Thursday, June 4, 2026
Daily digest
The Microsoft 365 Android token-theft flaw and the unpatched Windows Search URI NTLM hash leak together represent a significant double hit to environments running M365 — review both immediately if mobile devices access your tenant.
Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag
A debug flag left enabled in production builds of multiple Microsoft 365 Android apps (Word, PowerPoint, Excel, etc.) bypassed the token-sharing restriction that normally limits access to trusted Microsoft apps. Any installed app could silently request and receive the signed-in user's OAuth token, enabling full access to email, files, and calendar with no user interaction. Microsoft has since patched the flag, but organizations with M365 GCC High users on Android should verify app versions and audit recent token activity.
Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes
A newly disclosed flaw in the Windows search: URI handler allows attackers to capture a user's NTLMv2 hash simply by getting them to click a link — no patch exists yet. The issue mirrors CVE-2026-33829 (Windows Snipping Tool URI spoofing) and was reported by Huntress. In Active Directory environments, stolen NTLMv2 hashes can be cracked offline or relayed for lateral movement.
Cisco Warns of Critical Unified CM Flaw with PoC Exploit Code
Cisco patched a critical vulnerability in Unified Communications Manager that allows unauthenticated attackers to gain root privileges; proof-of-concept exploit code is already publicly available. Organizations running Cisco UCM for voice infrastructure should apply the security update immediately given the availability of working exploit code. This is a high-priority patch given the combination of criticality and public PoC.
New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
A single-machine denial-of-service attack can crash major web servers including NGINX, Apache HTTPD, Microsoft IIS, and Envoy in under a minute by exploiting default HTTP/2 configurations. The vulnerability was discovered using OpenAI Codex and affects servers in their out-of-box configuration, making the attack surface extremely broad. Any internet-facing infrastructure or reverse proxy running HTTP/2 should be evaluated for mitigations immediately.
CISA Warns of Cyberattacks Targeting Fuel Tank Monitoring Systems
CISA, FBI, NSA, and the Department of Energy issued a joint warning that threat actors are actively targeting internet-exposed automatic tank gauge (ATG) systems used to monitor fuel storage across critical infrastructure sectors. The advisory highlights that these OT/ICS devices are often left internet-accessible with default credentials, making them trivial targets. Organizations managing any facility infrastructure with ATG systems should verify network segmentation and remove internet exposure.
CISA Warns of Active Attacks Exploiting Android and Linux Bugs
CISA added actively exploited vulnerabilities in the Linux kernel and Android OS to its Known Exploited Vulnerabilities catalog, signaling confirmed in-the-wild exploitation. Federal agencies under BOD 22-01 must patch on CISA's mandated timeline, and CMMC environments should treat KEV additions as high-priority remediation items under NIST 800-171 patch management controls. Linux-based infrastructure — including containerized workloads on platforms like Nutanix AHV — should be assessed for exposure.
One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens
A vulnerability in the GitHub.dev web-based editor allows an attacker to steal a victim's GitHub OAuth token — with full read/write access to public and private repositories — via a single crafted link. The attack requires no special permissions and exploits how VS Code's browser-based environment handles authentication. Development teams using GitHub for IaC, Ansible playbooks, or pipeline automation should treat this as a supply chain risk and audit OAuth token exposure.
Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)
An AI-powered vulnerability research tool discovered a use-after-free flaw in Redis's blocking-client code that allows an authenticated user to execute arbitrary OS commands on the host. The bug was introduced in Redis 7.2.0 and went undetected for over two years across all stable branches until patched on May 5. Environments using Redis as a caching or session backend — including containerized deployments — should update immediately.
Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months
Unknown threat actors maintained persistent access to a senior finance executive's Outlook mailbox for at least five months, exfiltrating email in small batches routed through Dropbox and OneDrive to blend with normal cloud traffic. Symantec and Carbon Black attributed the campaign to espionage motives, noting the use of native Windows tools to avoid detection. The tradecraft — abusing legitimate cloud storage for exfil and living-off-the-land — is directly applicable to M365 GCC High environments and underscores the need for robust mailbox audit logging and DLP.
Trump to Soon Nominate CISA Head, DHS Secretary Says
DHS Secretary Markwayne Mullin testified before the House Homeland Security Committee that a CISA director nominee is imminent, while also addressing ongoing contract reviews and staffing reductions at the agency. CISA has operated without a confirmed director for an extended period, raising concerns about leadership continuity for federal cybersecurity programs. The nominee's confirmation will have downstream implications for CMMC policy guidance, KEV catalog management, and broader federal cyber initiatives.
Nobody Needs 0-Days to Build a Chaos-Causing Worm — Free Open Source AI Models Work Just Fine
Researchers demonstrated that freely available open-source AI models are sufficient to create self-spreading worms capable of exploiting known vulnerabilities at scale across enterprise test networks — no proprietary or advanced models required. The finding lowers the barrier for automated exploit development significantly, as attackers can now operationalize existing CVEs cheaply and quickly. This has direct implications for patch velocity expectations in CMMC environments: the window between vulnerability disclosure and active exploitation is shrinking.
Microsoft Build: Air-Gapped GitHub, Coreutils for Windows, and Execution Containers for AI Agents
Microsoft Build announcements include an air-gapped GitHub offering for sensitive environments, native Linux Coreutils (75+ commands) integrated into Windows and PowerShell, and Execution Containers providing isolated sandboxes for running AI agents. The air-gapped GitHub option is particularly relevant for classified or CUI-handling environments that need source control without external network connectivity. Execution Containers address a growing concern around agentic AI having unconstrained access to host systems.