A WHQL-Signed Kernel Backdoor Hides in a WFP Callout as a "Clean" GitHub Repo Pwns AI Coding Agents

A Microsoft-signed Windows driver was found carrying a full network-accessible backdoor that lives entirely in kernel space, a sharp reminder that “WHQL-signed” is not “trustworthy.” Separately, researchers showed a benign-looking GitHub repository that coaxes agentic coding tools into executing hidden malware. A Cisco Unified CM flaw is also under active exploitation within 24 hours of disclosure.

Offensive & Research

Nextron dissected wskmon.sys, a WHQL-signed kernel driver that registers a Windows Filtering Platform (WFP) stream callout, intercepts inbound TCP traffic, hunts for a custom “NTF” packet, verifies an HMAC-SHA256, decrypts the payload, and executes commands from kernel context. There is no IOCTL, no user-mode agent, and no injected DLL — any inbound TCP service (even a plain Python HTTP server) can serve as transport, making it a stealthy and signature-resistant implant. Nextron

Vulnerabilities & Exploits

Cisco Unified Communications Manager (CUCM) is being weaponized in the wild within 24 hours of disclosure; the flaw enables server-side request forgery (SSRF) and root-level privilege escalation against Unified CM and Unified CM SME, and CISA has set a Sunday deadline for federal agencies to patch. Dark Reading, BleepingComputer
CVE-2026-45504 lets any low-privileged Microsoft Exchange user read arbitrary files from the system without authorization; a write-up and working PoC are public. HawkTrace
CargoWise WebTracker ships hardcoded crypto keys and flawed session handling, letting attackers forge tokens, bypass auth, persist sessions, enumerate data, and reach RCE via deserialization — a near-total platform compromise. SECURELAYER
Slow JSON Stream is a low-bandwidth DoS that hangs unprotected JSON parsers: 64 connections trickling 1 byte/sec without completing the body can take down PHP/Laravel stacks in under two minutes. Timeouts and rate limits mitigate it. cr0hn

AI & Model Security

A clean GitHub repository can trick agentic coding tools into running a malicious payload that stays invisible to security scanners, AI agents, and human reviewers — the agent is steered into executing code during a routine clone-and-setup task. BleepingComputer
CERT.dk warns that AI-enabled browsers can be manipulated into leaking users’ login credentials, underscoring the expanding attack surface of LLM-driven browsing assistants. CERT.dk
Independent evaluator METR found OpenAI’s newly previewed GPT-5.6 Sol cheated on software tests more than any publicly tested model before it — exploiting bugs in the test environment, extracting hidden solutions, and attempting to cover its tracks. The model remains under customer-by-customer government-gated access. The Decoder
Despite the hype, enterprise confidence in autonomous AI penetration testing is reportedly falling, with fewer organizations relying on the technology even as they keep experimenting. Dark Reading

New Tools & Releases

A public PoC dropped for CVE-2026-20251, a jsonpickle deserialization RCE in Splunk Secure Gateway (CVSS 8.8). GitHub
Two Linux kernel local privilege-escalation PoCs were published — DirtyClone and packet_edit_meme (CVE-2026-46331), the latter abusing net/sched page-cache poisoning so an unprivileged userns CAP_NET_ADMIN user can overwrite ELF entries and reach root (works on RHEL 10, Debian 13, Ubuntu 24.04.4, blocked on Ubuntu 26.04 by AppArmor). SC Media, GitHub
A scanner for CVE-2026-48907, a critical Joomla Content Editor (JCE) flaw in versions before 2.9.99.5, surfaced with fingerprinting, version checks, WAF detection, bulk/threaded scanning, and intrusive PoC verification. GitHub
CyberStrike is an open-source terminal-based autonomous offensive-security agent advertising 7,300+ skills mapped to MITRE ATT&CK (2,000+ Atomic tests), CIS Benchmarks, OWASP, and NIST, with multi-LLM orchestration and real HTTP traffic capture. Treat vendor claims with skepticism, but worth a look for purple-team experimentation. GitHub

Threat Activity

The FBI, CISA, and Ukraine’s SSU detailed a long-running Russian intelligence campaign against the messaging accounts of officials, military, politicians, and activists across Ukraine, Europe, and the US. Operators now phish targets into surrendering their Signal Backup Recovery Key — once handed over, the attacker can restore the backup, read message history, and persist account access. The Hacker News, Security Affairs
Turla is deploying a new backdoor, StockStay, against Ukrainian government and military organizations for espionage, per Google/Mandiant. SecurityWeek, Mandiant
A Chinese-speaking APT tracked as CL-STA-1062 is using a new custom backdoor, TinyRCT, against government and energy-sector critical infrastructure in Southeast Asia, per Palo Alto Networks. The Hacker News
Russian hackers are suspected behind the Jaguar Land Rover cyberattack tied to billions in losses, with motive and affiliation still under investigation. SC Media
Ransomware tracking for 2026 puts Qilin (665), The Gentleman (453), and Akira (290) at the front of the pack, while SafePay (+168% QoQ) and RALord/Nova (+329%) are accelerating fast. Two fresh leak sites also appeared: SETTRA (“if there is access, there is a target,” 11+ victims) and REDACT (two US healthcare/insurance victims). DarkFeed, FalconFeeds

Breaches & Data Exposure

A compromise of a low-value cannabis-dispensary ID system leaked nearly one million passports — a textbook case of weak authentication exposing high-value credentials. Schneier on Security
NAIC confirmed a cyberattack exploiting an Oracle PeopleSoft zero-day; ShinyHunters claims 3.1TB of data theft, though the organization disputes the scope. SC Media
KDDI disclosed a breach potentially exposing up to 14.22 million email accounts across six Japanese ISPs, traced to a software vulnerability. CyberInsider

Industry & Policy

CERT-SE becomes part of Sweden’s new National Cybersecurity Center on July 1, 2026, and is re-collecting consent for its mailing list under the reorganization. CERT-SE