Selected events and fix thresholds
This retrospective covers 2026-06-01 to 2026-06-30. Sources were checked on 6 November 2026. The table lists historical fix thresholds in the corresponding branches. Before deploying, choose a currently supported release or a distributor package with the relevant backport; an old fix threshold is not a recommendation to install an obsolete branch.
For the selected items, this review confirms the disclosure or security release and its stated conditions. Active exploitation and historical CISA KEV or EPSS status are not asserted here. Missing exploitation evidence remains unknown.
| Event date | Product and advisory | Fix thresholds by branch |
|---|---|---|
| 2026-06-08 | Apache HTTP Server | CVE-2026-49975 | 2.4.68 |
| 2026-06-18 | Node.js | CVE-2026-48618 | 22.23.0 / 24.17.0 / 26.3.1 |
| 2026-06-09 | OpenSSL | CVE-2026-35188 | 4.0.1 / 3.6.3 |
| 2026-06-24 | curl | CVE-2026-11856 | 8.21.0 / 8.20.1 / 8.16.1 / 8.14.2 |
Apache: HTTP/2 memory exhaustion (CVE-2026-49975)
Malicious HTTP requests can cause excessive allocation and denial of service in mod_http2. Apache lists versions 2.4.17 through 2.4.67 as affected; the June 2.4.68 release includes the fix. This is a different HTTP/2 issue from the May double-free case.
Confirm which public endpoints use mod_http2 and which host owns the update. Record memory and availability checks after installing the patched package and reloading workers.
Node.js: TLS hostname normalization (CVE-2026-48618)
Different treatment of Unicode dot separators by the resolver and certificate verifier can bypass wildcard-depth checks. The June Node.js release fixes the issue in branches 22, 24 and 26. Review outbound TLS requests whose hostname can be influenced by untrusted data.
Review URL input validation and deployed runtimes for webhook, fetch and integration services. After updating, check approved destinations and certificate failures using a controlled test service.
OpenSSL: OCSP stapling in TLS clients (CVE-2026-35188)
A malicious TLS server can trigger a double free in a client that checks stapled OCSP responses. This can corrupt memory and cause a crash; code execution is described as possible but environment-dependent. OCSP stapling is not enabled by default in the affected path.
Check outbound clients using OpenSSL 4.0 or 3.6 and this validation setting. Apply the relevant branch package and verify both accepted and rejected certificates after restart.
curl: Digest authorization between origins (CVE-2026-11856)
After a Digest-authenticated request, changing the origin while reusing the same libcurl handle can send the original Authorization header to another host. The vendor advisory accompanied the June release; the CNA publication followed in July. Branch-specific maintenance fixes are also listed.
Find integration clients that change origin within a shared handle. Test separation of credentials after updating and review logs if an unexpected authenticated destination was contacted.
Breaches and cyber incidents reported this month
These cases were publicly reported during June 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.
| Organization | Public notice | Incident |
|---|---|---|
| Novo Nordisk | 2026-06-11 | Information exposure |
| LastPass / Klue | 2026-06-22 | Supplier incident |
Novo Nordisk: unauthorized copying from internal systems (2026-06-11)
On 2026-06-11, Novo Nordisk reported unauthorized access to a limited set of internal IT systems and external copying of non-public information, including personal data. Some systems were temporarily taken offline. Its investigation was ongoing, so the notice did not establish a complete affected-person count.
Include data extraction in the incident review even when only a few systems are involved. Map sensitive exports and access logs, and agree what evidence is needed before isolated services can be safely reconnected.
LastPass and Klue: CRM exposure through supplier tokens (2026-06-22)
LastPass's 2026-06-22 notice said an attacker obtained Klue-held OAuth tokens and used them to access customer CRM data in Salesforce. LastPass stated that its products, infrastructure and customer password vaults were unaffected. It had learned of the supplier incident on June 12.
Inventory OAuth connections that can read CRM records. Check token scope and the ability to revoke a supplier connection promptly; removing a user's interactive login alone may leave an integration's token active.
Coverage and editorial record
This is a selected review for business websites and hosting, not a complete monthly vulnerability inventory. Each section links to its evidence. Public disclosure or a security release determines the coverage month; a private report date, CVE reservation year or later record edit does not determine that month.
The first edition was prepared on 6 November 2026. Current advisories may contain later corrections, so this article does not claim to reproduce their exact month-end state. No corrections are recorded for this edition. A substantive change will receive a dated note and updated article metadata.
