22nd June – Threat Intelligence Report

Sicherheitsmeldung mit Schweregrad hoch. Sie wird laut CISA-KEV aktiv ausgenutzt und sollte priorisiert behandelt werden. Betroffene Kennungen: CVE-2026-20245, CVE-2026-33017, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

For the latest discoveries in cyber research for the week of 22nd June, please download our Threat Intelligence Bulletin.

TOP ATTACKS AND BREACHES

Texas Parks and Wildlife Department has been affected by a third-party data breach involving its license system vendor. The incident exposed driver’s license information, passport numbers, emails, phone numbers, and residential addresses for 3,087,721 hunting and fishing license customers. Social Security numbers and payment data were not affected. ShapedPlugin, a WordPress plugin vendor, has faced a supply chain attack that delivered malicious updates for three paid plugins through its official updater. The malware installed a hidden fake WooCommerce plugin to steal admin, database, and 2FA credentials and modify affected websites. Incident analysis tied the compromise to vendor release infrastructure. iRhythm Technologies, a US digital health company focused on remote cardiac monitoring, has experienced a cyberattack involving third-party-hosted business applications. The company confirmed that attackers stole protected health information, proprietary data, and other personal data through a social engineering attack. Clinical systems were not affected. Market intelligence platform Klue has confirmed a breach after attackers used compromised legacy integration credentials to steal OAuth tokens connected to customer Salesforce environments. The tokens enabled theft of sales and customer data from several clients, including Huntress, Recorded Future, Tanium, and Jamf. The Icarus extortion group claimed responsibility.

AI …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2026-20245, CVE-2026-33017, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/
• Priorität HOCH: laut CISA-KEV aktiv ausgenutzt – bevorzugt patchen.
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.
• Erkennung: Logs und Indikatoren (IoCs) auf Ausnutzung prüfen.