Cybersecurity News | Daily Recap [09 Jun 2026]

Critical Patches

• Google and SAP shipped urgent fixes for a fifth Chrome zero-day exploited in the wild, critical NetWeaver/Commerce bugs, and a LiteLLM flaw chained to unauthenticated RCE — Chrome Zero-Day, SAP Patches, LiteLLM Flaw
• CISA ordered U.S. federal agencies to patch a Check Point VPN zero-day within 3 days after exploitation in Qilin ransomware attacks that bypassed passwords in IKEv1 setups — CISA Orders, Qilin Attacks, VPN Bypass
• Gogs patched a critical zero-day enabling RCE, while a one-character Linux kernel flaw now has public exploits for local root access and UniFi OS has a bug that allows unauthenticated root compromise — Gogs Zero-Day, Linux Root Flaw, UniFi Root Bug

Supply Chain & Malware

• Shai-Hulud supply chain attacks infected over 100 NPM and PyPI packages, including 19 science-focused PyPI packages, with trojanized releases spreading malicious code — Shai-Hulud Attack, PyPI Trojanization
• NFCShare Android malware spread through fake banking app updates hosted on GitHub, using deceptive distribution to target mobile users — NFCShare Malware

Spyware & Messaging

• WhatsApp and Meta said they blocked new NSO Group phishing/spearfishing campaigns targeting users in violation of a court order, and Meta filed a contempt complaint against the spyware maker — WhatsApp Warns, WhatsApp Disrupts, Meta Blocks, Meta Complaint
• France’s government messaging service was breached in an account hijacking attack that compromised user access — French Service Breach

Data Breaches & Identity

• SoFi confirmed a third-party data breach affecting its Hong Kong subsidiary, highlighting ongoing supply-chain exposure in financial services — SoFi Breach
• Apple unveiled a feature that can automatically change compromised passwords, adding a new layer of account recovery and protection for users — Apple Passwords

Policy & Disinformation

• Armenia’s pro-Europe party won election despite Russia-linked disinformation efforts, while the UK gave big tech 3 months to build device controls to block nude images of children — Armenia Vote, UK Device Controls

Security Industry

• A Security raised $37 million to expand its autonomous offensive security platform, as vendors continue pitching AI-driven security automation — A Security Funding, AI Protection Platform, Vibe Coding Risk, Wazuh Cloud

Cybersecurity News | Daily Recap – hendryadrian.com