Cyber Morning Call

Referências do Episódio
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit

Oracle Security Alert Advisory - CVE-2026-35273

Oracle mitigates PeopleSoft zero-day exploited in data theft attacks

Velvet Ant’s Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected

Inside OnyxC2: The New Stealer Targeting 210 Apps

OceanLotus: From external espionage to domestic targeting

Arctic Wolf Observes an Increase in Palo Alto Networks GlobalProtect Authentication Bypass Exploitation via CVE-2026-0257

From SQLi to RCE – Exploiting LangGraph’s Checkpointer

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE

Expanded JDY IoT and SOHO botnet enables rapid vulnerability exploitation

CVE-2026-0274 Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration

Who Runs the Ransomware Group ‘The Gentlemen?’

GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
MSRC - June 2026 Security Updates

CVE-2026-45586 - Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability 

CVE-2026-49160 - HTTP.sys Denial of Service Vulnerability 

CVE-2026-50507 - Windows BitLocker Security Feature Bypass Vulnerability

RoguePlanet

Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges

SAP Security Patch Day - June 2026

ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances

More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520)

Vulnerability Resolved in Veeam Backup & Replication 12.3.2.4854

CVE-2026-25089 - Second-Order OS Command Injection via JSON Input on start vnc feature

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
Google patches new Chrome zero-day flaw exploited in the wild

Chrome Releases - Stable Channel Update for Desktop - Monday, June 8, 2026

Security Advisory – Action Required – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751)

Off By !: Exploiting a Use-after-Free in the Linux Kernel

Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave

When “Hi, This Is IT” Comes Through Microsoft Teams

Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available

Cisco Catalyst SD-WAN Manager Authenticated Privilege Escalation Vulnerability

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia

Referências do Episódio
1-Click GitHub Token Stealing via a VSCode Bug

Error 524 Decoy: Unmasking a Global Smishing Operation Hiding Behind Error Pages

Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor

Boletim de segurança do Android: junho de 2026

CISA flags two-year-old Oracle flaw as actively exploited in attacks

Roteiro e apresentação: Carlos Cabral
Edição de áudio: Paulo Arruzzo 
Narração de encerramento: Bianca Garcia