Cyber News: Week Ending June 6, 2026

1: GlobalProtect VPN Authentication Bypass Is Being Actively Exploited

Palo Alto Networks Unit 42 reported active exploitation of CVE-2026-0257, a PAN-OS vulnerability affecting GlobalProtect portal and gateway components. The issue can allow unauthorized attackers to bypass security controls and initiate VPN connections on vulnerable systems. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on May 29.

This matters because VPNs are still one of the most important front doors into small-business networks. A compromised VPN connection can give attackers a path toward internal systems, file shares, servers, remote desktops, accounting platforms, and administrator tools. Unit 42 said only a small portion of probed devices established VPN sessions, but any successful gateway-connected event should be treated seriously.

The exploitation activity involves the GlobalProtect access path, suspicious gateway-connected events, and indicators such as unusual host IDs or device names. Unit 42 recommended hunting in GlobalProtect logs and following the vendor advisory, mitigations, or fixed releases.

BET-R Actions: If you use Palo Alto GlobalProtect, verify whether CVE-2026-0257 applies to your PAN-OS version and configuration. Patch immediately if affected. Review GlobalProtect logs for suspicious successful gateway-connected events, unfamiliar source IPs, strange host IDs, and generic device names. If you see signs of successful unauthorized VPN access, start incident response instead of treating it as a routine login anomaly. Remove unnecessary VPN exposure and confirm that authentication override settings and certificate configurations follow vendor guidance.

2. Android and Linux Flaws Added to CISA’s Exploited Vulnerability List

Google released June 2026 Android security patches addressing 124 vulnerabilities, including CVE-2025-48595, a high-severity Android Framework flaw that may be under limited targeted exploitation. The issue can allow local attackers to gain code execution and escalate privileges on Android 14 or later devices.

CISA also warned that attackers are exploiting Android and Linux vulnerabilities, adding CVE-2025-48595 and CVE-2022-0492 to its Known Exploited Vulnerabilities catalog. CVE-2022-0492 affects Linux cgroups v1 and can allow privilege escalation or container escape in vulnerable environments.

For individuals, the Android issue is a reminder that phones are business devices now. They hold email, banking apps, authenticator apps, client messages, photos of documents, cloud storage, and password reset access. For small businesses, the Linux issue matters because containerized workloads, hosting environments, development servers, and cloud systems often depend on Linux kernels that may be older than administrators realize.

BET-R Actions: Update Android devices as soon as the June 2026 patch level is available. For managed phones, verify patch levels through your MDM or device inventory instead of assuming automatic updates completed. For Linux servers and containers, check kernel versions and cgroups configuration, especially on older systems or container hosts. Prioritize systems exposed to the internet, systems hosting client data, and developer or cloud environments where privilege escalation could expose credentials.

3. Acer Wave 7 Router Flaws Show Why Home and Small-Office Wi-Fi Gear Needs Attention

Acer disclosed two critical vulnerabilities affecting Acer Wave 7 routers running firmware version T7c_GBL_1.01.000055 or earlier. One flaw exposes cleartext web and Telnet credentials through an unauthenticated log file, while the other involves a hardcoded AES key that can let attackers modify router backups and inject persistent backdoors. Acer said firmware updates are planned by the end of June 2026.

Routers are easy to forget because they are usually installed once and left alone. But for home offices and small businesses, a router is the boundary between trusted devices and the internet. If attackers control it, they may be able to monitor traffic paths, redirect users, change DNS settings, weaken security, or maintain hidden access.

The issue is especially concerning because a hardcoded cryptographic key can enable persistence through modified backup files. Changing a password may not be enough if a device was already tampered with.

BET-R Actions: If you use an Acer Wave 7 router, check the firmware version and watch Acer’s support page for the June firmware update. Disable remote management, restrict management access to trusted internal devices, disable Telnet, and change administrator passwords. If the router is business-critical and may have been exposed, consider replacing it or factory-resetting and rebuilding it after a clean firmware update rather than restoring from an old backup.

4. Over 900 U.S. Fuel Tank Gauge Systems Were Exposed Online

CISA, the FBI, NSA, Department of Energy, and other U.S. government partners warned critical infrastructure organizations to secure internet-exposed automatic tank gauge systems. Shadowserver observed 1,061 exposed ATG systems on June 5, with 909 located in the United States.

Automatic tank gauge systems are used to monitor fuel and chemical storage tanks. According to the reporting, attackers can target these devices through hardcoded credentials, authentication bypasses, SQL injection, OS command execution, and privilege escalation flaws. A successful compromise could alter settings, disable alerts, increase leak or equipment-failure risk, or damage tank systems.

This is not just a “critical infrastructure” story. It applies to gas stations, convenience stores, municipalities, farms, fleet operators, chemical storage sites, and small businesses that rely on operational technology. Many of these systems were never meant to be exposed directly to the internet.

BET-R Actions: If your business uses fuel, chemical, storage, environmental, or building-control systems, inventory what is reachable from the internet. Remove direct exposure wherever possible. Put remote access behind firewalls, VPNs, access control lists, and strong authentication. Replace default passwords, apply vendor updates, monitor for unauthorized setting changes, and make sure operational alerts cannot be silently disabled.

5. Red Hat npm Package Compromise Shows Developer Workstations Are Prime Targets

JFrog reported a new Shai-Hulud variant called Miasma affecting 96 hijacked @redhat-cloud-services npm package versions. The malicious versions execute during package installation, target developer and CI/CD secrets, and can hook into tools such as Claude, Codex, Gemini, Copilot, Kiro, opencode, VS Code, and system services for persistence.

This matters because developers and IT teams often run install commands that execute code before anyone reviews the package. A single compromised dependency can search for GitHub tokens, npm tokens, cloud credentials, Kubernetes secrets, Vault secrets, Docker credentials, SSH keys, password-manager credentials, .env files, and CI/CD secrets.

For small software companies, MSPs, website agencies, and internal IT teams, developer systems should be treated as privileged systems. A compromised developer laptop or build runner can lead to downstream customer risk.

BET-R Actions: Search package files, lockfiles, build logs, containers, and CI caches for affected @redhat-cloud-services versions. If exposure is confirmed, isolate affected machines and runners before rotating credentials. Remove persistence, preserve evidence, and then rotate GitHub, npm, cloud, Kubernetes, Vault, Docker, SSH, and password-manager credentials from a clean environment. Consider using dependency cooldowns, package allowlists by exact version, and npm ci –ignore-scripts where lifecycle scripts are not required.

6. Fake Open-Source Download Sites Are Ranking High and Delivering Malware

Researchers warned about a large-scale campaign using fake sites that mimic open-source and freeware projects such as Ghidra, dnSpy, and SpiderFoot. The sites can rank highly in Google search results, show legitimate-looking pages, and even reveal real project URLs when users hover over download buttons. But the first download click can be intercepted and routed through a traffic distribution system that delivers malware such as SessionGate, Remus Stealer, and AnimateClipper.

This is dangerous because many users have been trained to search for a tool name and click the first convincing result. Attackers know that, and they are building sites that look professional enough to pass a quick visual check.

For individuals, this can lead to browser-cookie theft, password theft, wallet theft, and malware infections. For businesses, fake download campaigns can compromise workstations used for IT, accounting, development, design, or administration.

BET-R Actions: Do not search-and-click your way to software downloads. Use vendor bookmarks, official GitHub organizations, package manager documentation, or known vendor domains. Train employees to avoid sponsored results and lookalike domains. Block software installs by standard users where possible. If a user installed a tool from a search result, review browser history, download source, file hashes, endpoint telemetry, and any credential use after installation.