Friday, June 26, 2026
Daily digest
OMB formally directed federal agencies to submit post-quantum cryptography migration plans within four months — a direct compliance action item for any organization in the federal supply chain.
OMB Issues Instructions for Agency Migration to Quantum-Proof Encryption
OMB has issued formal guidance directing federal agencies to execute a phased migration of cryptographic systems to post-quantum cryptography (PQC) standards and submit PQC migration plans to OMB. The directive builds on earlier Biden-era cryptographic inventory work. Agencies have approximately four months to finalize their plans.
Why it matters: This has direct downstream implications for DIB contractors operating under NIST 800-171 and CMMC L2 — expect forthcoming DFARS clauses or assessment guidance requiring PQC-ready cryptographic controls. Now is the time to inventory all cryptographic dependencies across your M365 GCC High tenant, AWS GovCloud workloads, and VPN/TLS configurations before auditors ask.
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets
CVE-2026-43503 (CVSS 8.8), dubbed DirtyClone, is a privilege escalation vulnerability in the Linux kernel in the DirtyFrag family. A local user can corrupt file-backed memory through a cloned network packet to gain root. JFrog Security Research published a working exploit walkthrough on June 25, and a patch has landed upstream.
Why it matters: Nutanix AHV runs on a hardened Linux kernel — confirm whether your AHV version incorporates the upstream patch and prioritize patching any Linux-based VMs, Ansible control nodes, or container hosts where local access by non-root users is possible.
In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw
A vulnerability in Cisco Unified Communications Manager (CUCM) and Unified CM SME enabling server-side request forgery (SSRF) was weaponized by attackers within 24 hours of disclosure. The flaw also allows privilege escalation to root on affected systems.
Why it matters: If your environment includes Cisco CUCM for VoIP — common in DoD-adjacent offices — treat this as an emergency patch. The sub-24-hour weaponization window means your patch window is effectively zero; apply Cisco's fix or isolate CUCM from untrusted network segments immediately.
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
The Miasma/Mini Shai-Hulud malware family has expanded its supply chain campaign to poison over 20 npm packages, including LeoPlatform and RStreams, and abuse GitHub Actions workflows. The campaign now extends into the Go ecosystem and actively harvests developer credentials while targeting additional maintainers for compromise.
Why it matters: If any Ansible playbooks, pipeline scripts, or internal tooling pull from npm or Go module registries — or if your CI/CD runs GitHub Actions — audit your dependency manifests and workflow files now. Harvested developer credentials can pivot directly into your source code repositories and infrastructure automation.
New Mistic Backdoor Linked to KongTuke Sold to Ransomware Groups as Corporate Foothold
A stealthy, self-destructing backdoor named Mistic (also MLTBackdoor) has been deployed against insurance, education, IT, and professional services organizations since April 2026. It is attributed to an initial access broker linked to KongTuke, ClickFix, and ModeloRAT campaigns, with footholds being sold to ransomware operators.
Why it matters: IT and professional services firms — likely including many CMMC L2 contractors — are explicitly in this threat actor's targeting profile. The self-destructing behavior means traditional forensic indicators may disappear; ensure your EDR and network detection tooling captures behavioral baselines, not just file artifacts.
Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks
Russian state-sponsored APT Turla has deployed a previously undocumented .NET Windows backdoor called STOCKSTAY against government and military organizations in Ukraine and entities linked to Italian foreign policy. Google Threat Intelligence Group describes the backdoor as under continual active development.
Why it matters: Turla consistently targets defense-adjacent organizations. As a CMMC L2 environment likely handling CUI related to defense programs, ensure your Intune-managed Windows 11 fleet has current .NET runtime telemetry flowing to your SIEM and that anomalous outbound connections from managed endpoints are alerted.
New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis
A Rust-based macOS infostealer named Gaslight embeds prompt injection payloads designed to confuse or abort AI-assisted malware analysis tools, causing them to misclassify or refuse to analyze the sample. Researchers assessed with high confidence that this is an adversarially intentional anti-analysis capability.
Why it matters: If your security team uses AI-assisted triage tools (Copilot for Security, AI-augmented SIEM, or your self-hosted AI stack) for malware analysis, this is a direct reliability threat. Validate that AI-assisted findings on suspicious files are cross-checked with traditional static/dynamic sandbox analysis.
Secret Service Failed to Secure Mobile Devices, Putting Protectees and Employees at Risk
A DHS OIG report found the U.S. Secret Service failed to properly secure and manage mobile devices, including during active protective operations. The watchdog identified systemic mobile device security management failures across the agency.
Why it matters: This is a direct cautionary example for CMMC L2 environments: mobile device management failures are a documented path to compliance findings and real operational risk. Review your Intune MDM policies, conditional access rules for mobile devices, and whether all government-issued or BYOD devices accessing CUI are fully enrolled and compliant.
Agencies Have Four Months to Finalize Quantum-Ready Migration Plans
A White House directive gives federal agencies four months to complete and submit post-quantum cryptography migration plans, building on cryptographic system inventories conducted under the previous administration. The plans must address a phased migration to PQC-compliant algorithms.
Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability
Security researchers at Island found that the Chrome extension "Adblock for YouTube" (10M+ installs, Featured badge) contains the capability to execute arbitrary JavaScript code on visited pages, a feature not disclosed to users. The extension is currently dormant regarding this capability but the mechanism is present in the code.
Why it matters: If your Intune-managed Windows 11 fleet allows user-installed Chrome extensions, this is a live supply chain risk to browser sessions — including M365 GCC High. Use Intune or Group Policy to enforce an extension allowlist and block or remove this extension across managed endpoints.
Bluekit Phishing Kit Adopts Browser-in-the-Middle for Login Theft
The Bluekit phishing-as-a-service platform has added browser-in-the-middle (BitM) capabilities and expanded significantly, with nearly 70 new hostnames identified over the past week. BitM attacks proxy real login sessions in real time, bypassing traditional MFA by stealing authenticated session tokens.
Why it matters: Browser-in-the-middle attacks defeat standard TOTP and push-based MFA — including configurations common in GCC High tenants. Verify that phishing-resistant MFA (FIDO2/hardware keys or Windows Hello for Business) is enforced for all privileged accounts and CUI-adjacent applications in your Entra ID conditional access policies.
Windows 11 Can Now Roll Back Updates Within 72 Hours When They Go Bad
Microsoft has introduced a point-in-time restore feature for Windows 11 that provides a 72-hour window to roll back a problematic update without losing user data. The feature is designed to recover systems that become unstable or non-bootable after a patch is applied.
Why it matters: For an Intune-managed Windows 11 fleet, this reduces the operational risk of mandatory monthly patching — a key concern in CMMC environments where both timely patching (SI.3.219) and system availability are required. Validate how this feature interacts with your Autopatch or Update Ring configurations and whether rollback events will be logged and visible in Intune.