Miasma Supply Chain Worm Spreads to Microsoft & PyPI; Record Patch Tuesday Fixes 206 Flaws; 'Gentlemen' Ransomware Hits 478 Victims

New intelligence indicates 'The Gentlemen' ransomware, tracked as Storm-2697, is a splinter group from the Qilin RaaS operation. The group has now compromised at least 478 victims across 66 countries, primarily by actively exploiting vulnerabilities in Fortinet FortiGate appliances and VPNs, specifically CVE-2025-32433 and CVE-2025-33073. This exploitation serves as the main initial access vector for their worm-like attacks. Targeted sectors include IT services, manufacturing, and finance, with a notable focus on Southeast Asia and Latin America. Organizations are urged to immediately patch all internet-facing Fortinet FortiGate devices to mitigate this threat. Security teams should also monitor web and firewall logs for suspicious requests to `/remote/fgt_lang`.

The Miasma supply chain attack framework was leaked on GitHub on June 10, 2026, leading to the rapid emergence of a new 'Hades' variant. This variant has significantly expanded the attack's scope beyond Microsoft GitHub repositories to include 19 packages on the Python Package Index (PyPI) as of June 7, 2026, and potentially hundreds across npm. A novel execution trigger has been identified where the credential-harvesting payload activates simply by opening a compromised project in an AI-assisted IDE. For PyPI, the Hades variant utilizes .pth startup hooks to achieve persistent execution, further increasing the attack's stealth and impact on developer environments.

The critical vulnerability count for Microsoft's June 2026 Patch Tuesday has been updated from 32 to 33. New analysis highlights the operational challenges of 'Patching Overload' due to the record 206 fixes, and discusses the 'Industry Trend' of AI-assisted vulnerability discovery. The article also provides revised 'Cyber Observables — Hunting Hints,' including monitoring for high volumes of HTTP/2 SETTINGS frames for CVE-2026-49160 and using `manage-bde -status` to identify systems vulnerable to the BitLocker bypass (CVE-2026-50507). Additionally, a more structured 'Deployment Priority' guide is offered for effective patch management.