Morning Review in IT Security — June 6, 2026

The cybersecurity landscape continues to intensify as multiple critical threats emerge across supply chain ecosystems, cloud infrastructure, and industrial control systems. Today's briefing covers active exploitation campaigns targeting enterprise software, widespread compromises of open-source packages, and emerging vulnerabilities in critical infrastructure that demand immediate attention from security teams worldwide.

CISA Warns of Active SolarWinds Serv-U Exploitation

The Cybersecurity and Infrastructure Security Agency has issued an alert regarding active exploitation of a high-severity vulnerability in SolarWinds Serv-U. Threat actors are leveraging recently patched flaws to conduct denial-of-service attacks against affected servers. The vulnerability represents a significant risk to organizations relying on Serv-U for file transfer and remote access capabilities. Source: CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers

Miasma Malware Compromises 32 Red Hat npm Packages

A supply chain attack has resulted in the compromise of 32 Red Hat npm packages through a breached GitHub account. The Miasma malware family, along with the Mini Shai-Hulud variant, has been deployed to expose cloud tokens, CI/CD secrets, and developer credentials across affected systems. This incident underscores the persistent threat to open-source software repositories and the need for enhanced authentication controls on developer accounts. Source: Miasma Malware Hits 32 Red Hat Packages via Compromised GitHub Account

Chinese APT UNC5221 Deploys New Backdoors for Persistent Access

A Chinese espionage group tracked as UNC5221 has been maintaining access to compromised Microsoft 365 environments using multiple malware families including Brickstorm, Plenet, and the previously undocumented AgentPSD. The threat actor has demonstrated sophisticated persistence capabilities, leveraging these tools to maintain long-term access to victim networks while remaining undetected. Source: Chinese APT deploys new malware to keep access to hacked networks

npm Ecosystem Hit by IronWorm and Miasma Worm Variants

The npm package repository has become the target of coordinated supply chain attacks distributing both IronWorm, a Rust-based information stealer, and a self-spreading Miasma worm variant. Threat actors have poisoned over 50 legitimate packages to distribute these malicious payloads. The IronWorm stealer is particularly concerning due to its ability to scrape secrets from developer machines and hide behind an eBPF kernel rootkit, providing attackers with deep system access. Source: IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks

PAN-OS Vulnerability CVE-2026-0257 Under Active Exploitation

Palo Alto Networks has disclosed that CVE-2026-0257 in PAN-OS is currently under active exploitation by threat actors. The vulnerability enables authentication bypass attacks against affected firewall systems. Security researchers have identified multiple malicious IP addresses conducting exploitation attempts, and mitigation guidance has been released for organizations running vulnerable versions. Source: Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257

Claude Code GitHub Action Vulnerability Exposes Workflow Secrets

Microsoft Threat Intelligence has identified a prompt injection vulnerability in the Claude Code GitHub Action that could allow attackers to access workflow secrets under specific conditions. The research demonstrates how AI-powered CI/CD tools introduce new attack surfaces when integrated into development pipelines. Anthropic has implemented mitigations, and the disclosure highlights the importance of securing AI-powered automation tools in software development environments. Source: Securing CI/CD in an agentic world: Claude Code Github action case

Over 900 US Gas Station Tank Gauge Systems Exposed Online

Security researchers have discovered more than 900 automatic tank gauge systems across the United States exposed to internet-accessible attacks. These systems, which monitor fuel and chemical storage tanks in critical infrastructure sectors including gas stations, are vulnerable to unauthorized access and potential manipulation. The exposure represents a significant risk to fuel supply chain integrity and public safety. Source: Over 900 US gas station tank gauge systems exposed to attacks

Polyfill CDN Compromise Affects Toshiba and Muji Websites

Toshiba and Muji have warned customers of suspicious login prompts appearing on their websites following a compromise of the polyfill.io content delivery network. The attack leverages compromised polyfill domains including polyfill.com, polyfill.io, and polyfill.top to inject credential-harvesting prompts into legitimate websites. This incident demonstrates how third-party CDN compromises can rapidly affect multiple major organizations and expose user credentials to attackers. Source: Suspicious Polyfill login prompts pop up on Toshiba, Muji websites

Today's threat landscape reflects an escalating pattern of supply chain attacks, persistent advanced threats, and infrastructure vulnerabilities that require coordinated response efforts across industry sectors. Organizations should prioritize patching critical vulnerabilities, implementing supply chain security controls, and monitoring for indicators of compromise related to the malware families and threat actors highlighted in this briefing.