Security Risk Advisors

The post TB20260609 – Microsoft Patch Tuesday appeared first on Security Risk Advisors.

Trend Micro disclosed that CVE-2025-8088, a path traversal vulnerability in WinRAR patched in July 2025, continues to be actively exploited against Ukrainian organizations by two distinct Russia-aligned threat actor groups: SHADOW-EARTH-066 (tracked by CERT-UA as UAC-0226) and Earth Dahu (Gamaredon). Both groups produced new exploit samples ...

Veeam disclosed CVE-2026-44963, a critical vulnerability affecting Veeam Backup & Replication 12.3.2.4465 and earlier version 12 builds. The flaw allows remote code execution on the backup server by an authenticated domain user and carries a CVSS v4 score of 9.4. Veeam noted that the issue only impacts domain-joined backup servers, while...

Socket disclosed a coordinated PyPI supply chain compromise involving 37 malicious wheel artifacts across 19 packages, linked to the ongoing Mini Shai-Hulud and Miasma campaign family. The affected packages include widely used bioinformatics and research tools including dynamo-release, spateo-release, and coolbox, with cumulative download to...

Mandiant reported an ongoing financially motivated data theft extortion campaign by UNC3753, also tracked as Luna Moth, Chatty Spider, and Silent Ransom Group, targeting dozens of US legal, professional services, and financial services organizations from January through May 2026. The group relies heavily on voice ph...