Massive Vuln/Exploit/DoS Wave: Record Patch Tuesday, CISA 3-Day Window, AI-Discovery Gap, Exploitarium Zero-Day Dump, FortiBleed, Bad Epoll Kernel Race Bug
Key Questions
What record was set during June 2026 Patch Tuesday?
June 2026 Patch Tuesday included a record 571 CVEs, with Adobe shifting to twice-monthly patches. CISA added several issues to its Known Exploited Vulnerabilities catalog and mandated a 3-day patching window for critical flaws.
How is AI affecting vulnerability discovery and disclosure?
AI-driven tools are outpacing traditional disclosure, with Mythos identifying a 29-year-old Squid leak and Tuskira reporting that 95% of AI-discovered vulnerabilities lack advisories. Google confirmed the first large-scale AI-driven exploit generation.
What zero-day releases came from the Exploitarium researcher?
The Exploitarium researcher published over 30 AI-fuzzed zero-days, including an actively exploited libssh2 RCE (CVE-2026-55200), challenging conventional coordinated vulnerability disclosure practices.
What is FortiBleed and how many devices does it target?
FortiBleed is a credential-harvesting campaign affecting more than 430,000 FortiGate devices, with actors reportedly collaborating with ransomware groups such as Inc and Lynx.
Which new critical vulnerabilities require immediate attention?
Notable issues include Fluentd RCE (patch to 3.0.9), Citrix NetScaler flaws with active exploitation within 24 hours, Progress Kemp LoadMaster pre-auth RCE (CVE-2026-8037), DCMTK path traversal, and the Bad Epoll kernel race bug with a 99% root exploit rate.
What data shows the growth in vulnerability submissions and AI impact?
ZDI reported a 490% increase in submissions, while autonomous exploit development now generates 10.5x more exploits. SecVulEval shows the best LLM agent achieves only 23.83% F1 on statement-level detection.
How are payment fraud and AI agent security evolving?
63% of consumers now prioritize security amid rising synthetic identity fraud, while a new framework stresses evaluating AI agents by blast radius and access scope for better prioritization.
What does the AI refactoring trend indicate for code security?
AI-generated refactoring PRs introduce 4.7% new Bandit findings, yet 73.5% are still merged, highlighting risks in automated code changes.
June 2026 Patch Tuesday set a record with 571 CVEs. CISA mandated 3-day patching for critical vulns. AI-driven discovery is outpacing disclosure: Mythos found a 29-year-old Squid leak, Tuskira reports 95% of AI-discovered vulns lack advisories, Google confirmed the first large-scale AI-driven exploit. Qihoo 360 claims a better-than-Mythos multi-agent swarm bug finder (Tulongfeng). GLM-5.2 now matches Mythos on bug-finding. The Exploitarium researcher released 30+ zero-days via AI fuzzing, including actively exploited libssh2 RCE (CVE-2026-55200), challenging CVD norms. New critical vulns: Fluentd RCE (patch to 3.0.9), Citrix NetScaler six vulns (active exploitation within 24h), Progress Kemp LoadMaster pre-auth RCE (CVE-2026-8037, CVSS 9.6), DCMTK path traversal (CVSS 9.8), Bad Epoll kernel race bug (99% root exploit rate, no workaround). FortiBleed credential harvesting targets 430k+ FortiGate devices. Adobe moved to twice-monthly patches. CISA KEV additions (Cisco SSRF, PTC RCE). New data: ZDI 490% submission increase, cURL 15-16% confirmation rate, Anthropic <1% patched stat. Autonomous exploit development now produces 10.5x more exploits, $2,200 for Windows kernel crashes, 12-minute Firefox PoCs. SecVulEval benchmark shows best LLM agent achieves only 23.83% F1 for statement-level vuln detection. AI refactoring PRs introduce 4.7% new Bandit findings, 73.5% merged. Payment fraud automation rising: 63% consumers prioritize security, synthetic identity fraud doubling. AI agent security prioritization framework emphasizes blast radius and access scope. New: Ill Bloom vulnerability in crypto wallets led to $3.1M theft.