Monday, June 15, 2026 · Daily editionBack issueBack issues · Search

SitRep

An independent cybersecurity briefing — what matters, with its sources.

You are reading a back issue. Go to the latest edition →

The situation

Ransomware Forces Two Mackay Sugar Mills Offline

Two Mackay Sugar mills offline; initiate OT playbooks, containment checks, and production recovery actions.

Composed by SitRep’s AI editors from 3 sources — SecurityWeek, BleepingComputer, The Hacker News

Mackay Sugar Ransomware Shuts Two Mills

Mackay Sugar was hit by The Gentlemen ransomware, forcing two of its three cane-processing mills to halt and reducing production capacity; one mill resumed limited manual crushing by June 12. Restoration is ongoing and OT/ICS impact remains unclear, requiring immediate incident-playbook activation for affected production sites.

Context

This outage underscores that adversaries are converging on both operational disruption (ransomware against OT/ICS) and high-value data theft across enterprise infrastructure. Organizations running widely deployed network appliances, VPN gateways, AI runtimes, and web-facing CMS plugins face a broad blast radius affecting production, network integrity, and credential security.

“The through-line is urgent patching, credential rotation, and incident-playbook execution to limit operational and data impact.”
The move

5 things to do today

  1. Patch vManage to the fixed Cisco releases (20[.]9[.]9[.]1/2, 20[.]12[.]7[.]1/2, 20[.]15[.]4[.]4/5, 20[.]15[.]5[.]2/3, 20.18.x, 26.x) and hunt for index[.]jsp and[.]war uploads in vmanage-server logs.
  2. Apply Palo Alto mitigations for CVE-2026-0257 immediately, and monitor GlobalProtect portal and gateway logs for anomalous authentication or session creation.
  3. Upgrade LiteLLM to v1.83.14-stable, rotate provider keys and credentials, and audit callbacks, stored prompts, and account privileges for unauthorized changes.
  4. Rotate CDN and web-admin credentials for OptinMonster/TrustPulse/PushEngage integrations, remove rogue admin accounts and web shells, and verify plugin file integrity.
  5. Activate OT/ICS incident-playbooks for The Gentlemen ransomware, isolate affected production networks, and coordinate staged restart and safety validation with operations.

On the wire

P0Ransomware

The Gentlemen Ransomware Halts Two Mackay Sugar Mills

Two of three cane-processing mills were taken offline by The Gentlemen (Storm-2697), forcing production halts and manual workarounds; OT/ICS impact remains unclear. Activate OT incident response, isolate affected networks, and coordinate with operations to validate safe restart procedures.

SECURITYWEEK · Ransomware Attack Shuts Down Mills at Mackay Sugar, Australia

P1Exploit

Cisco Patches vManage Zero‑Day CVE-2026-20262 After Exploitation

CVE-2026-20262 allowed authenticated attackers to upload index[.]jsp/.war files and escalate to root on Catalyst SD‑WAN Manager; Cisco released patches across supported branches. Patch vManage to the listed releases immediately and hunt vmanage-server logs for index[.]jsp and[.]war upload activity to detect compromise.

BLEEPINGCOMPUTER · Cisco Fixes SD-WAN vManage Flaw Exploited in Zero-Day Attacks

P0Exploit

Active Exploitation of PAN‑OS CVE-2026-0257 Against GlobalProtect

CVE-2026-0257 is under active exploitation against GlobalProtect portals and gateways since mid‑May, with observed limited attacks. Apply Palo Alto mitigations immediately, monitor VPN portal/gateway logs for anomalous authentication and session creation, and treat KEV guidance as priority for agency-facing controls.

THE HACKER NEWS · Palo Alto Warns Active Exploitation of PAN-OS GlobalProtect Flaw

P1AI Runtime

LiteLLM Three‑CVE Chain Lets Low‑Privilege Users Escalate to Proxy Admin

Chained CVE-2026-47101, CVE-2026-47102, and CVE-2026-40217 let low-privilege accounts assume proxy-admin roles and execute code, exposing provider keys and prompts. Upgrade to LiteLLM v1.83.14-stable, rotate exposed keys and credentials, and audit callbacks, stored prompts, and account privileges for unauthorized changes.

THE HACKER NEWS · LiteLLM Chain Allows Low-Privilege Takeover of AI Gateway Servers

P1Supply Chain

CDN Supply‑Chain Compromise Injects Malicious Scripts into WordPress Plugins

Sansec found malicious CDN-served scripts injected into OptinMonster, TrustPulse, and PushEngage that created rogue admins and backdoors via stolen CDN credentials. Rotate CDN and web-admin credentials, remove rogue accounts and web shells, and verify plugin file integrity across customer-facing sites.

BLEEPINGCOMPUTER · OptinMonster WordPress Plugin Hacked in CDN Supply-Chain Attack

Indicators named in this edition

KindValueNote
CVECVE-2026-20262Cisco Catalyst SD-WAN Manager vManage zero-day
CVECVE-2026-0257PAN-OS GlobalProtect active exploitation
CVECVE-2026-47101LiteLLM privilege escalation chain
CVECVE-2026-47102LiteLLM privilege escalation chain
CVECVE-2026-40217LiteLLM privilege escalation chain

Elsewhere in the edition

GeoVision LPC2011/LPC2211 Web Interface Privilege Escalation

A privilege escalation flaw in GeoVision LPC2011/LPC2211 Web Interface (version 1.10) lets a low-privilege Guest access admin features via geo-cgi endpoints. Exploitation via HTTP requests to geo-cgi/sdk_fw_update.cgi and geo-cgi/params[.]cgi can reboot, retrieve, or export settings, including plaintext admin credentials. CVSS 9.9. Vendor disclosed 2026-02-24; patch released 2026-04-14.

5 reports

China-Linked Hackers Abuse Google Workspace to Steal Emails

A China-linked group, UNC6508, used a REDCap backdoor to access medical, academic, and military research networks. They hijacked Google Workspace content-compliance rules to silently copy matching emails to an attacker-controlled inbox. The compromise started by Sept 2023 and continued through Nov 2025, affecting multiple US and Canadian organizations. Google disrupted the operation and notified…

5 reports

Collaboration at Black Hat: Cisco XDR and Partners

At Black Hat Asia 2026, Cisco and partners expanded visibility by ingested XSIAM analytics into Cisco XDR via a collaborative workflow. The effort, aided by Palo Alto Networks guidance, integrated Corelight/OpenNDR detections and focused on behavioral analytics and correlated alerts, delivering end-to-end detection in XDR and production-ready threat-hunter workflows.

3 reports

Council of Europe Probes ShinyHunters Data Breach Claims

The Council of Europe is investigating ShinyHunters’ claims of a data breach involving documents from multiple departments. The group claimed 429,000+ documents were stolen, including 409,000+ payslips for 10,000+ staff (2011–2026), 3,700+ personnel files, and 14,000+ CVs with sensitive data. ShinyHunters links prior breaches against Salesforce Aura, Salesloft, Drift, Snowflake, and an Oracle Peo…

2 reports

One-Click Microsoft 365 Copilot Flaw Enables Data Exfiltration

Researchers describe a one-click flaw in Microsoft 365 Copilot Enterprise Search, dubbed SearchLeak, that can exfiltrate emails, calendar details, and indexed files via a crafted q parameter and Bing image requests. CVE-2026-42824 was assigned; Microsoft mitigated backend risk and no exploitation was observed. Applies to Copilot Enterprise with data accessible via Microsoft Graph.

2 reports

Infinite Campus data breach affects 137,000 school staff accounts

A ShinyHunters-led Salesforce data theft targeted Infinite Campus, exposing 137,100 school staff records. The breach involved names, contact details, emails, job titles, phone numbers, and addresses, with data largely directory information. Infinite Campus says customer databases were not confirmed compromised; impact mirrors prior EdTech incidents.

2 reports

Ukrainian Man Pleads Guilty to Conti Ransomware Charges

Oleksii Oleksiyovych Lytvynenko pleaded guilty in the US to wire fraud conspiracy linked to Conti ransomware. He joined Conti in Sep 2021, worked on a malware loader, and possessed data from 12 victims (8 in the US). Extradited from Ireland in 2025; sentencing set for Sep 10, 2026. Conti operated 2020–2022, extorting and leaking data before its 2022 shutdown; related malware families include Tric…

2 reports

Ozempic Maker Novo Nordisk Reports IT Breach Exposing Trial Data

Novo Nordisk disclosed unauthorized access to limited internal IT systems storing personal data, affecting some clinical trial participants. Exposed data include randomly assigned patient IDs, trial participation, sex, birth year, biomarkers, health or immunogenicity data, and lifestyle factors; providers’ names, emails, phone numbers, and locations may also be affected. No party claimed responsi…

2 reports

Also reported

End of the Monday, June 15, 2026 edition.