DAY 005 · 11 JUNE 2026 · DAILY INTELLIGENCE

Patched at Record Pace, Rooted Anyway

Twenty-four hours after Microsoft shipped its largest Patch Tuesday in history, a working exploit for an unpatched Defender flaw is sitting in public. The record was never the point. The gap is.

01 // LEAD STORY

RoguePlanet: a public PoC for a Defender zero-day that survives the record patch

Yesterday this brief covered the number — more than 200 CVEs fixed in a single Patch Tuesday, the largest in Microsoft's history, driven in large part by AI-accelerated vulnerability discovery. Today comes the counterpoint. The researcher operating as Chaotic Eclipse has released proof-of-concept code for RoguePlanet, a Microsoft Defender zero-day that yields SYSTEM-level privileges on fully patched Windows systems.

Read that again: fully patched. The exploit has been tested against Windows 10 and 11 machines with the June 2026 updates installed. Reliability varies by machine — the researcher reports a 100% success rate on some systems and struggles on others — and Windows Server is not affected in the current form. But the asymmetry is the story. Defenders patched two hundred holes this week; an attacker needs the one that wasn't on the list. And this one lives inside the security product itself.

The June record looked like progress. RoguePlanet is the reminder that patch volume measures effort, not exposure.

Chaotic Eclipse appears connected to the same disclosure wave as "Nightmare Eclipse", whose earlier Windows exploit drops — including GreenPlasma — fed directly into this month's zero-day fixes. The pattern emerging in June: independent researchers are now setting Microsoft's patching agenda from the outside, in public, at speed. Expect an out-of-band fix; until then, privilege-escalation monitoring on endpoints is the realistic mitigation.

02 // FIELD REPORT

Kickoff day: the World Cup starts in Mexico City, and so does the fraud harvest

At 19:00 GMT today, Mexico and South Africa open the 2026 World Cup at the Estadio Azteca. The fraud infrastructure has been warming up for longer than the players have. Researchers and the FBI tracked thousands of lookalike FIFA domains, banking malware embedded in pirate streaming apps, and at least one phishing operation cloning FIFA's login page well enough to take over genuine accounts — all of it live before a single ball was kicked.

This brief flagged the World Cup fraud build-up in Day 001. Today it stops being a forecast. The largest tournament in history — 48 teams, 104 matches, 39 days, three host countries — is also the largest single phishing lure of the year, and the first match-day traffic spike is exactly when credential-harvesting pages convert best. If you're watching: official apps, official ticket channels, and treat every "free stream" as a payload until proven otherwise.

Match coverage, for the part of your day that isn't threat modelling, lives on our sister channel: sports.nodeshield.net.

03 // PATCH DESK

Veeam at 9.4, SAP's critical quartet, and protobuf.js in the supply chain

VEEAM CVE-2026-44963 · CVSS 9.4 · RCE on Backup & Replication ≤ 12.3.2.4465 by an authenticated domain user. v13 builds unaffected. Backup servers are ransomware's favourite first stop — patch out of cycle.

SAP June patch day: 15 vulnerabilities, four critical, hitting NetWeaver and Commerce Cloud.

PROTOBUF.JS Six flaws in the JS/TS Protocol Buffers implementation; worst cases reach RCE and DoS. Check your lockfiles — this one ships transitively.

CISA KEV Cisco Catalyst SD-WAN, Arista EOS and Chromium V8 flaws added to the Known Exploited Vulnerabilities catalogue. Exploitation confirmed; deadlines apply.
04 // INCIDENT

France's government chat app breached through a single account

Tchap, the encrypted messaging platform built for the French state, was breached after one account was compromised — exposing messages and data from public channels. The lesson is not new but keeps being re-taught: in federated and channel-based systems, "encrypted" describes the transport, not the blast radius. One credential, properly placed, reads everything that account can see. Public channels in a government messenger are still government data.

05 // SIGNAL

Autonomous worms, with taste

A University of Toronto study demonstrates AI-powered worms capable of tailoring attacks per target — adapting payloads across Windows, Linux and IoT devices autonomously. Put this next to yesterday's record Patch Tuesday and the RoguePlanet drop, and June 2026's thesis writes itself: discovery is automated, exploitation is automating, and adaptation is next. The defence stack that assumed human-speed adversaries is now a legacy assumption. Plan accordingly.

← Day 004 Day 006 →