[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpy0xOPI0BOchC2Np44Gh2KEnDeo6Ti-9NNJFNva47fU":3},{"article":4,"iocs":53,"watch_terms":72,"solutions":73,"lesson":175},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"2e10e8a8-a00c-4a8c-bb3f-dea91a91a833","⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More","weekly-recap-chrome-0-day-unifi-exploits-macos-stealers-vpn-flaw-and-more-93ac29","Stuff broke again. Not in a movie way. An old tool was left exposed. An abandoned package was abused. A deprecated feature was still running in prod. This week is the same lesson in a new form: phishing kits are easier to rent, AI names are useful bait, old login paths still fail, and forgotten software keeps becoming someone else's entry point. Scroll through the full Monday Cybersecurity","This week's cybersecurity recap includes Google patching a zero-day vulnerability in Chrome that was actively exploited in the wild. Additionally, the ShinyHunters gang exploited an Oracle PeopleSoft zero-day, leading to data exfiltration and CISA adding it to the KEV catalog. Hundreds of Arch Linux packages were compromised to distribute a rootkit and stealer, and the FBI took down domains linked to the Outsider phishing-as-a-service kit.","Weekly recap highlights Chrome 0-day, PeopleSoft exploit, Arch Linux package compromise, and PhaaS takedown.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fweekly-recap-chrome-0-day-unifi.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgOtdohah5P1Lv9egIZCwwxpEdcV4phYigmhvgzB3ulDhSeeffe4qDsVoowrzaTD6WsgwyjKIdJ_vzvnsUJ78zn5oxOl83qUj5ie8NN_MF8pMbdcikrPpV9vAUgm-7NLOztqN17uTx-dktpkgcQSFrmulSyCtE3MCGHOe5yQRVDFbsrx0DUjoHTa76k4Oos\u002Fs1600\u002Fthn-recap.jpg","2026-06-15T13:49:29+00:00","2026-06-15T16:00:08.662299+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Chrome","product",{"name":21,"type":19},"V8",{"name":23,"type":19},"Oracle PeopleSoft",{"name":25,"type":19},"PeopleTools",{"name":27,"type":19},"MeshCentral",{"name":29,"type":19},"atomic-lockfile","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,63,65,67,70],{"type":55,"value":56,"context":57},"cve","CVE-2026-11645","Out-of-bounds memory access in Chrome's V8 engine.",{"type":55,"value":59,"context":60},"CVE-2026-2441","Previously exploited Chrome zero-day.",{"type":55,"value":62,"context":60},"CVE-2026-3909",{"type":55,"value":64,"context":60},"CVE-2026-3910",{"type":55,"value":66,"context":60},"CVE-2026-5281",{"type":55,"value":68,"context":69},"CVE-2026-35273","Unpatched flaw in Oracle PeopleSoft.",{"type":47,"value":29,"context":71},"Malicious npm package used in Arch Linux compromise.",[18,21,23],{"controls":74,"vendors":162},[75,104,133],{"slug":76,"name":77,"problem":78,"products":79},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":105,"name":106,"problem":107,"products":108},"patch-management","Automated patch management","Known holes get closed in days, not months.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":134,"name":135,"problem":136,"products":137},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[138,146,154],{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[163,170],{"slug":164,"name":165,"logo_path":166,"roles":167},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[168,169],"reported_by","affected",{"slug":171,"name":172,"logo_path":173,"roles":174},"oracle","Oracle","\u002Fvendor-logos\u002Foracle.png",[169],{"slug":176,"title":177,"body":178,"framework_refs":179,"framework_notes":186},"multiple-zero-day-exploits-and-supply-chain-compromises-highlight-critical-security-gaps","Multiple Zero-Day Exploits and Supply Chain Compromises Highlight Critical Security Gaps","This week's incidents demonstrate the severe consequences of delayed patching and compromised software supply chains. Google's Chrome zero-day was actively exploited in the wild, while Oracle PeopleSoft's zero-day led to data exfiltration by the ShinyHunters gang. The compromise of hundreds of Arch Linux packages to distribute malware shows how attackers can weaponize trusted software repositories. These incidents underscore the need for rapid patch deployment and robust supply chain security measures to prevent widespread exploitation.",[180,181,182,183,184,185],"CIS Control 7","CIS Control 15","NIST SI-2","NIST SA-12","NIST CM-11","ISO 27001 A.12.6.1",{}]