Daily Cyber & AI Briefing — 2026-06-18

Daily Cyber & AI Briefing with Michael Housch. This episode was published automatically and includes the assembled audio plus full transcript.

Transcript

Today’s risk landscape is marked by a convergence of fast-moving cyber threats and the growing influence of artificial intelligence, both as an attack vector and as a governance challenge. Organizations are facing a surge in high-impact software vulnerabilities, active exploitation of widely used enterprise platforms, and a steady evolution in attacker tactics—including the blending of traditional methods with AI-driven techniques. At the same time, regulatory and stakeholder scrutiny around AI governance is intensifying, with new standards and frameworks emerging in response to both technical and ethical risks.

Let’s dig into the most pressing developments and what they mean for security and risk leaders.

We’ll start with critical software vulnerabilities making headlines today. Mozilla has released Firefox version 152 to address multiple critical vulnerabilities that could allow for remote code execution. This is a significant concern because attackers exploiting these flaws can potentially take control of affected systems with nothing more than a user visiting a malicious website. With Firefox being a staple in both consumer and enterprise environments, the risk of exploitation is not theoretical. If attackers gain a foothold through a browser, they can often move laterally within a network, escalating privileges and compromising additional assets. The practical takeaway is straightforward: patch Firefox immediately. Security teams should verify that the latest version is deployed across their environments and keep an eye out for any unusual browser activity, which could indicate attempted or successful exploitation.

Shifting to enterprise infrastructure, F5 has issued emergency, out-of-band patches for critical vulnerabilities in NGINX. NGINX is a core component in many organizations’ web infrastructure, acting as a reverse proxy and web application firewall. The vulnerabilities in question could allow attackers to bypass security controls or execute arbitrary code on affected systems. The fact that these patches were released outside of the regular update cycle signals either active exploitation or a very high risk of imminent attacks. For organizations running NGINX, patching should be prioritized. It’s also wise to review web application firewall and reverse proxy configurations for any signs of compromise, and to monitor for anomalous traffic or behavior that could suggest an attacker is already present.

Microsoft has confirmed a zero-day vulnerability in its Defender product, currently referred to as “RoguePlanet.” Details are still limited, but this is a particularly sensitive issue because Defender is a core endpoint security tool for many organizations. A compromise here could undermine defense-in-depth strategies, potentially allowing attackers to disable security controls or evade detection. Microsoft is still working on a patch, so in the meantime, security teams should closely monitor Microsoft advisories, consider implementing compensating controls, and be alert for any signs of suspicious activity related to Defender. This is a developing situation, and timely response will be critical in minimizing exposure.

Turning to security monitoring platforms, a vulnerability in the Splunk AI Toolkit has been disclosed that allows attackers to execute arbitrary operating system commands. This is a high-impact risk because Splunk is often used as a central hub for security analytics and incident response. If an attacker can compromise Splunk, they may be able to tamper with logs, disable alerts, or even use the platform as a launchpad for further attacks. The recommended action is immediate patching, followed by a thorough review of Splunk instance logs for any anomalous or unauthorized activity. Organizations should also assess whether their Splunk deployments are exposed to the internet or accessible from less-trusted network segments, as this increases the risk of exploitation.

WordPress continues to be a popular target, and today’s briefing highlights active exploitation of a vulnerability in a widely used SMTP plugin, affecting over 100,000 installations. Successful exploitation can give attackers access to sensitive data and facilitate further attacks on connected systems. For organizations with WordPress deployments, the guidance is clear: update affected plugins as soon as possible and conduct an audit for unauthorized access or signs of data exfiltration. Given the prevalence of WordPress in both public-facing and internal applications, even a single vulnerable plugin can serve as an entry point for attackers.

Attackers are also evolving their tactics to blend in with trusted platforms. The DragonForce threat group, for example, is now leveraging Microsoft Teams relays to evade detection and maintain persistence within enterprise environments. By abusing trusted collaboration channels, they can move laterally and exfiltrate data while bypassing traditional security controls. This is a reminder that collaboration tools, which have become essential for remote and hybrid work, are now part of the attack surface. Security teams should enhance monitoring of Teams activity, looking for unusual patterns or behaviors, and provide user education to help employees recognize and report suspicious activity within these platforms.

A new adversary-in-the-middle attack, utilizing the Evilginx framework, is capturing Microsoft credentials, multi-factor authentication tokens, and authenticated sessions. This technique allows attackers to bypass even MFA protections and maintain access to accounts even after passwords are changed. The implication here is that traditional MFA is not a silver bullet. Organizations should consider moving toward phishing-resistant authentication methods, such as hardware security keys or passkeys, and should monitor for unusual session activity that could indicate compromised credentials or tokens.

Remote monitoring tools, which are often used for legitimate IT management and support, are increasingly being abused by threat actors to bypass signature-based detection mechanisms. This trend makes it more challenging to distinguish between legitimate administrative activity and malicious behavior, complicating threat hunting and incident response. To address this, organizations should implement behavioral analytics to detect abnormal usage patterns and restrict remote tool usage to authorized personnel only. Regular audits of remote access logs can also help identify potential misuse.

Attackers are also leveraging native scripting languages—such as PowerShell, VBScript, and BAT files—to deliver the Xctdoor backdoor. By using built-in scripting capabilities, they can evade many traditional defenses that rely on signature-based detection. The Xctdoor backdoor enables persistent access and data theft, making it a serious risk for affected organizations. Enhanced script monitoring and tighter endpoint controls are recommended. Security leaders should ensure that only authorized scripts are allowed to run and that any deviations from normal scripting activity are promptly investigated.

A proof-of-concept exploit has been released for a remote denial-of-service vulnerability in Apache HTTP Server’s HTTP/2 implementation. This so-called “HTTP/2 bomb” could allow attackers to disrupt web services at scale, potentially impacting availability for critical applications. Organizations running Apache HTTP Server should apply the relevant patches and monitor for abnormal traffic patterns that could indicate an attempted denial-of-service attack. Proactive measures here can help mitigate the risk of service outages and maintain business continuity.

Shifting gears to artificial intelligence, there’s a notable trend toward professionalizing AI governance. Multiple organizations, including G-P and Daon, have recently achieved ISO/IEC 42001 certification. This standard is quickly emerging as a benchmark for trust, transparency, and ethical AI deployment. The growing adoption of ISO/IEC 42001 reflects increasing regulatory and stakeholder expectations around AI risk management. For CISOs and risk leaders, it’s time to assess your organization’s AI governance maturity and consider aligning with emerging standards. This not only helps with compliance but also builds trust with customers, partners, and regulators.

AI’s influence is also extending into critical sectors such as biology and nuclear technology. The integration of AI into these domains is amplifying both opportunities and risks, prompting calls for updated governance frameworks. As AI capabilities expand, so too do the potential threat vectors—from the misuse of AI in developing biological agents to the automation of nuclear command and control systems. Security and risk leaders must anticipate new regulatory requirements and adapt their risk assessments accordingly. This is an area where cross-disciplinary collaboration will be essential, bringing together expertise from cybersecurity, safety, ethics, and sector-specific domains.

Let’s take a step back and look at the strategic implications of these developments. First, patch management processes need to be agile and prioritized for high-impact vulnerabilities—especially those with active exploits or affecting core infrastructure. The days of quarterly patch cycles are over; organizations must be able to respond quickly as new threats emerge.

Second, AI governance is rapidly maturing. ISO/IEC 42001 is becoming a touchstone for organizations looking to demonstrate responsible AI practices. Preparing for increased scrutiny means not only having policies and controls in place, but also being able to show evidence of effective risk manage

Transcript

SPEAKER_00 0:07

Grab your coffee or Red Bull or whatever your morning vice is, and this is your daily cyber and AI briefing, and I am your host, Michael Hoosh. Today's risk landscape is marked by a convergence of fast moving cyber threats and the growing influence of artificial intelligence, both as an attack vector and as a governance challenge. Organizations are facing a surge in high impact software vulnerabilities, active exploitation of widely used enterprise platforms, and a steady evolution in attacker tactics, including the blending of traditional methods with AI-driven techniques. At the same time, regulatory and stakeholder scrutiny around AI governance is intensifying, with new standards and frameworks emerging in response to both technical and ethical risks. Let's dig into the most pressing developments and what they mean for security and risk leaders. We'll start with critical software vulnerabilities making headlines today. Mozilla has released Firefox version 152 to address multiple critical vulnerabilities that could allow for remote code execution. This is a significant concern because attackers exploiting these flaws can potentially take control of affected systems with nothing more than a user visiting a malicious website. With Firefox being a staple in both consumer and enterprise environments, the risk of exploitation is not theoretical. If attackers gain a foothold through a browser, they can often move laterally within a network, escalating privileges and compromising additional assets. The practical takeaway is straightforward. Patch Firefox immediately. Security teams should verify that the latest version is deployed across their environments and keep an eye out for any unusual browser activity, which could indicate attempted or successful exploitation. Shifting to enterprise infrastructure, F5 has issued emergency out-of-band patches for critical vulnerabilities in NGINX. NGINX is a core component in many organizations' web infrastructure, acting as a reverse proxy and web application firewall. The vulnerabilities in question could allow attackers to bypass security controls or execute arbitrary code on affected systems. The fact that these patches were released outside of the regular update cycle signals, either active exploitation or very high risk of imminent attacks. For organizations running NGINX, patching should be prioritized. It's also wise to review web application firewall and reverse proxy configurations for any signs of compromise, and to monitor for anomalous traffic or behavior that could suggest an attacker is already present. Microsoft has confirmed a zero-day vulnerability in its Defender product, currently referred to as Rogue Planet. Details are still limited, but this is a particularly sensitive issue because Defender is a core endpoint security tool for many organizations. A compromise here could undermine defense and depth strategies, potentially allowing attackers to disable security controls or evade detection. Microsoft is still working on a patch, so in the meantime, security teams should closely monitor Microsoft advisories, consider implementing compensating controls, and be alert for any signs of suspicious activity related to Defender. This is a developing situation, and timely response will be critical in minimizing exposure. Turning to security monitoring platforms, a vulnerability in the Splunk AI toolkit has been disclosed that allows attackers to execute arbitrary operating system commands. This is a high impact risk because Splunk is often used as a central hub for security analytics and incident response. If an attacker can compromise Splunk, they may be able to tamper with logs, disable alerts, or even use the platform as a launch pad for further attacks. The recommended action is immediate patching, followed by a thorough review of Splunk instance logs for any anomalous or unauthorized activity. Organizations should also assess whether their Splunk deployments are exposed to the Internet or accessible from less trusted network segments, as this increases the risk of exploitation. WordPress continues to be a popular target, and today's briefing highlights active exploitation of a vulnerability in a widely used SMTP plugin affecting over 100,000 installations. Successful exploitation can give attackers access to sensitive data and facilitate further attacks on connected systems. For organizations with WordPress deployments, the guidance is clear. Update affected plugins as soon as possible and conduct an audit for unauthorized access or signs of data exfiltration. Given the prevalence of WordPress in both public-facing and internal applications, even a single vulnerable plugin can serve as an entry point for attackers. Attackers are also evolving their tactics to blend in with trusted platforms. The Dragon Force Threat Group, for example, is now leveraging Microsoft Teams relays to evade detection and maintain persistence within enterprise environments. By abusing trusted collaboration channels, they can move laterally and exfiltrate data while bypassing traditional security controls. This is a reminder that collaboration tools, which have become essential for remote and hybrid work, are now part of the attack surface. Security teams should enhance monitoring of teams' activity, looking for unusual patterns or behaviors, and provide user education to help employees recognize and report suspicious activity within these platforms. A new adversary in the middle attack utilizing the Evil Ginks framework is capturing Microsoft credentials, multi-factor authentication tokens, and authenticated sessions. This technique allows attackers to bypass even MFA protections and maintain access to accounts even after passwords are changed. The implication here is that traditional MFA is not a silver bullet. Organizations should consider moving toward phishing resistant authentication methods, such as hardware security keys or pass keys, and should monitor for unusual session activity that could indicate compromise credentials or tokens. Remote monitoring tools, which are often used for legitimate IT management and support, are increasingly being abused by threat actors to bypass signature-based detection mechanisms. This trend makes it more challenging to distinguish between legitimate administrative activity and malicious behavior, complicating threat hunting and incident response. To address this, organizations should implement behavioral analytics to detect abnormal usage patterns and restrict remote tool usage to authorize personnel only. Regular audits of remote access logs can also help identify potential misuse. Attackers are also leveraging native scripting languages such as PowerShell, VBScript, and BAT files to deliver the X to door backdoor. By using built-in scripting capabilities, they can evade many traditional defenses that rely on signature-based detection. The XCT door backdoor enables persistent access and data theft, making it a serious risk for affected organizations. Enhanced script monitoring and tighter endpoint controls are recommended. Security leaders should ensure that only authorized scripts are allowed to run, and that any deviations from normal scripting activity are promptly investigated. A proof-of-concept exploit has been released for a remote denial of service vulnerability in Apache HTTP servers HTTP by 2 implementation. This so-called HTTP2 bomb could allow attackers to disrupt web services at scale, potentially impacting availability for critical applications. Organizations running Apache HTTP server should apply the relevant patches and monitor for abnormal traffic patterns that could indicate an attempted denial of service attack. Proactive measures here can help mitigate the risk of service outages and maintain business continuity. Shifting gears to artificial intelligence, there's a notable trend toward professionalizing AI governance. Multiple organizations, including GP and DON, have recently achieved ISO IEC for 2001 certification. This standard is quickly emerging as a benchmark for trust, transparency, and ethical AI deployment. The growing adoption of ISO IEC for 2001 reflects increasing regulatory and stakeholder expectations around AI risk management. For CISOs and risk leaders, it's time to assess your organization's AI governance maturity and consider aligning with emerging standards. This not only helps with compliance, but also builds trust with customers, partners, and regulators. AI's influence is also extending into critical sectors such as biology and nuclear technology. The integration of AI into these domains is amplifying both opportunities and risks, prompting calls for updated governance frameworks. As AI capabilities expand, so too do the potential threat vectors. From the misuse of AI in developing biological agents to the automation of nuclear command and control systems, security and risk leaders must anticipate new regulatory requirements and adapt their risk assessments accordingly. This is an area where cross-disciplinary collaboration will be essential, bringing together expertise from cybersecurity, safety, ethics, and sector-specific domains. Let's take a step back and look at the strategic implications of these developments. First, patch management processes need to be agile and prioritized for high impact vulnerabilities, especially those with active exploits or affecting core infrastructure. The days of quarterly patch cycles are over. Organizations must be able to respond quickly as new threats emerge. Second, AI governance is rapidly maturing. ISO IEC for 2001 is becoming a touchstone for organizations looking to demonstrate responsible AI practices. Preparing for increased scrutiny means not only having policies and controls in place, but also being able to show evidence of effective risk management, transparency, and ethical decision making in the deployment of AI systems. Third, attackers are exploiting trusted platforms like Microsoft Teams and remote monitoring tools and native scripting to evade detection. This requires a shift from traditional, signature-based defenses to more advanced behavioral analytics and continuous monitoring. User education remains a critical component as attackers increasingly rely on social engineering and abuse of trusted channels to achieve their objectives. Finally, the convergence of AI, cyber, and physical risks, such as those in the biological and nuclear sectors, demands cross-disciplinary risk assessments and updated governance models. The traditional boundaries between IT, OT, and physical security are blurring, and organizations must be prepared to manage risks that span multiple domains. So, what matters most today for risk leaders and security teams? There are a few clear priorities. First, immediate attention to patching is critical. Firefox, NGINX, Splunk, and the affected WordPress SMTP plugin all present active risks that can be mitigated through timely updates. Delays in patching can leave organizations exposed to exploitation and downstream attacks. Second, monitoring for advanced phishing and adversary in the middle attacks is essential, especially those targeting Microsoft credentials and MFA tokens. Traditional MFA is no longer sufficient on its own. Organizations should move toward phishing resistant authentication and keep a close watch for unusual session activity. Third, now is the time to evaluate and enhance AI governance frameworks. The momentum behind ISO and IEC for 2001 and similar standards is only going to increase. And organizations that get ahead of the curve will be better positioned to meet regulatory and stakeholder demands. To sum up, the risk environment is evolving quickly. Attackers are taking advantage of both new and old vulnerabilities, trusted platforms are being weaponized, and AI is creating both opportunities and new challenges for security and compliance. The organizations that will thrive are those that can respond quickly, adapt their controls, and take a holistic, proactive approach to risk management. That's the briefing for today. Stay vigilant, prioritize your patching, and keep driving forward on AI governance. Thanks for listening. That's a wrap, peeps. Stay secure, stay sharp, and don't forget to hug your CISO.