KEVSEC Weekly Intelligence Report — June 22, 2026

This KEVSEC Weekly Intelligence Report covers the period ending June 22, 2026. Active threat sensor infrastructure recorded 8 inbound probe attempts from 2 unique source IPs across the reporting window. The SSH tarpit neutralized 429 unique scanner IPs, consuming 21.7 hours of adversary connection time. 13 IPs were permanently banned following honeypot engagement. The cumulative nftables blocklist now stands at 18,782,324 permanently blocked addresses.

Key intelligence findings this cycle: 20 vulnerability disclosures tracked by NVD including 9 Critical-rated CVEs; state-affiliated probe activity attributed to Pakistan, Vietnam infrastructure. Full analysis across cyber threat intelligence, infrastructure defense metrics, vulnerability landscape, global events, and government intelligence follows.

Over the past seven days, the KEVSEC honeypot and network sensor infrastructure logged 8 inbound probe attempts from 2 unique IP addresses — a steady tempo consistent with broad opportunistic reconnaissance campaigns. The activity spans automated SSH brute-force sweeps, HTTP vulnerability scanners, and targeted probes against exposed management interfaces, reflecting the persistent baseline noise of internet-facing infrastructure.

State-affiliated infrastructure contributed a measurable share of inbound activity. The top nation-state sources by probe volume were: 🇵🇰 Pakistan (9 recorded hits via Cyber Internet Services (Pvt) Ltd.); 🇻🇳 Vietnam (6 recorded hits via Viettel Group); 🇷🇴 Romania (6 recorded hits via Feo Prest SRL). Attribution to state actors is based on autonomous system ownership as resolved through BGP routing data — it reflects infrastructure origin, not necessarily direct government sponsorship of individual scanning operations.

At the autonomous system level, the highest-volume sources were: DigitalOcean LLC (43 hits); Justin Harth (39 hits); Google Cloud Platform (18 hits); TECHOFF SRV LIMITED (18 hits). The presence of cloud hosting providers and residential ISPs within the top sources underscores how threat actors leverage commodity infrastructure to distribute scanning operations and complicate attribution.

Surveillance-linked ASN keywords detected in inbound traffic this period included references to: viettel, china unicom. Traffic originating from infrastructure associated with surveillance vendors and intelligence contractors warrants heightened scrutiny — these probes may be targeted rather than opportunistic.

The vulnerability front saw 6 notable disclosures this reporting period, including 6 rated Critical and 0 rated High. The highest-priority finding was CVE-2026-10611 (CVSS 10.0) — An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configu. Defenders are advised to prioritize patching based on EPSS exploitation probability scores alongside raw CVSS severity ratings.

The KEVSEC endlessh SSH tarpit has processed 429 unique adversary IP addresses and consumed a cumulative 21.7 hours of attacker connection time since deployment — including 21.7 hours in this reporting period alone. The tarpit operates by accepting SSH connections on port 22 and deliberately delaying the protocol handshake, tying up scanner threads and consuming attacker resources without providing any authentication surface. Tarpit data feeds directly into the nftables permanent blocklist — identified scanner IPs are automatically flagged for injection into the deny ruleset, preventing future connection attempts.

The HTTP honeypot layer logged 47 probe attempts from 4 unique IPs during this period. 13 IPs triggered automatic permanent bans via the honeypot engagement pipeline. Monitored honeypot paths include common WordPress admin panels, phpMyAdmin instances, environment file endpoints, Git configuration directories, and known CVE-targeted paths — all designed to catch automated exploitation frameworks and manual attackers alike.

Fail2ban enforcement triggered across 4 active jails this cycle. Top jail activity by ban count: sshd-root (10 bans); honeypot-probe (7 bans); honeypot-trap (7 bans); sshd (6 bans). The sshd and sshd-root jails represent brute-force credential attacks against the management interface; honeypot-probe and honeypot-trap jails capture HTTP-layer exploitation attempts.

The nftables blacklist enforced 4 logged block events across 1 enforcement sources. Block sources: HONEYPOT (4).

Cumulative platform metrics: 18,782,324 IPs permanently blocked in the nftables deny ruleset; 278 total probe events logged across all sensor layers since deployment. The permanent blocklist is maintained as a compiled nftables set and is reloaded hourly from the consolidated blacklist — ensuring minimal performance overhead while providing comprehensive pre-connection blocking.

The National Vulnerability Database published or updated 8 significant vulnerabilities during this reporting window — 8 rated Critical and 0 rated High. EPSS (Exploit Prediction Scoring System) probability data, where available, is included to help prioritize remediation efforts against actively exploited or exploit-imminent weaknesses.

CVE-2026-10611 (CVSS 10.0, CRITICAL, published 2026-06-02): An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.mixedAuth=true and Security.require_otp=tr EPSS exploitation probability: 35.0%.

CVE-2026-7312 (CVSS 10.0, CRITICAL, published 2026-06-02): CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441 EPSS exploitation probability: 34.0%.

CVE-2026-42074 (CVSS 9.8, CRITICAL, published 2026-06-02): OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool EPSS exploitation probability: 43.0%.

CVE-2026-49185 (CVSS 9.8, CRITICAL, published 2026-06-04): The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection. EPSS exploitation probability: 39.0%.

CVE-2026-49186 (CVSS 9.8, CRITICAL, published 2026-06-04): The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish ro EPSS exploitation probability: 32.0%.

Organizations should review their asset inventory against the affected vendors and platforms listed above. Where EPSS scores exceed 10%, treat remediation as urgent regardless of CVSS rating, as probability of observed in-the-wild exploitation is elevated.

Cross-reference: internal red team assessment identified 1 High/Critical findings against platform infrastructure this cycle. See the Red Team Assessment section for full details.

The Global Disaster Alerting and Coordination System (GDACS) flagged 6 significant events during this reporting period, 0 carrying red-level alerts and 0 at the orange threshold. Red alerts indicate high humanitarian impact potential requiring immediate international response coordination.

⚠ Green flood alert in Türkiye (GREEN alert, Türkiye): FL event logged Tue, 02 Ju.

⚠ Green forest fire notification in Australia (GREEN alert, Australia): WF event logged Mon, 22 Ju.

⚠ Green forest fire notification in Australia (GREEN alert, Australia): WF event logged Mon, 22 Ju.

⚠ Green earthquake (Magnitude 5.5M, Depth:10km) in St. Helena 20/06/2026 06:43 UTC, Few people affected in MMI III. (GREEN alert, St. Helena): EQ event logged Sat, 20 Ju.

USGS seismic monitoring recorded 5 significant earthquakes this week. The highest-magnitude event was a M6.7 near 43 km ESE of Palu, Indonesia, registered 2026-06-15 10:27 PM CT. Events above M6.0 in densely populated regions are tracked for potential secondary effects on critical infrastructure, supply chains, and regional stability.

NIFC wildfire monitoring reports 12 active wildfires across the United States covering approximately 168,752 total acres. Largest active incidents: South Fork (NE, 39,696 acres, 90% contained); 4170 Tule Rd (WA, 24,087 acres, 95% contained); Iron (UT, 21,935 acres, 0% contained); QUARRY 2 (13) (FL, 19,018 acres, 97% contained). Active wildfires in populated regions are tracked for potential air quality impacts, infrastructure disruption, and emergency services strain that may degrade local response capabilities.

NOAA Space Weather Prediction Center reports current geomagnetic activity at Kp=1.0 (1Z) — conditions are quiet (nominal conditions). No active SWPC alerts during this reporting period. Elevated geomagnetic activity (Kp≥5) can impact HF communications, satellite navigation accuracy, and high-latitude power grid stability — relevant for emergency communications planning and critical infrastructure operators.

White House and presidential activity tracked during this reporting period reflects the following developments: "U.S. and Iran sign deal ahead of schedule - Axios" | "Secret Service disbursements raise questions on ballroom funding - Roll Call" | "Press Conference: Donald Trump Holds a Press Conference at the G7 Summit in France - June 17, 2026 - Roll Call". Presidential movements and official actions are catalogued from White House RSS feeds and corroborating news sources to provide an unfiltered activity record.

Department of Justice and FBI reporting highlights 2 notable developments this week. "Repeat Offender Charged with Being a Felon in Possession of a Firearm" (FBI, Wed, 17 Ju); "Fourteen Defendants Indicted in Crack and Cocaine Trafficking Conspiracy Operating Near D.C. Elementary School" (FBI, Wed, 17 Ju). Law enforcement actions, indictments, and agency press releases are monitored as indicators of domestic threat mitigation and enforcement priority shifts.

Additional government intelligence from DHS, CENTCOM captures the broader policy and operations picture. "War Department Continues to Encourage Civilians to Augment Homeland Security Border Mission - U.S. Department of War (.gov)"; "Trump’s Firing of Noem Signals Need for New Vision on Immigration - American Civil Liberties Union"; "U.S. Plans Major Strikes on Iran, Hegseth Says - U.S. Department of War (.gov)".

The 119th Congress is currently in session. Current composition: House 220R/213D; Senate 53R/45D. Active legislative items tracked this week: "Defense Funding Put in Context-2026-05-27 - Committee for a Responsible Federal Budget"; "6 House primaries to watch in New York - Roll Call"; "Housing deal in hand, revised bill cruising toward passage - Roll Call"

Automated red team assessment of https://kevsec.com completed 2026-06-21T03:00:30.365824. Scan returned 0 Critical, 1 High, 3 Medium, 1 Low, and 39 informational findings. Overall posture: HIGH-PRIORITY FINDINGS PRESENT. The KEVSEC platform performs weekly automated security assessments against its own externally-facing infrastructure, correlating findings against known-good baseline configurations to identify drift, misconfigurations, or newly exposed attack surface.

Actionable findings this cycle:

[MEDIUM] Auth — Login rate limiting may not be active (test inconclusive from localhost): Could not trigger lockout in 7 attempts — verify _check_rate_limit is wired to login route

[MEDIUM] SSH — Password authentication enabled on SSH: PasswordAuthentication yes

[MEDIUM] SSH — Password authentication enabled on SSH: PasswordAuthentication yes

[HIGH] Firewall — nftables may not be applying rules: Log check failed and nft list tables returned error: Command '['sudo', 'nft', 'list', 'tables']' timed out after 8 seconds

23 security controls confirmed in-place during this assessment cycle. Verified controls include: strict-transport-security; content-security-policy; x-frame-options; x-content-type-options; referrer-policy; permissions-policy; Env file exposed: /.env → HONEYPOT ACTIVE; Git repo exposed: /.git/config → HONEYPOT ACTIVE.

Red team findings are triaged weekly. Critical and High findings trigger immediate remediation workflows. Medium findings are tracked in the configuration backlog. All findings are re-assessed on the following cycle to confirm remediation.

From an analyst standpoint, this reporting period reinforces several persistent trends worth monitoring. Scanning pressure from Pakistan, Vietnam-attributed infrastructure remains consistent — no significant surge, but no decline either.

Vulnerability priority should center on CVE-2026-10611 and any assets running affected software versions. Organizations running unpatched internet-facing systems against this week's Critical disclosures should treat those systems as compromised until verified otherwise.

The political intelligence picture continues to evolve with frequent executive activity. Downstream policy effects on regulatory posture, federal IT procurement, and agency operational tempo remain areas to watch in subsequent reporting cycles.

Infrastructure defense posture remains active. The tarpit consumed 21.7 hours of adversary time this week alone — a passive but meaningful drain on automated scanning resources targeting this platform. Consistent tarpit engagement without escalation suggests adversaries have not flagged this infrastructure as a high-value target warranting manual follow-up, though this assessment should be revisited if targeted probe patterns emerge.

Environmental conditions bear monitoring: 12 active wildfires are currently burning across the US. Wildfire incidents of sufficient scale can stress emergency communications infrastructure, trigger emergency management coordination activity, and create information operations opportunities around disaster response narratives.

KEVSEC reports are generated weekly from live sensor data, open-source intelligence feeds, and public government sources. Data reflects conditions at the time of generation and should be supplemented with direct-source verification for operational decisions.