Researchers continue monitoring the group’s tactics to better understand its objectives and affiliations.

Critical Check Point VPN Vulnerability Actively Exploited

Vulnerability A critical vulnerability affecting Check Point VPN products is being actively exploited in the wild, prompting urgent warnings from security researchers. The flaw could allow attackers to gain unauthorized access to enterprise networks or compromise remote access infrastructure. VPN appliances remain high-value targets because they often provide direct access to sensitive corporate resources. Security experts warn that organizations with exposed or unpatched systems face elevated risk of compromise. Check Point customers are being urged to apply available patches and review systems for indicators of attack.

Check Point Links VPN Zero-Day Attacks to Qilin Ransomware Operators

Ransomware Check Point researchers have linked exploitation of a VPN zero-day vulnerability to affiliates associated with the Qilin ransomware operation. Investigators say attackers are using the flaw to gain initial access before deploying ransomware and conducting data theft activities. The campaign demonstrates how quickly ransomware groups weaponize newly discovered vulnerabilities. Security teams are being encouraged to prioritize patching internet-facing infrastructure and monitor VPN access logs for suspicious activity. The findings further illustrate the growing overlap between vulnerability exploitation and ransomware operations.

Independent Review Examines Claude Mythos and Project Glasswing Claims

Threat Intelligence A new independent review has examined claims surrounding Anthropic’s Claude Mythos model and Project Glasswing cybersecurity initiative. The report evaluates reported vulnerability discovery capabilities, operational effectiveness, and the level of verification available for public claims. Researchers note that while AI-driven security systems continue to demonstrate impressive results, independent validation remains critical. The analysis highlights the importance of transparency and reproducibility when evaluating emerging cybersecurity AI technologies. The discussion reflects broader industry interest in measuring the real-world effectiveness of AI-powered security platforms.

Internet Explorer WebBrowser Control Attack Technique Disclosed

Vulnerability Researchers have disclosed a new attack technique that abuses legacy Internet Explorer WebBrowser components still present in modern Windows environments. Although Internet Explorer itself has been retired, remnants of its technology continue to exist within some applications and enterprise workflows. Attackers may be able to exploit these components to bypass protections or execute malicious actions under certain conditions. The finding serves as a reminder that legacy technologies can continue introducing security risks long after official retirement. Organizations are encouraged to identify and remove dependencies on outdated browser components wherever possible.

Cisco and Anthropic Debate AI Vulnerability Discovery Claims

Threat Intelligence Industry discussion intensified after commentary surrounding Cisco’s public statements about AI-assisted vulnerability discovery and Anthropic’s Mythos platform. The debate centers on how vulnerabilities are attributed, measured, and publicly reported when AI systems are involved. Researchers argue that transparency around methodology is essential to properly evaluate the effectiveness of AI-powered security research. The controversy highlights growing competition among cybersecurity vendors and AI providers. As AI-driven vulnerability discovery becomes more common, independent validation is expected to become increasingly important.

UniFi OS Server RCE Chain Enables Root Access

Vulnerability Researchers have identified a critical remote code execution chain affecting UniFi OS Server that can ultimately grant attackers root-level access. Successful exploitation could allow full compromise of affected systems and provide attackers with control over connected network infrastructure. Because UniFi products are widely deployed in businesses and managed environments, the vulnerability has significant potential impact. Security experts warn that publicly disclosed exploit chains often attract rapid attacker attention. Administrators are being urged to apply patches immediately and restrict unnecessary exposure of management interfaces.

VS Code Introduces Automatic Extension Expiration Feature

Policy & Legislation Microsoft has introduced a new Visual Studio Code security feature that automatically expires certain extensions after a two-hour period under specific conditions. The change is designed to reduce risks associated with malicious, abandoned, or compromised extensions within the development ecosystem. Browser and IDE extension security has become an increasing concern as attackers target developer environments. Microsoft says the feature provides an additional layer of protection without significantly impacting developer productivity. The update reflects broader efforts to improve software supply chain security across development platforms.

Claude Code MCP Traffic Hijacking Vulnerability Disclosed

Vulnerability Researchers have disclosed a vulnerability that could allow attackers to hijack MCP-related traffic within certain Claude Code deployments. The issue may enable interception or manipulation of communications between components, potentially exposing sensitive development data or workflows. As AI-assisted coding platforms become more integrated into enterprise environments, weaknesses in supporting protocols and infrastructure are drawing greater scrutiny. Security experts recommend reviewing network configurations and applying vendor-provided mitigations where available. The vulnerability underscores the growing importance of securing AI development ecosystems alongside traditional software infrastructure.