← Cybersecurity Headlines
Cybersecurity Headlines
Big Patch Tuesday, 'Nightmare Eclipse' drops Windows 0-day, Claude Fable restricted at Microsoft
00:07:58
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Thursday, June 11, 2026. I'm Sarah Lane. A Patch Tuesday for the Books Microsoft released a record June patch Tuesday with nearly 200 security fixes, including around 35 critical vulnerabilities and several flaws that that already have public exploit code available. AI assisted bug hunting is accelerating discovery, which could make bigger patch cycles more common. The update also addresses several exploits published by Nightmare Eclipse, who claims to be a former Microsoft employee and has promised to release more 0 days Rapid7 researchers note the patch total was actually larger, with Microsoft separately fixing about 360 browser vulnerabilities that aren't even included in the official Patch Tuesday count. Nightmare Eclipse Drops Windows 0 Day yes just hours after Microsoft's big patch Tuesday, Nightmare Eclipse released exploit code for a new Microsoft Defender flaw they claim works on fully patched Windows 10 and 11 systems. The bug could let an attacker gain system level control of a machine, and early testing by both Threat Locker and security researcher Will Doormond said suggest the exploit is real, though not completely reliable. Nightmare Eclipse has backed away a bit from earlier threats of a big July vulnerability dump, saying that the latest exploit took more time and effort than expected. Claude Fable restricted at Microsoft the Verge reports Microsoft is restricting employee access to Anthropic's new Claude Fable 5 model because its safety system requires prompts and outputs and to be retained for at least 30 days. That is unlike earlier Claude models that support zero data retention policies. Microsoft has already made Fable 5 available to GitHub, Copilot and Foundry customers, but its legal teams are still reviewing whether the model can be safely used internally, given concerns around confidential and customer data. Anthropic says Fable 5 needs additional safety controls, but those controls come with Data retention requirements. ServiceNow unpacks data security incidents ServiceNow briefly warned customers that a security issue may have been used to access data in some customer environments. The company now says the activity was most likely caused by security researchers conducting bug bounty research rather than malicious attackers. The issue could allow unauthenticated access to certain information under specific conditions and was patched on June 5, affecting a limited number of customers. ServiceNow now says multiple researchers independently reported the same flaw through bug bounty programs, and its investigation found no evidence that any data was retained or misused. Huge thanks to our sponsor Doppel. Cybercriminals don't respect your security silos. They use one connected attack chain to hit your brand externally, infiltrate your inbox and manipulate your team Stop playing Whack a mole with fragmented tools. Doppel unifies digital risk protection, human risk management, and email security into one unified platform. 1 attack chain 3 pillars of defense 0 blind spots Secure your enterprise relentlessly at doppel.com that is-o P P E L.com lang flow flaw exploited Attackers are actively exploiting a high severity flaw in Langflow, the popular open source platform used to build AI apps, agents and rag workflows. Tenable, which discovered the flaw, says it lets attackers write arbitrary files to a server through a path traversal bug. And Vulnchek researcher Caitlin Condon says attackers are already dropping test files on on vulnerable systems. Langflow enables unauthenticated auto login by default, meaning that attackers don't need credentials to reach the vulnerable endpoint. And Condon says scans have identified roughly 7,000 publicly exposed instances. The bug has been patched for months, but it is another example of attackers targeting AI development infrastructure as adoption grows, China ramps up AI espionage CrowdStrike reports that China linked hacking groups are targeting US tech companies more and more to steal AI technology and intellectual property, with Chinese actors responsible for more than 58% of state sponsored cyber attacks it tracked against the sector over the past year. CrowdStrike says the goal is to help China close the AI gap with the US Especially as export controls continue to limit China's access to advanced AI chips. Chinese groups are also reportedly targeting government communications in Southeast Asia and maintaining long term access to North American tech companies by exploiting vulnerabilities, CISA wants federal agencies to patch Lickety split the agency is tightening federal patching requirements, giving other agencies three days to fix the highest risk vulnerabilities, specifically flaws that are actively exploited. Internet facing automatable and capable of giving attackers control of a system. CISA officials say this is necessary because AI is making it easier for attackers to find and exploit vulnerabilities at scale. CISA says not every bug needs urgent attention, but those dangerous ones cannot sit unpatched for weeks anymore. Miasma worm source code leaked on GitHub the source code for Miasma, a sophisticated credential stealing worm linked to supply chain attacks against Red Hat NPM packages and dozens of Microsoft GitHub repositories, was briefly published on GitHub through compromised developer accounts. SafeDEP researchers say the release appears intentional and reveals a highly advanced framework that steals cloud and developer credentials, compromises software packages and repositories, and even targets coding tools like Claude Gemini, Cursor, Copilot and Klein. Much like the earlier Shai Hulud leak that led to new variants and attacks. Making Miasma public could do the same. A lot of times when we're looking at cybersecurity solutions, it's easy to think purely is this a best in breed tool? Is this the best thing out there for this specific function? But the reality is that's not always or even often why a CISO will choose a product. That is what we're getting into. On this week's episode of Defense In Depth. Look for the episode CISOs buy for selfish and politically risk averse reasons. Wherever you get your podcasts. And if you have some thoughts on the news from today or about our show in general, be sure to reach out feedbackisoseries.com we always want to hear from you. I am Sarah Lane reporting for the CISO series. We'll talk to you tomorrow.
- [07:42]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.