Threat Intelligence Brief - Tuesday, June 9, 2026

Executive Signal

• Check Point VPN zero-day is under active ransomware exploitation — Qilin affiliates have abused an authentication bypass since at least early May, enabling passwordless VPN access. CISA has issued a 3-day patch mandate for federal agencies; private sector should treat this with equivalent urgency.
• Two Chrome zero-days patched this week — Google has addressed five actively exploited Chrome flaws in 2026. CVE-2026-11645 is confirmed exploited in the wild; browser fleet patch compliance is a live exposure issue, not a scheduled maintenance item.
• LiteLLM RCE (CVE-2026-42271) added to CISA KEV — Unauthenticated remote code execution in an AI gateway layer is now confirmed exploited. All internet-facing or internally accessible LiteLLM deployments require immediate remediation.
• Three stories this week involve CISA KEV additions or directives — The volume of confirmed, actively exploited vulnerabilities is elevated. Vulnerability management teams should cross-reference current patch queues against this week’s KEV updates.

Immediate Action Required

High-Impact Developments

Qilin Ransomware Exploiting Check Point VPN Zero-Day (Active Since Early May)

• What happened: A critical authentication bypass in Check Point Remote Access VPN and Mobile Access allows attackers to establish VPN connections without valid credentials. Qilin affiliates have exploited this flaw since at least early May. CISA has issued an emergency directive requiring U.S. federal agencies to patch within three days.
• Why it matters: Passwordless VPN access is a direct path to network intrusion and ransomware deployment. The exploitation window exceeds one month, meaning undetected footholds may already exist. CISA’s 3-day mandate reflects confirmed, widespread exploitation — not theoretical risk.
• Who should care: CISOs running Check Point remote access infrastructure; SOC teams hunting for unauthorized VPN sessions dating to early May; vulnerability management leads responsible for patch SLA compliance.
• Recommended action: Apply Check Point’s patch immediately. Pull VPN authentication logs from May 1 onward and review for anomalous source IPs, off-hours access, and accounts with no prior VPN history. Do not defer to a scheduled maintenance window.
• Confidence: High — confirmed exploitation, CISA directive issued, corroborated by multiple independent sources.
• Search metadata: T1190, Qilin, Check Point Remote Access VPN, Check Point Mobile Access

LiteLLM CVE-2026-42271 — Unauthenticated RCE Now Actively Exploited

• What happened: CISA added CVE-2026-42271 (CVSS 8.7) in BerriAI’s LiteLLM to its Known Exploited Vulnerabilities catalog. The flaw is a command injection vulnerability that chains to unauthenticated remote code execution. Active exploitation is confirmed.
• Why it matters: LiteLLM is widely used as an AI proxy and gateway layer routing requests across multiple LLM providers. Unauthenticated RCE at this layer gives an attacker full host access without credentials, with lateral movement as the immediate next step. AI tooling is routinely deployed without the security scrutiny applied to traditional enterprise software.
• Who should care: Security architects and cloud security teams with LiteLLM in any environment; SOC leaders who may lack visibility into AI tooling running in developer or data science environments.
• Recommended action: Inventory all LiteLLM deployments immediately, including shadow IT and developer-owned instances. Apply the patch or take the service offline if patching cannot be completed promptly. Confirm whether any instances are internet-facing.
• Confidence: High — CISA KEV listing with confirmed active exploitation.
• Search metadata: CVE-2026-42271, T1190, LiteLLM, BerriAI

Google Chrome Zero-Days — Fifth Exploited Flaw Patched in 2026

• What happened: Google patched multiple actively exploited Chrome zero-day vulnerabilities this week, bringing the 2026 total to at least five. CVE-2026-11645 is confirmed exploited in the wild and was reported by an anonymous researcher in late April.
• Why it matters: The 2026 cadence of Chrome zero-days is abnormally high. Each unpatched instance is a drive-by compromise vector — a user visiting a malicious or compromised page can be exploited without further interaction. Credential theft and initial access are the primary downstream risks.
• Who should care: IT security and endpoint teams responsible for browser fleet management; SOC leaders monitoring for initial access indicators.
• Recommended action: Verify Chrome auto-update policies are enforced across all managed endpoints. Manually push updates where auto-update is delayed or disabled. Prioritize endpoints used for privileged access or financial operations.
• Confidence: High — confirmed exploitation, patch available.
• Search metadata: CVE-2026-11645, Google Chrome

Monitor Only

• No additional items surfaced in this brief above the monitoring threshold. All three clusters warranted immediate or near-immediate action.

Analyst Observation

Three separate confirmed exploitation events landed in the same window: a VPN authentication bypass enabling ransomware access, an RCE in AI infrastructure, and a browser zero-day. The Check Point situation is the most acute — a month-long exploitation window means incident response teams should be hunting for existing compromise, not just patching forward. The LiteLLM finding warrants attention beyond its CVSS score. AI tooling is being deployed faster than security teams can inventory it, and this is the predictable result. If your organization has not formally catalogued its AI stack exposure, this is the forcing function to do it.

Source Links

• Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks — https://www.securityweek.com/check-point-vpn-zero-day-exploited-in-qilin-ransomware-attacks/
• CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day — https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/
• Check Point VPN Flaw Exploited Since Early May — https://www.darkreading.com/vulnerabilities-threats/check-point-vpn-flaw-exploited-early-may
• LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE — https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html
• Google patches new Chrome zero-day flaw exploited in the wild — https://www.bleepingcomputer.com/news/security/google-patches-fifth-chrome-zero-day-bug-exploited-in-attacks-this-year/
• Google Patches 5th Chrome Zero-Day Exploited in 2026 — https://www.securityweek.com/google-patches-5th-chrome-zero-day-exploited-in-2026/

Generated by DevSecOpsDadAttack cyber threat intelligence.