Google released the June 2026 Android Security Bulletin on June 2, patching 124 vulnerabilities across the Android ecosystem. The bulletin’s most urgent item is CVE-2025-48595, a high-severity privilege escalation in the Android Framework component caused by an integer overflow in multiple locations. The vulnerability allows a local attacker to achieve code execution leading to privilege escalation without requiring any additional execution privileges and without any interaction from the device’s owner or user.
Google acknowledged that CVE-2025-48595 may be under limited, targeted exploitation, the standard language used to indicate observed use in targeted attacks rather than broad exploitation campaigns. The vulnerability affects Android versions 14, 15, 16, and 16 QPR2. Google’s Android Security Bulletin provides patch levels for device manufacturers to incorporate into their own updates. The actual availability of patches on individual devices depends on the device manufacturer’s update pipeline and the carrier if applicable.
The remaining 123 vulnerabilities in the June bulletin are not confirmed exploited but represent the breadth of the Android patch surface. Organisations running managed Android fleets should verify patch delivery status through their MDM platform and prioritise devices that are behind on the June patch level.
- Push the June 2026 Android Security Bulletin to all managed Android devices through your MDM platform today. Prioritise devices on Android 14, 15, and 16 where CVE-2025-48595 is confirmed applicable.
- Verify patch deployment status across the managed fleet via MDM reporting. Identify devices that have not received the June patch level and escalate as non-compliant.
- For BYOD environments, send user communications today instructing employees to apply the June Android security update manually if auto-update is not enforced.
BleepingComputer reported that hackers are actively exploiting CVE-2026-8206, a critical privilege escalation vulnerability in the Kirki plugin for WordPress, to take over any user account on affected sites including those belonging to site administrators. Kirki is an open-source WordPress customisation framework that provides an extended API for building theme options pages, used both as a standalone plugin and as a bundled dependency in many commercially distributed WordPress themes.
The vulnerability allows a critical privilege escalation that an attacker can exploit to hijack any user account without requiring prior authentication or existing credentials. Full administrator access on a WordPress site allows the attacker to install or modify plugins and themes to execute server-side PHP code, access and exfiltrate the WordPress database containing all site content and user credentials, and modify site content to deliver malware or phishing pages to site visitors.
Kirki’s presence as a bundled theme dependency complicates the patching picture. Many site owners will not know Kirki is present because it was installed as part of a theme rather than as a deliberate plugin choice. The WordPress Plugins menu may not reflect all copies of Kirki on a site, and automatic update mechanisms may not apply to theme-bundled copies. A patched version of Kirki is available.
- Update the Kirki plugin to the patched version from the WordPress plugin repository. Also check active theme directories for bundled copies of Kirki and update or remove them.
- Audit the WordPress Users table for any administrator or elevated-privilege accounts created or accessed in the past 72 hours that were not created by your team.
- Review WordPress access logs for unexpected POST requests to Kirki plugin endpoints as exploitation indicators, and check for recently installed plugins or theme modifications made by accounts you did not create.
BleepingComputer reported on June 2 that a threat actor is actively distributing a ransomware attack toolkit that was built using AI assistance and is designed to automate two of the most technically demanding phases of an enterprise ransomware attack: Active Directory reconnaissance and endpoint detection and response evasion.
The AD discovery component automates the enumeration of the Active Directory environment after initial access is established, identifying domain controllers, privileged accounts, high-value file servers, and lateral movement paths without requiring the operator to manually run AD enumeration tools or interpret their output. The EDR evasion component incorporates techniques to detect the specific endpoint protection platform present on a compromised host and adapt the payload delivery to avoid triggering its detection logic.
The significance of the toolkit is the lowered barrier to entry it represents. Both AD enumeration and EDR evasion have historically required skilled operators with specific knowledge of how enterprise environments are structured and how specific security products work. Packaging both capabilities into an automated toolkit means a less technically skilled operator can conduct an enterprise-grade ransomware campaign that previously required a specialist. This is consistent with the ransomware-as-a-service model documented in the Kaspersky State of Ransomware 2026 report in Issue 42, which has progressively reduced the skill requirements for effective ransomware operations.
- Review Active Directory monitoring for unusual enumeration activity: bulk LDAP queries, unusual use of tools like BloodHound or SharpHound equivalents, or accounts querying AD objects they do not normally access.
- Verify that your EDR platform is configured with behavioural detection enabled and that detection rules cover AD enumeration activity patterns, not just known malware signatures.
- Test network segmentation controls between workstations and domain controllers. Automated AD lateral movement relies on being able to reach domain controllers from compromised endpoints. Segmentation controls raise the cost significantly even when the attacker has automated the discovery phase.