Afternoon Review in IT Security — June 9, 2026

The IT security landscape continues to face mounting pressure from sophisticated supply chain attacks, critical zero-day vulnerabilities, and ransomware campaigns leveraging authentication bypass flaws. Today's threat intelligence reveals coordinated efforts targeting both open-source package repositories and enterprise infrastructure, demanding immediate attention from security teams across all sectors.

Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks

A significant supply chain campaign has compromised over 100 packages across multiple open-source repositories, with attackers deploying self-propagating malware variants. The most recent iterations of these attacks are designated as Miasma and Hades, representing an evolution in the threat actor's methodology and targeting scope. Source: Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks

Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks

A critical authentication bypass vulnerability in Check Point VPN infrastructure has become the focal point of active ransomware campaigns attributed to the Qilin group. The vulnerability allows attackers to establish VPN connections without requiring valid credentials, providing direct access to protected networks and enabling deployment of ransomware payloads. This zero-day represents a severe risk to organizations relying on Check Point infrastructure for remote access security. Source: Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks

Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer

The Hades campaign has specifically targeted the Python Package Index with a focused credential theft operation affecting 19 compromised packages. Attackers deployed 37 malicious wheel artifacts containing setup.pth files designed to execute automatically upon installation, capturing credentials from developers using the Bun runtime environment. This represents a refinement of earlier Miasma-style attacks, with threat actors tailoring payloads to specific development ecosystems and tools. Source: Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer

Google Patches New Chrome Zero-Day Flaw Exploited in the Wild

Google has released emergency security updates addressing another Chrome zero-day vulnerability actively exploited by threat actors in the wild. This marks the fifth zero-day flaw patched in Chrome since the beginning of 2026, demonstrating a concerning trend of in-the-wild exploitation targeting the widely deployed browser. Organizations must prioritize immediate deployment of these critical updates to mitigate active attack campaigns. Source: Google patches new Chrome zero-day flaw exploited in the wild

The convergence of supply chain attacks, infrastructure zero-days, and browser vulnerabilities underscores the complexity of the current threat environment. Security teams should prioritize patching critical systems, implementing enhanced monitoring of open-source dependencies, and establishing rapid response protocols for zero-day disclosures.