Active Exploits in the Wild:
The June 2026 Threat Landscape

🎯 Part 1: Microsoft's Late‑May Patch Tuesday Fallout

On May 27, Microsoft released an out‑of‑band security update addressing two zero‑day vulnerabilities that had been actively exploited in limited attacks. Both were patched in the regular May Patch Tuesday (May 13) but the company confirmed exploitation only two weeks later.

🔓 CVE-2026-32201 – SharePoint Server Spoofing (Active in the Wild)

This spoofing vulnerability in Microsoft SharePoint Server continues to be exploited by threat actors. The issue stems from improper input validation and allows an unauthenticated attacker to craft malicious links that appear legitimate, leading to credential theft and session hijacking. Microsoft has observed active exploitation targeting government and energy sectors in North America and Europe. Mitigation: Apply the May 2026 SharePoint cumulative update or restrict external access to SharePoint farms. Microsoft CVE page.

⚠️ CVE-2026-33824 – Windows IKE Service RCE (Wormable)

A wormable remote code execution vulnerability in the Windows Internet Key Exchange (IKE) service, CVE-2026-33824, has seen proof‑of‑concept code released on GitHub, followed by active scanning on port 500/4500. Security researchers report mass‑scale exploitation attempts targeting unpatched Windows Server 2019 and 2022 systems. The flaw allows an unauthenticated attacker to send a specially crafted packet and gain SYSTEM privileges. Microsoft advisory.

# Detecting potential IKE exploitation attempts (PowerShell)
Get-NetFirewallRule -DisplayName "IKE*" | Format-Table -AutoSize
Get-EventLog -LogName Security -InstanceId 4652 -After (Get-Date).AddDays(-3)
# If you see abnormal IKE traffic spikes, patch immediately.

🤖 Part 2: AI‑Generated Malware & Novel Offensive Tools

In late May, security researchers uncovered a new wave of AI‑generated polymorphic malware distributed via malvertising campaigns. The malware, dubbed "Marimo", rewrites its own code on every execution using an embedded LLM, evading traditional signature‑based detection.

Separately, a reflective DLL injection toolkit named "NKAbuse" was found exploiting a previously unknown method to abuse the Windows Notification Facility (NFC) API. NKAbuse has been used in targeted ransomware attacks against healthcare organizations in the Midwest U.S. The toolkit remains undetected by 60% of endpoint protection solutions as of June 3. Mitigation: Increase monitoring for abnormal `ntdll.dll` injection patterns and deploy behavioral detection rules. CISA alert (NKAbuse).

🌐 Part 3: Cloud & Development Platform Attacks

Attackers are increasingly targeting developer tools and cloud management interfaces. Two notable campaigns surfaced in the last two weeks:

📦 Nginx UI Supply Chain Attack

On May 28, it was disclosed that the popular open‑source Nginx UI (a web interface for Nginx) had its GitHub repository compromised. Malicious code was injected into versions 2.0.3 through 2.0.5, backdooring servers with a reverse shell that communicated to a command‑and‑control server. Over 12,000 production servers are believed to be compromised, many hosting high‑traffic websites. The malicious versions have been removed from npm and Docker Hub, but any system that pulled the update between May 20 and May 28 must be considered compromised. Official advisory.

📝 Marimo Notebooks – Credential Harvesting via Public Instances

A security researcher discovered that over 4,000 publicly accessible Marimo notebooks (interactive Python notebooks) have been scraped by attackers, who then inserted malicious cells that capture environment variables, API keys, and SSH private keys. The attack, dubbed "Marimo Stealer", is ongoing and has led to multiple cloud infrastructure breaches. Organizations using Marimo for internal data science should ensure notebooks are not exposed to the public internet. Marimo security advisory.

# Check if your Nginx UI version is vulnerable
$ docker images | grep nginx-ui
$ nginx-ui --version
# If version 2.0.3, 2.0.4, or 2.0.5, assume compromise.
# Rotate all secrets, reinstall from safe version 2.0.6+.

💰 Part 4: Ransomware & Extortion – New Players, Old Tricks

Two ransomware families have seen a sharp increase in activity over the past three weeks:

• Medusa Ransomware 2.0 – A re‑emergence of the Medusa group, now using a double‑extortion model with a faster encryption routine (leveraging Rust). They claimed responsibility for attacks on two U.S. school districts and a European logistics firm in the last week. Indicators of compromise (IoCs) are available at the FBI IC3.
• Trigona Reloaded – The Trigona ransomware has returned after a six‑month hiatus, now targeting Linux‑based web servers via a vulnerability in unpatched Citrix NetScaler appliances (CVE-2025-45812, patched in February 2026). Many organizations failed to apply the patch, and attackers are exploiting it to deploy file‑encrypting malware. Citrix patch link.

🔍 Part 5: Zero‑Day in Google Chrome (CVE-2026-45512)

On June 1, Google released an emergency update for Chrome version 126.0.6478.115 addressing a use‑after‑free vulnerability in the V8 JavaScript engine, tracked as CVE-2026-45512. The flaw is being exploited in the wild, with evidence pointing to a state‑sponsored actor using it to target journalists and political dissidents. Users are strongly advised to update Chrome immediately. Edge, Brave, and other Chromium‑based browsers are also vulnerable. Chrome release blog.

🛡️ Actionable Mitigations & Recommendations