Cybersecurity: Threats and Defences

CISA's risk-tiered directive was sold as breathing room. Recounting the catalogue shows the median federal patch deadline has fallen from 14 days to three, and the 60-day checkpoint due next week enforces nothing. We also correct our own June ransomware league table, which the source does not support.

A 15-nation coalition named Russian actor LAUNDRY BEAR behind a zero-click Zimbra exploit, while two Scattered Spider hackers drew record UK sentences for the TfL attack. CISA's catalogue ran a month behind private detection on a Fortinet flaw, and River Financial answered the materiality question with 'not yet determined' for a fourth time. The machinery of defence, not a single breach, is the story of the fortnight.

SOCRadar traced the FortiBleed credential haul to 12 confirmed ransomware deployments and found one operator working the negotiation panels for both INC Ransom and Lynx. Microsoft closed the Nightmare Eclipse zero-day series with an out-of-band Defender patch. NCSC and 18 agencies named Russia's FSB Centre 16 over SNMP router attacks, and the UK cyber bill reached the Lords with a £17m fine ceiling.

SOCRadar has tied the 86,644-credential FortiGate harvest to the Lynx ransomware crew, cracked offline against legacy FortiOS passwords never re-hashed to PBKDF2. A SharePoint code-execution deadline falls today under CISA's new triage regime, Cisco leads a five-vendor KEV batch, and the BlueHammer Defender flaw is now weaponised for SYSTEM access. Spring's disclosures are being cashed in as the federal machine that forced prioritisation is dismantled.

CISA revoked the directive behind its patch-deadline regime on 10 June and replaced it with a risk-tiered model, four days before Arista's deadline under the old order fell. The same fortnight produced Splunk's first-ever KEV entry, a triple CVSS-10 Ubiquiti chain, an 86,644-credential Fortinet leak, and a Five Eyes warning that AI will compress the exploit window to months.

Check Point's Remote Access VPN carried a critical authentication-bypass flaw for roughly a month before its 8 June hotfix, and a Qilin ransomware affiliate is already inside one victim. CISA set a three-day federal deadline. The same fortnight, Arista declined to patch an exploited flaw at all and Microsoft shipped its overdue Exchange fix 16 days late.

CISA added four exploited flaws to its catalogue between 1 and 3 June, spanning Oracle WebLogic, Linux containers, Android and Magento. Two were patched years ago; only the Magento bug is near-fresh. ENISA put water, rail and waste water in the EU risk zone the same week, and May ransomware ran at 95 disclosed victims with no sign of consolidation.

A poisoned Nx Console extension sat on the VS Code Marketplace for 18 minutes, long enough to steal a GitHub employee's tokens and clone roughly 3,800 internal repositories. The same actor that hit Cisco's source last fortnight has now breached the registry operator itself. CISA added two AI-tier flaws and a Drupal SQL bug to KEV; the UK cyber sector cleared 14.7 billion pounds.

GTIG named the first criminal LLM-generated zero-day and the actor cluster that stole Cisco AI Defense source code. CISA gave federal agencies until 29 May to fix an Exchange flaw Microsoft has not patched. The ICO fined a UK water company £963,900.

CISA gave federal agencies until 9 May to fix a Palo Alto firewall flaw. The patch ships on 13 May. State-nexus attackers have been inside the same firewalls since 16 April. Trellix, cPanel and Ivanti round out a week in which the perimeter device stopped pretending to hold.

Sixteen agencies admitted on 23 April that indicators of compromise vanish faster than blocklists can absorb them. A day later, CISA and NCSC named FIRESTARTER, a Cisco firewall implant that survives every patch. The defender's job has shifted from removing the indicator to rearchitecting the device.

Iran-linked Handala wiped 80,000 to 200,000 Stryker devices across 79 countries on 11 March using one stolen Microsoft Intune admin credential, with no malware deployed. NHS Supply Chain issued a UK disruption alert; Stryker filed an SEC 8-K/A. US defenders face this with a proposed $707m CISA cut and a Citrix/F5 vendor stack still burning.