CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog in June 2026 — Android Framework RCE, Linux kernel privesc, Oracle WebLogic access, PAN-OS VPN bypass, and trojanized Daemon Tools builds. Here is what defenders need to know and do.
Three AI-adjacent CVEs hit CISA's KEV catalog in one month: the LiteLLM proxy auth bypass exposing every prompt your org ever sent, a Linux kernel privesc reaching GPU training clusters, and PAN-OS as the beachhead. Living off the LLM, explained.
April 2026 was one of the most volatile months in cybersecurity history: Microsoft's 167-flaw Patch Tuesday, exploited SharePoint and IKE zero-days, ransomware at Rockstar and McGraw-Hill, and two CISA emergency directives — everything defenders need to know.