June 2026 in security — the breaches and bugs that mattered
A plain-language recap of the month's biggest cyber events: a wave of supply-chain breaches through trusted connections, a university-wrecking ERP zero-day, the largest Patch Tuesday on record, and the edge devices that keep getting torn open. What happened, and the one lesson from each.
June 2026 was not a quiet month. Two storylines ran through it: a wave of attacks that stole data through trusted third-party connections, and a steady drumbeat of zero-days in the very devices and systems organizations rely on to function. Underneath the headlines, the same handful of lessons kept repeating. Here is the month in plain language — what happened, and the one thing to take from each.
The breaches that mattered
ShinyHunters and the Oracle PeopleSoft zero-day. A financially motivated group exploited an unpatched flaw in Oracle's PeopleSoft to break into 100-plus organizations, about two-thirds of them universities, stealing deeply sensitive student records and extorting victims. The University of Nottingham alone had roughly 455,000 records exposed. Takeaway: your back-office ERP is a crown-jewel target, not a quiet utility — get it off the public internet and patch it fast.
LastPass, via Klue. Attackers breached a market-intelligence vendor called Klue, stole the OAuth tokens it held, and used them to pull Salesforce data from LastPass and a dozen other firms — many of them security companies. No passwords were cracked; LastPass password vaults were not touched. Takeaway: your security perimeter now includes every SaaS vendor's tokens — audit third-party app connections and rotate integration credentials.
UN World Food Programme. Attackers accessed the self-registration app that people in Gaza use to enroll for food and cash aid, exposing data on roughly 600,000 households — names, ID numbers, phone numbers, and locations. Takeaway: humanitarian data on vulnerable people is uniquely dangerous if leaked — collect less, and guard aid registries like financial systems.
Tchap, the French government messaging app. An attacker hijacked an account and pulled data from public, non-encrypted chat rooms, affecting more than 73,000 public-sector accounts. Private encrypted messages were not compromised. Takeaway: encryption protects message contents, not the account perimeter — one social-engineered login still exposed plenty.
TVING, a South Korean streaming service. Unauthorized database access exposed user data including identity-verification tokens and refund account numbers; a regulator put the scale near 19.5 million people. Takeaway: verification tokens and bank-refund details are durable, reusable identifiers — encrypt them and keep less.
Texas Parks and Wildlife. A breach at the vendor running the state's hunting and fishing license system exposed more than 3 million people's data, including passport numbers. Takeaway: you inherit your vendors' risk — third-party processors hold passport-grade data and need the same standards you hold yourself to.
ServiceNow. A custom interface left with authentication switched off let outsiders query customer data tables. ServiceNow says the activity it saw was researchers and customers rather than confirmed malicious use, but the exposure was real. Takeaway: a single auth setting left off can expose an entire tenant — audit the defaults on your custom integrations.
The bugs under active attack
A quick note on what "actively exploited" means: when the U.S. cybersecurity agency adds a flaw to its Known Exploited Vulnerabilities catalog, it is confirming attackers are using it right now — and the clock on patching has already started. June saw an unusually heavy run of these.
Check Point VPN (CVE-2026-50751). An authentication bypass, severity 9.3, exploited as a zero-day and linked with medium confidence to a ransomware affiliate. Lesson: deprecated protocols left switched on are live attack surface.
Cisco Catalyst SD-WAN Manager (CVE-2026-20245). A flaw letting an attacker with admin access escalate to full root on the system that controls the whole network fabric — Cisco SD-WAN's seventh exploited zero-day of the year. Lesson: network-management planes are root-level prizes; lock down and monitor admin access.
Splunk Enterprise (CVE-2026-20253). An unauthenticated remote-code-execution flaw, severity 9.8, with public exploit code appearing within days of the fix. Lesson: your security tools are themselves high-value targets — patch them first, not last.
Ubiquiti UniFi OS (CVE-2026-34908). A maximum-severity flaw in widely deployed network gear, chainable with others into full remote takeover. Lesson: internet-reachable network hardware at severity 10 demands same-week patching.
PTC Windchill (CVE-2026-12569). The first-ever in-the-wild exploitation of this manufacturing/product-lifecycle platform, an unauthenticated code-execution bug. Lesson: attackers are moving into manufacturing and operations software — extend patch discipline beyond traditional IT.
Google Chrome (CVE-2026-11645). The fifth actively-exploited Chrome zero-day of 2026, in the browser's JavaScript engine. Lesson: browser zero-days remain a top way in — enforce auto-update and treat Chrome patches as urgent.
Patch Tuesday: the biggest on record
Microsoft's June 9 update was the largest Patch Tuesday ever, fixing around 206 vulnerabilities, including 37 rated critical. Three were publicly disclosed ahead of the patch, though none were being exploited at release.
Adobe shipped fixes for 123 issues, including two maximum-severity flaws in its Campaign product. SAP's update was led by a severity-9.9 authentication bypass in NetWeaver. The takeaway when the patch list runs into the hundreds: you cannot do everything at once, so triage by exploitability. Ship the unauthenticated, internet-reachable, remote-code-execution fixes first, then work down.
The through-line
Strip away the names and the same few lessons run through every story this month.
Most attacks started in two places: internet-facing systems (VPNs, ERP servers, network gear) and trusted third-party connections (the OAuth tokens and vendors you wired into your core platforms). Those are the two frontiers worth most of your attention. The patch window has collapsed to days — by the time a flaw is publicly known, it is often already being used, so emergency patching is now a core capability, not an annoyance. And because none of this is fully preventable, the durable move is to assume breach and limit blast radius: segment networks, minimize the data you keep, govern your integrations, and know your dependencies — including the ones you cannot see. The specific breaches will be different next month. The lessons, almost certainly, will not.