In June 2026, security developments were largely centred on identity, remote access, and the risks associated with trusted systems. Attackers continued to target VPN infrastructure, enterprise platforms, and account recovery processes, as these can provide direct access to organisational environments without relying on traditional malware. Several incidents also demonstrated how third-party systems and automated tools can create unintended access paths when they are granted excessive trust or permissions. The month also brought a substantial Microsoft security update, with fixes released across a broad range of enterprise products.
Happenings
[US] NYC Health + Hospitals Breach Exposes Data of 1.8 Million People
A breach impacting NYC Health + Hospitals, the largest public healthcare system in the United States, exposed sensitive data belonging to at least 1.8 million people, making it one of the most serious publicly reported healthcare breaches of 2026. The breach appears to have been linked to a third-party vendor, although NYC Health + Hospitals did not name the specific vendor involved. NYC H+H detected suspicious activity on 2 February 2026 and took steps to secure their network but indicated that attackers had access to systems from 25 November 2025 until 11 February 2026, and that the attackers exfiltrated files during this time.
The stolen data was comprehensive and included patients’ health insurance plan and policy information, medical information such as diagnoses, medications, tests, and imagery, as well as billing, claims, and payment information. Other government-issued identity documents, including Social Security numbers, passports and driver’s licences, are believed to have also been compromised. The inclusion of fingerprints and palm prints increases the long-term risk, as biometric data cannot be updated or reset in the same way as account credentials. The extended period of unauthorised access raises questions about detection, vendor access monitoring, and remote access controls, as the attackers were able to remain active for several months before the incident was contained.
Third-party risk management needs to be treated as a core security function, with strong monitoring and strict access controls for vendors. Organisations should also apply data minimisation, review vendors and system access to information required to deliver services.
[Global] Oracle PeopleSoft Zero-Day Used in Data Theft and Extortion Campaign
Oracle released an emergency advisory for CVE-2026-35273, a critical zero-day vulnerability affecting Oracle PeopleSoft PeopleTools. PeopleSoft is Oracle’s enterprise application suite, with products that support business functions including human resources, finance, procurement, supply chain management, and student administration. It remains widely used by large organisations, particularly universities, government agencies, and large enterprises, and is used at University of Auckland, the University of Minnesota, the State of Tennessee, the City of New York, and the US National Association of Insurance Commissioners (NAIC).
The attack was attributed to ShinyHunters, who are believed to have used the compromise as a bridge into connected internal systems for post-exploitation activities, primarily data theft. The most clearly reported data-theft case involved NAIC, where ShinyHunters claimed to have stolen 3.1TB of data after using the PeopleSoft compromise to obtain credentials and move laterally to internal storage locations. Public reporting also described a wider extortion campaign affecting higher education and other organisations, with claims that more than 100 organisations and hundreds of PeopleSoft instances were compromised. Outside the NAIC case, victims were not publicly named, and the extent of confirmed data theft remains less clear.
Third-party and vendor-managed platforms that hold sensitive business data often rely on service accounts, database connections, integration keys, and automation credentials, which can extend an attacker’s reach if they are over-permissioned or poorly protected. Organisations must understand how these systems are exposed, what data they hold, which integrations they rely on, and whether their configurations have been independently reviewed. Regular penetration testing, configuration reviews, and access assessments are important where these platforms are internet-facing or connected to internal storage and cloud environments.
[Global] Network Edge Devices – Check Point Unauthenticated Network Access Zero-Day / FortiBleed
Check Point released emergency fixes for a critical zero-day vulnerability affecting some of its VPN and remote access products. Tracked as CVE-2026-50751, the flaw was rated critical with a CVSS score of 9.3 and affected Check Point Remote Access VPN, Mobile Access, and Spark Firewall deployments using the deprecated IKEv1 protocol. The vulnerability allowed an attacker to abuse a logic flaw in certificate validation to bypass authentication and establish a VPN session without a valid user password, creating a direct path into affected environments. The vulnerability was concerning because it had already been exploited in the wild before patches were available, with Check Point reporting that exploitation began in early May, while the patch was not made available until early June. A notable compromise was linked to the Qilin ransomware-as-a-service operation, demonstrating the importance of securing perimeter defences and how quickly initial access can be turned into a broader environment-wide incident by established ransomware operators.
Also occurring in June, researchers reported a large credential-harvesting campaign targeting Fortinet FortiGate firewalls and SSL VPN gateways. The activity, dubbed FortiBleed by third-party researchers, was described as a financially motivated access operation rather than a single new Fortinet vulnerability. Reporting from SOCRadar and others indicated that attackers had been scanning internet-facing systems at scale, fingerprinting hundreds of thousands of FortiGate devices and harvesting credentials from compromised or exposed environments. The campaign was significant because it turned perimeter infrastructure into a source of reusable access, where rather than simply compromising one firewall and moving on, the operators appeared focused on collecting credentials that could be used, resold, or fed into later intrusion activity. SOCRadar reported the use of custom sniffing capability to capture authentication material, while Fortinet described the incident as a credential and access campaign and noted that it was not being treated as a new product vulnerability.
VPN appliances are high-value targets because they give attackers legitimate-looking remote access into the environment, often with broader internal reach than a single compromised endpoint, where the initial foothold can turn to reconnaissance, credential theft, and lateral movement. The incident reinforces the value of moving from traditional VPN access to a ZTNA model, where users are granted access to specific applications based on identity, device posture, and policy, rather than being placed broadly onto the internal network. This limits the reach of a compromised remote access path and provides a stronger control point for modern hybrid environments.
[US] Meta’s AI Support Bot used to Seize Instagram Accounts
In May 2026, attackers exploited a flaw in Meta’s AI-powered customer support assistant to take over Instagram accounts. This exploit relied on the AI chatbot having the access to backend management functions such as email changes and password resets, allowing attackers to use simple techniques such as VPN based geo-spoofing to mimic the victims, before asking the chatbot to update account details, primarily the email address associated with the account. The chatbot would then send password reset codes directly to the attacker’s email addresses using the legitimate account recovery flow, which would enable the attackers to take over accounts within minutes. The impact included the compromise of high-value and sensitive accounts, including the Obama-era white house account and the account of the U.S. Space Force’s chief master sergeant. The attack required no malware, phishing, or toolkit of any kind, and instead exploited logical flaws in the AI system, combined with its wide powers to facilitate account changes with no human oversight.
The attack showed how emerging AI systems can introduce new identity and access risks, with attackers being able to bypass traditional authentication controls by interacting with or manipulating chat bots. This incident highlights the need for strict access controls and verification layers in AI-driven systems, especially when they have the bypass or update access controls. Organisations should confirm that AI tools cannot perform actions like this without authentication checks, or human escalation paths.
Techniques and Updates
MCP Tool Poisoning Creates New Risks for AI Agents
MCP tool poisoning is an emerging attack technique affecting AI agents that connect to external tools through the Model Context Protocol or similar tool frameworks. Rather than directly attacking the model, the attacker manipulates the tool metadata or description that the agent relies on to decide what a tool does and when it should be used. For example, a tool that appears to “summarise documents” could include hidden instructions to extract email addresses, contract details, or invoiced data and pass them to another tool or external service, while still producing a normal-looking summary for the user. Microsoft describes this as an agentic supply chain risk, where a trusted AI agent can be manipulated into taking unauthorised actions even though each individual tool call may appear normal.
This is particularly concerning as AI agents move from reading information to acting on it, including querying databases, sending messages, modifying records, or triggering workflows. Research into MCP security has also shown that misleading or inconsistent tool descriptions can shape agent behaviour, creating a gap between what a tool claims to do and what it performs. Organisations adopting AI agents should therefore treat connected tools as part of the security boundary. Controls should include an approved tool registry with review of tool descriptions, least privilege tool permissions, human approval controls for high-risk actions, logging, and monitoring for unusual agent activity.
Microsoft Passkey Registration Campaigns Hijacked
Threat actors are abusing Microsoft Entra passkey enrolment in a vishing (voice call phishing) campaign targeting Microsoft 365 users. The campaign has been identified as running since May of this year, in response to changes made by Microsoft in March to allow tenants to run registration campaigns asking their users to configure passkeys. The attack involves attackers calling members of organisations and impersonating help desks or security teams, to convince users that they need to register a new passkey for security compliance reasons. The phishing kit used allows attackers to mirror a legitimate Microsoft sign in flow and allows them to generate legitimate passkeys under their control in real time as victims enter their account details, and even complete MFA.
While the registration campaign changes are intended to improve adoption of phishing-resistant MFA, it has created a window that is able to be abused by malicious parties to take control of organisational accounts, before moving on to post-exploitation activities, such as invoice interception, or phishing campaigns generated from the breached accounts. Organisations should review their registration campaign settings, as when set to Microsoft managed the tenant may begin the registration campaign based upon the allowed authenticator methods, without the immediate knowledge of tenant administrators. For organisations who wish to legitimately run a passkey registration campaign, we recommend pairing passkey rollouts with clear user communication and to monitor new authentication method registrations.
Microsoft Security / Updates
Microsoft’s June 2026 security updates were one of the larger Patch Tuesday releases of the year, addressing a reported 206 vulnerabilities across Windows, Microsoft Office, Azure, Visual Studio, SQL Server, Hyper-V, and other Microsoft products. The release included dozens of Critical vulnerabilities and three issues that had already been publicly disclosed before patches were available, making it a significant month for organisations managing Microsoft-heavy environments.
Several of the more important fixes affected core Windows and enterprise infrastructure components. Microsoft addressed CVE-2026-47291, a critical Windows HTTP.sys remote code execution vulnerability that could allow an unauthenticated attacker to send crafted traffic to a system using the Windows HTTP protocol stack. The same release also fixed CVE-2026-49160, a publicly disclosed HTTP.sys denial-of-service vulnerability associated with the HTTP/2 Bomb technique, which could allow crafted web requests to crash affected Windows servers.
Remote access and virtualisation components were also included in the June cycle. CVE-2026-42985 affected the Microsoft Remote Desktop Client and could allow remote code execution if a user connected to a malicious or compromised RDP server. Microsoft also patched multiple Hyper-V vulnerabilities, which are relevant in enterprise environments where virtualisation platforms host sensitive workloads or provide a path between guest and host boundaries if compromised. The release also included privilege escalation and security feature bypass fixes that matter once an attacker already has some level of access. CVE-2026-45586 affected the Windows Collaborative Translation Framework, also known as CTFMON, and could allow local privilege escalation. Microsoft also addressed CVE-2026-50507, a publicly disclosed BitLocker security feature bypass involving physical access to a device. The June release was not only large by volume, but also relevant across remote access, web services, virtualisation, endpoint protection, and post-compromise escalation paths.