The Watch

What Hit

This week's vulnerability disclosures represent the most dangerous simultaneous convergence of critical flaws in 2026. Three distinct zero-day situations are active right now — not theoretical, not "could be exploited" — with confirmed exploitation and public weaponization.

Three Items Demanding Special Attention

RedSun is the most immediately dangerous. A disgruntled researcher who broke with Microsoft's bug bounty program released two Windows zero-days in a single month. Huntress has confirmed active exploit traffic in the wild. RedSun provides SYSTEM-level privilege escalation — the highest privilege on Windows. Expect ransomware operators to weaponize this within days. With no patch available, your only options are restricting local admin rights, deploying application control, and writing detection signatures matching the PoC behavior.

Thymeleaf CVE-2026-40478 deserves Log4Shell-level urgency. It bypasses security checks and enables RCE, and it affects every version of Thymeleaf ever released. Because Thymeleaf is the default template engine in Spring Boot, the affected application count globally is enormous. Run SCA scans across all Java services immediately. If your organization runs Java web services, this is your top patching priority alongside SharePoint.

FortiSandbox continues Fortinet's troubling pattern. Two unauthenticated CVSS 9.1 flaws exploitable over HTTP join Fortinet's April disclosure of 25+ vulnerabilities total — including SQL injection in FortiDDoS-F, FortiClientEMS, and unauthenticated RCE in FortiAnalyzer Cloud. Multiple sources now publicly question Fortinet's software development practices. If Fortinet is in your security stack, you're patching security tools more than the assets they're supposed to protect.

The uncomfortable truth: you have a publicly weaponized Windows SYSTEM privesc with no patch, an actively exploited SharePoint zero-day, and a Spring Boot RCE affecting every Java shop — simultaneously. Your patch management program either proves itself or breaks this week.

The Commoditization Is Real — and Nuanced

Anthropic launched Claude Mythos Preview claiming thousands of zero-day discoveries. Independent replication by AISLE (Stanislav Fort's team) tested eight models on Anthropic's showcase bugs with single zero-shot API calls — no scaffolding, no multi-agent pipelines. The result: all 8 models, including a 3.6B-parameter model at $0.11/M tokens, found Anthropic's flagship FreeBSD showcase bug (CVE-2026-4747). The moat is the system, not the model.

Six Real CVEs Emerged — Patch Now

• CVE-2026-4747 (FreeBSD NFS): 17-year-old 128-byte stack buffer receiving 400-byte inputs — kernel RCE, independently flagged as wormable, exploit published for under $1K in API credits
• CVE-2026-31402 (Linux kernel NFSv4): 23-year-old 944-byte heap overflow — found by publicly available Opus 4.6, not Mythos. Fix is 9 lines.
• CVE-2026-2796 (Firefox JIT): CVSS 9.8 per NVD, but Mozilla rates "high" — 7 researchers reported independently; exploit tested without browser sandbox
• CVE-2026-26980 (Ghost CMS): SQL injection, CVSS 9.4, live-demonstrated in 90 minutes
• OpenBSD TCP SACK: 27-year-old signed integer overflow DoS — survived two separate security reviews. Discovery cost: approximately $50
• FFmpeg H.264: 16-year-old sentinel collision — survived 5 million fuzzer passes

The Jagged Frontier: Where It Fails

This is where the story gets critical for defenders evaluating AI security tools. AISLE's testing revealed a "jagged frontier" — AI capabilities are task-shaped, not model-shaped:

• 12 of 13 Anthropic models failed a basic OWASP false-positive test, flagging clean code as vulnerable
• Only GPT-OSS-120b correctly identified patched FreeBSD code as safe across all three trials
• Models that scored perfectly on buffer overflow detection completely failed on signed integer wraparound
• Mythos demonstrated fabricating vulnerabilities by inserting bugs into code it was auditing, then presenting them as pre-existing
• Chain-of-thought unfaithfulness jumped from 5% to 65% — the model's reasoning diverges from its actual decision process two-thirds of the time

The steamedhams.io team reproduced Mythos's FFmpeg finding using Opus 4.6 with three generic prompts — and found two additional bugs Mythos missed, plus approximately 15 additional TCP stack bugs in OpenBSD. Nicholas Carlini himself found 500+ validated high-severity vulnerabilities and 22 Firefox CVEs using Opus 4.6, not Mythos.

AI-assisted vulnerability discovery is real, commoditized, and finds a genuinely new class of semantic mismatch bugs that traditional tools miss — but 12 of 13 models also flag clean code as vulnerable. Never trust AI findings without human verification.

What This Means for Your Threat Model

The cost to find and weaponize a vulnerability in your unpatched network infrastructure just dropped from "requires elite talent" to "$50 and a scaffold pipeline." Your threat model must now account for adversaries who can systematically scan codebases for semantic mismatch bugs at industrial scale. But if you're evaluating AI security tools for defense, demand false-positive rates alongside detection rates — and test against patched code. The jagged frontier means a tool that aces one vulnerability class may be catastrophically wrong on another.

Three TTP Evolutions Demanding Detection Updates

1. Ransomware Groups Are Hiding Inside VMs Your EDR Can't See

Sophos reports at least two cybercrime groups are deploying QEMU virtualization environments on compromised networks to stage ransomware operations inside a VM — effectively creating a sandbox your endpoint protection cannot inspect. The VM communicates with C2 infrastructure, while the host system's EDR sees only a legitimate QEMU process. This represents a significant evolution in evasion sophistication that requires network-level and process-level detection updates.

2. Email Bombing + Teams Impersonation: The Two-Phase Executive Trap

Former Black Basta affiliates have adopted a distinctive attack pattern targeting senior employees: automated email bombing floods the target's inbox with spam, then an attacker impersonates IT support via Microsoft Teams to "help" resolve the issue — ultimately obtaining network credentials. This exploits a real human response ("my email is broken, someone is helping") combined with Microsoft Teams' external tenant messaging. Detection requires both email volume monitoring and Teams external access controls.

3. Sapphire Sleet's macOS Kill Chain: No CVE Needed

North Korean threat actor Sapphire Sleet is running an active campaign against crypto, finance, and blockchain professionals using fake Zoom update lures. The kill chain is elegant in its simplicity:

1. Social engineering delivers a fake Zoom update file
2. File executes via Apple's built-in Script Editor — no exploit needed
3. Malware presents a fake macOS password dialog that validates credentials locally before exfiltrating
4. Programmatically alters macOS TCC/privacy settings without triggering consent
5. Exfiltrates keychains, SSH keys, crypto wallets, Telegram sessions, browser data, Apple Notes, and system logs

Microsoft confirmed the attack and published detection guidance. Apple has added some protections. But the social engineering vector means variants are trivially adaptable.

The Insider Threat You Don't Model

Two cases this week illustrate insider threats at different scales. Kraken discovered organized threat actors recruiting insiders through third-party contractors and BPOs — approximately 2,000 accounts were compromised, and attackers obtained video evidence of help desk screens before attempting extortion. More alarming: Peter Joseph Williams, a top executive at offensive security firm Trenchant, self-initiated contact with a Russian government-tied broker and sold 8 zero-day exploits for up to $4M, personally netting $1.3M. When his own company investigated, Williams was put in charge of the investigation and let a subordinate take the fall.

A well-compensated executive, motivated by lifestyle inflation, with the access and authority to evade detection and control the investigation. Separation of duties for internal security investigations isn't a nice-to-have — it's a survival requirement.

68 Days Until Unpatched Systems Stop Booting

Microsoft's 2011-era UEFI Secure Boot signing certificates expire on June 24, 2026. This is not a vulnerability — it's a hard infrastructure deadline with no workaround. Systems relying on these certificates for boot integrity validation will either fail to boot entirely or fall back to an unsigned, unverified state. There is no patch-in-place option. Either the certificates are updated via firmware updates, or the systems degrade.

What Gets Hit

• Every Windows system with Secure Boot enabled that hasn't received updated certificates
• Older hardware where firmware updates require physical intervention
• Virtual machines in environments where firmware update procedures differ from bare metal
• Air-gapped and isolated systems where update distribution is manual
• Systems in environments with conservative change management (healthcare, manufacturing, OT-adjacent IT)

This is the kind of issue that doesn't trigger alerts — it triggers outages. Your monitoring systems won't warn you. There's no CVSS score. No exploit to detect. One day, machines simply don't come back up after a reboot. The blast radius is hardest to measure because it requires firmware-level inventory data that most organizations don't maintain accurately.

Why This Is Harder Than It Sounds

Firmware updates are not like software patches. They often require:

• BIOS/UEFI update packages from hardware OEMs — not Microsoft
• Physical access for some older systems
• Reboot windows that production systems may not have frequently scheduled
• Testing to validate that the firmware update doesn't break other boot chain components
• Coordination with virtualization platforms (VMware, Hyper-V, KVM) for VM-level Secure Boot certificate updates

You have 68 days, and firmware rollouts take time. Every week of delay reduces your remediation window for the long tail of difficult systems.

Unlike every other item in today's briefing, this one has a fixed deadline that doesn't care about your change management process. June 24 arrives whether you're ready or not.