Skip to content
Monday, June 15, 2026 · Daily edition · Vol. 1, No. 2Back issue

Vol. 1, No. 2Composed Jun 16 · 00:08 UTC

SitRep

An independent cybersecurity briefing — what matters, with its sources.

2 critical · 3 elevated5 stories on the wire

You are reading a back issue. Go to the latest edition →

The situation

Mackay Sugar Ransomware Shuts Two Mills

Two Mackay Sugar mills offline; initiate OT playbooks, containment checks, and production recovery actions.

Composed by SitRep’s AI editors from 3 sources — SecurityWeek, BleepingComputer, The Hacker News

Mackay Sugar was hit by The Gentlemen ransomware, forcing two of its three cane-processing mills to halt and reducing production capacity; one mill resumed limited manual crushing by June 12. Restoration is ongoing and OT/ICS impact remains unclear, requiring immediate incident-playbook activation for affected production sites.

Context

This outage underscores that adversaries are converging on both operational disruption (ransomware against OT/ICS) and high-value data theft across enterprise infrastructure. Organizations running widely deployed network appliances, VPN gateways, AI runtimes, and web-facing CMS plugins face a broad blast radius affecting production, network integrity, and credential security.

“The through-line is urgent patching, credential rotation, and incident-playbook execution to limit operational and data impact.”
From the analysis
The move

5 things to do today

  1. Patch vManage to the fixed Cisco releases (20[.]9[.]9[.]1/2, 20[.]12[.]7[.]1/2, 20[.]15[.]4[.]4/5, 20[.]15[.]5[.]2/3, 20.18.x, 26.x) and hunt for index[.]jsp and[.]war uploads in vmanage-server logs.
  2. Apply Palo Alto mitigations for CVE-2026-0257 immediately, and monitor GlobalProtect portal and gateway logs for anomalous authentication or session creation.
  3. Upgrade LiteLLM to v1.83.14-stable, rotate provider keys and credentials, and audit callbacks, stored prompts, and account privileges for unauthorized changes.
  4. Rotate CDN and web-admin credentials for OptinMonster/TrustPulse/PushEngage integrations, remove rogue admin accounts and web shells, and verify plugin file integrity.
  5. Activate OT/ICS incident-playbooks for The Gentlemen ransomware, isolate affected production networks, and coordinate staged restart and safety validation with operations.

On the wire

  • 2critical
  • 3elevated
  • 0moderate
  • 0low
P0Ransomware

The Gentlemen Ransomware Halts Two Mackay Sugar Mills

Two of three cane-processing mills were taken offline by The Gentlemen (Storm-2697), forcing production halts and manual workarounds; OT/ICS impact remains unclear. Activate OT incident response, isolate affected networks, and coordinate with operations to validate safe restart procedures.

SECURITYWEEK · Ransomware Attack Shuts Down Mills at Mackay Sugar, Australia

Copy link to “The Gentlemen Ransomware Halts Two Mackay Sugar Mills”

P1Exploit

Cisco Patches vManage Zero‑Day CVE-2026-20262 After Exploitation

CVE-2026-20262 allowed authenticated attackers to upload index[.]jsp/.war files and escalate to root on Catalyst SD‑WAN Manager; Cisco released patches across supported branches. Patch vManage to the listed releases immediately and hunt vmanage-server logs for index[.]jsp and[.]war upload activity to detect compromise.

BLEEPINGCOMPUTER · Cisco Fixes SD-WAN vManage Flaw Exploited in Zero-Day Attacks

Copy link to “Cisco Patches vManage Zero‑Day CVE-2026-20262 After Exploitation”

P0Exploit

Active Exploitation of PAN‑OS CVE-2026-0257 Against GlobalProtect

CVE-2026-0257 is under active exploitation against GlobalProtect portals and gateways since mid‑May, with observed limited attacks. Apply Palo Alto mitigations immediately, monitor VPN portal/gateway logs for anomalous authentication and session creation, and treat KEV guidance as priority for agency-facing controls.

THE HACKER NEWS · Palo Alto Warns Active Exploitation of PAN-OS GlobalProtect Flaw

Copy link to “Active Exploitation of PAN‑OS CVE-2026-0257 Against GlobalProtect”

P1AI Runtime

LiteLLM Three‑CVE Chain Lets Low‑Privilege Users Escalate to Proxy Admin

Chained CVE-2026-47101, CVE-2026-47102, and CVE-2026-40217 let low-privilege accounts assume proxy-admin roles and execute code, exposing provider keys and prompts. Upgrade to LiteLLM v1.83.14-stable, rotate exposed keys and credentials, and audit callbacks, stored prompts, and account privileges for unauthorized changes.

THE HACKER NEWS · LiteLLM Chain Allows Low-Privilege Takeover of AI Gateway Servers

Copy link to “LiteLLM Three‑CVE Chain Lets Low‑Privilege Users Escalate to Proxy Admin”

P1Supply Chain

CDN Supply‑Chain Compromise Injects Malicious Scripts into WordPress Plugins

Sansec found malicious CDN-served scripts injected into OptinMonster, TrustPulse, and PushEngage that created rogue admins and backdoors via stolen CDN credentials. Rotate CDN and web-admin credentials, remove rogue accounts and web shells, and verify plugin file integrity across customer-facing sites.

BLEEPINGCOMPUTER · OptinMonster WordPress Plugin Hacked in CDN Supply-Chain Attack

Copy link to “CDN Supply‑Chain Compromise Injects Malicious Scripts into WordPress Plugins”

Vulnerabilities named in this edition

CVE-2026-20262 · CVE-2026-0257 · CVE-2026-47101 · CVE-2026-47102 · CVE-2026-40217

Known exploited

Added 15 Jun2 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-20262Cisco Catalyst SD-WAN Manager15 Jun29 Jun
CVE-2026-54420LiteSpeed cPanel Plugin15 Jun18 Jun

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

Elsewhere in the edition

GeoVision LPC2011/LPC2211 Web Interface Privilege Escalation

A privilege escalation flaw in GeoVision LPC2011/LPC2211 Web Interface (version 1.10) lets a low-privilege Guest access admin features via geo-cgi endpoints. Exploitation via HTTP requests to geo-cgi/sdk_fw_update.cgi and geo-cgi/params[.]cgi can reboot, retrieve, or export settings, including plaintext admin credentials. CVSS 9.9. Vendor disclosed 2026-02-24; patch released 2026-04-14.

5 reports

China-Linked Hackers Abuse Google Workspace to Steal Emails

A China-linked group, UNC6508, used a REDCap backdoor to access medical, academic, and military research networks. They hijacked Google Workspace content-compliance rules to silently copy matching emails to an attacker-controlled inbox. The compromise started by Sept 2023 and continued through Nov 2025, affecting multiple US and Canadian organizations.

5 reports

Collaboration at Black Hat: Cisco XDR and Partners

At Black Hat Asia 2026, Cisco and partners expanded visibility by ingested XSIAM analytics into Cisco XDR via a collaborative workflow. The effort, aided by Palo Alto Networks guidance, integrated Corelight/OpenNDR detections and focused on behavioral analytics and correlated alerts, delivering end-to-end detection in XDR and production-ready threat-hunter workflows.

3 reports

Council of Europe Probes ShinyHunters Data Breach Claims

The Council of Europe is investigating ShinyHunters’ claims of a data breach involving documents from multiple departments. The group claimed 429,000+ documents were stolen, including 409,000+ payslips for 10,000+ staff (2011–2026), 3,700+ personnel files, and 14,000+ CVs with sensitive data.

2 reports

One-Click Microsoft 365 Copilot Flaw Enables Data Exfiltration

Researchers describe a one-click flaw in Microsoft 365 Copilot Enterprise Search, dubbed SearchLeak, that can exfiltrate emails, calendar details, and indexed files via a crafted q parameter and Bing image requests. CVE-2026-42824 was assigned; Microsoft mitigated backend risk and no exploitation was observed. Applies to Copilot Enterprise with data accessible via Microsoft Graph.

2 reports

Infinite Campus data breach affects 137,000 school staff accounts

A ShinyHunters-led Salesforce data theft targeted Infinite Campus, exposing 137,100 school staff records. The breach involved names, contact details, emails, job titles, phone numbers, and addresses, with data largely directory information. Infinite Campus says customer databases were not confirmed compromised; impact mirrors prior EdTech incidents.

2 reports

Ozempic Maker Novo Nordisk Reports IT Breach Exposing Trial Data

Novo Nordisk disclosed unauthorized access to limited internal IT systems storing personal data, affecting some clinical trial participants. Exposed data include randomly assigned patient IDs, trial participation, sex, birth year, biomarkers, health or immunogenicity data, and lifestyle factors; providers’ names, emails, phone numbers, and locations may also be affected.

2 reports

Also reported

End of the Monday, June 15, 2026 edition.

Colophon

SitRep · Vol. 1, No. 2

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
Editors
Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure
Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections
brief@sitrepit.com or the contact page.