🐛 COMMON VULNERABILITIES AND EXPOSURES 16[−]
3 Jun KEVGoogle June 2026 Android Update Patches 124 Flaws, One Actively ExploitedGoogle on Monday released patches for 124 security vulnerabilities impacting its Android operating system for the month of June 2026, including one high-severity flaw in the Framework component that has come under active exploitation. Tracked as CVE-2025-48595 (CVSS score: 8.4), …THEHACKERNEWS.COM
3 JunCVE-2025-4574 Crossbeam-channel: crossbeam-channel vulnerable to double free on dropInformation published.MSRC.MICROSOFT.COM
3 JunCVE-2019-11254 Kubernetes API Server denial of service vulnerability from malicious YAML payloadsInformation published.MSRC.MICROSOFT.COM
3 JunCVE-2023-1386 Qemu: 9pfs: suid/sgid bits not dropped on file writeInformation published.MSRC.MICROSOFT.COM
3 JunCVE-2026-33846 Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassemblyInformation published.MSRC.MICROSOFT.COM
3 JunCVE-2026-44777 jq: stack overflow in module loading on mutual `include`Information published.MSRC.MICROSOFT.COM
3 JunCVE-2021-25740 Holes in EndpointSlice Validation Enable Host Network HijackInformation published.MSRC.MICROSOFT.COM
3 JunCVE-2013-1633 easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.Information published.MSRC.MICROSOFT.COM
3 JunCVE-2025-1150 GNU Binutils ld libbfd.c bfd_malloc memory leakInformation published.MSRC.MICROSOFT.COM
3 JunCVE-2025-1180 GNU Binutils ld elf-eh-frame.c _bfd_elf_write_section_eh_frame memory corruptionInformation published.MSRC.MICROSOFT.COM
3 JunUnpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 HashesCybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a user's NTLMv2 hash to the attacker. Like in the case of CVE-2026-33829, which impacted the Windows Snipping Tool's ms-screensketch: URI handler, the newly flagged issue re…THEHACKERNEWS.COM
3 JunTenable CTO Q&A: C-suite views AI as massive threat, as cyber teams adopt exposure management to counter AI attacksTenable CTO Vlad Korsunsky talks about participating in the World Economic Forum’s Annual Meeting on Cybersecurity and Tenable’s EXPOSURE 2026 conference, where he talked with global leaders about new game-changing AI threats and the groundbreaking benefits of exposure management…TENABLE.COM
3 JunVerizon VoLTE network found missing IPsec protections for SIP signalingThe CERT Coordination Center (CERT/CC) has disclosed a security issue affecting Verizon's Voice over LTE (VoLTE) infrastructure, warning that SIP signaling traffic on the carrier's IP Multimedia Subsystem (IMS) network appears to lack IPsec integrity protection required by indust…CYBERINSIDER.COM
3 JunVU#595768: Securly Chrome Extension contains multiple weak encryption and access control vulnerabilitiesOverview Version 3.0.7 of the Securly Chrome Extension contains multiple vulnerabilities involving insecure data transmission, weak cryptography, and improper access control. These issues may expose sensitive filtering rules, enable the manipulation of downloaded configuration fi…KB.CERT.ORG
⚠️ VULNERABILITY DISCLOSURE 34[−]
3 JunAnthropic grants Project Glasswing access to 150 more companies, with a focus on critical infrastructureAnthropic on Tuesday announced that it was adding 150 more companies to its Project Glasswing AI-based vulnerability hunting initiative, with a particular focus on critical infrastructure companies including those involved in “power, water, healthcare, communications and hardware…CSOONLINE.COM
3 JunCarnival Data Breach Exposes Millions as Microsoft Backs Down on Researcher ThreatsCybersecurity Today for June 2, 2026. Microsoft has backed away from its hard-line stance against vulnerability researchers after widespread criticism from the security community. The dispute began after independent researcher Nightmare Eclipse published proof-of-concept code for…CYBERSECURITYTODAY.LIBSYN.COM
3 JunRisky Business #840 -- Microsoft walks back researcher threatsOn this week’s show special guest co-host Andy Boyd joins Patrick Gray and James Wilson to discuss the week’s cybersecurity news. Andy is the CEO of REDLattice, which makes the Paragon “intelligence collection and reconnaissance” solution. They cover: Adversaries are tracking US …RISKY.BIZ
3 JunWhat AI Security Research Actually Looks Like with John Zenick of Harmonic SecurityJohn Zenick started his cybersecurity journey modding a Nintendo Wii in middle school. He is now an AI Security Researcher at Harmonic Security and a Teaching Fellow at Harvard, and joins our show to discuss everything AI! Even though we're a marketing podcast, of course we love …THECYBERWIRE.COM
3 JunKnown vulnerabilities behind most application security incidentsEight in ten organizations took an application security hit during the past year tied to a vulnerability their team had already cataloged, according to a survey of 902 IT and security professionals conducted by the Cloud Security Alliance. The pattern points to a structural condi…HELPNETSECURITY.COM
3 JunVS Code zero-day lets hackers steal GitHub tokens in one clickA security researcher has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a link. [...]BLEEPINGCOMPUTER.COM
3 JunSupply Chain Attacks: Open Source or Open Door?In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by Allie Luhrs and Mario Samolis from Microsoft Security to explore the growing threat of open source software supply chain attacks. They discuss how malicious NPM packages, comprom…THECYBERWIRE.COM
3 JunMazeBolt brings AI-generated attack simulation to DDoS security testingMazeBolt has announced the launch of RADAR VectorAI, a new MazeBolt module that creates AI-generated DDoS attacks. As AI outpaces human response, enterprises need to have access to validated DDoS vulnerability data about both known and AI-generated attack vectors. Mythos has rais…HELPNETSECURITY.COM
3 JunGoogle adds a silent check to catch scammers posing as your contactsAndroid is introducing fake call detection to help protect users from impersonation scams. The feature can detect and flag suspected spoofed calls when both parties use Phone by Google on Android 12 or later. It will roll out globally this month, starting with Pixel devices. Stor…HELPNETSECURITY.COM
3 JunAnthropic expands Project Glasswing to 150 organizations in more than 15 countriesAnthropic is expanding Project Glasswing, its cybersecurity initiative built around the Claude Mythos Preview model, by adding about 150 organizations following several weeks of work with its initial group of partners, security firms, open-source maintainers, and government agenc…HELPNETSECURITY.COM
3 JunNew HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & CloudflareCybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The vulnerability has been codenamed HTTP/2 Bomb by Calif. "The vulnerable behavior exists in …THEHACKERNEWS.COM
3 JunLessons from the Canvas cyberattackCanvas cyberattack: Who, what, when, how? What and when? Over May 6 and 7, 2026, Canvas learning management system (LMS) users were served up a defaced web page in place of the expected login page. The altered web page displayed a warning by the ShinyHunters criminal hacker and e…CSOONLINE.COM
3 JunScaling to $100M as the Security Weekly Index Hits an All Time High - Joshua Gould - BSW #450The ultimate goal, scale a company to $100M and go IPO. Easier said than done. We've seen some make it and others that get stuck. What's he difference? Joshua Gould, CEO at thebigword, joins Business Security Weekly to discuss how to scale to $100M. From startup to platform, Josh…YOUTUBE.COM
3 JunMicrosoft Tries to Calm Legal Threat Fears After Zero-Day Disclosure BacklashMicrosoft has responded to backlash over its initial threats of legal action against researchers who publicly disclose zero-day vulnerabilities without coordinated notification. The controversy concerns a researcher known online as Chaotic Eclipse and Nightmare Eclipse, who in re…SECURITYWEEK.COM
3 JunAI may finally unlock the cyber budgets CISOs have wanted for yearsFor nearly two decades, cybersecurity leaders have faced the same reality: No matter how catastrophic the latest breach, ransomware attack, or nation-state intrusion, security spending often struggled against competition with every other business priority. AI may finally be chang…CSOONLINE.COM
3 JunNew cyber force would cost up to $11 billion to start, commission saysThe military branch would take 12 to 18 months to get up and running and also include roughly 5,000 members of the National Guard and up to 6,000 civilians, according to the commission.THERECORD.MEDIA
3 JunNew “HTTP/2 Bomb” attack can exhaust server memory in secondsResearchers have disclosed a new denial-of-service (DoS) technique dubbed HTTP/2 Bomb, a memory-exhaustion attack that can render major web servers inaccessible within seconds. The attack affects the default HTTP/2 configurations of nginx, Apache HTTP Server, Microsoft IIS, Envoy…CYBERINSIDER.COM
3 JunPolice dismantles 9 crime groups in illegal streaming crackdownEuropean and international law enforcement agencies have dismantled nine organized crime groups and arrested 29 suspects in a major crackdown on illegal streaming operations. [...]BLEEPINGCOMPUTER.COM
3 Jun‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in SecondsThe default HTTP/2 configuration of major web servers is vulnerable to an attack chain combining a compression bomb and a Slowloris-style hold. The post ‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in Seconds appeared first on SecurityWeek .SECURITYWEEK.COM
3 JunMicrosoft wants to put AI agents on a short leashAs enterprises race to adopt AI agents across software development workflows, Microsoft is rolling out new controls aimed at keeping the transformation from becoming a security headache. At its annual developer conference, Microsoft Build, the company unveiled a set of initiative…CSOONLINE.COM
3 JunThe sorry state of skill distributionPublic skill marketplaces are being flooded with malicious skills that steal credentials, exfiltrate data, and hijack agents. In response, a segment of the security industry released skill scanners, a new family of tools designed to detect malicious skills before they’re installe…TRAILOFBITS.COM
3 JunAcer working to patch max severity zero-days in Wave 7 routersAcer is working to address two maximum-severity zero-day vulnerabilities affecting its Wave 7 mesh routers. [...]BLEEPINGCOMPUTER.COM
3 JunOrganizations Warned of Exploited Linux Kernel VulnerabilityAn improper authentication bug allows attackers to escalate their privileges and escape containers. The post Organizations Warned of Exploited Linux Kernel Vulnerability appeared first on SecurityWeek .SECURITYWEEK.COM
3 JunBeyond the Zero-Day: See Your Network Like an Attacker | Webinar with HD MooreAssume the breach. Zero-days keep shipping, AI is writing exploits faster than anyone patches, and "patch everything in time" stopped working years ago. Stop betting the org on winning that race. You don't control which bug lands. You control what it can reach once it does. That …THEHACKERNEWS.COM
3 JunKirki, Burst Statistics WordPress Plugin Flaws in Attackers’ CrosshairsThreat actors are exploiting vulnerable Kirki and Burst Statistics deployments to elevate privileges and take over websites. The post Kirki, Burst Statistics WordPress Plugin Flaws in Attackers’ Crosshairs appeared first on SecurityWeek .SECURITYWEEK.COM
3 JunSimplify security management with CIS SecureSuite PlatformNew operating systems prioritize usability, a reality which threat actors use to exploit security gaps. Every misconfiguration creates an opportunity for compromise, and lean teams struggle in their security management efforts to harden hundreds or thousands of endpoints. CIS Sec…HELPNETSECURITY.COM
3 JunAutonomous AI-driven worm can reason its way through corporate networksResearchers at the University of Toronto, the Vector Institute, and the University of Cambridge have built and tested a proof-of-concept AI-driven worm that does not operate on a fixed list of exploits. Instead, it analyzes each target it encounters, reasons about how to attack i…HELPNETSECURITY.COM
3 JunOne-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth TokensCybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code (VS Code) that makes it possible to steal a user's GitHub token. "Just by clicking a link, it's possible for an attacker to steal a GitHub token that can read and write to your repos, inc…THEHACKERNEWS.COM
3 JunInfosecurity Europe: Vulnerability Management Innovator Konvu Wins Cyber Startup AwardInaugural Infosecurity Europe Cyber Startup Award Winner Impresses Panel with Ability Help Prioritize Vulnerabilities in AI eraINFOSECURITY-MAGAZINE.COM
3 JunMicrosoft responds to security challenges facing code, AI agents, and modelsMicrosoft has introduced a series of security tools and capabilities focused on AI-driven vulnerability discovery, AI agents, and AI models. The updates include a multi-agent vulnerability discovery system, new controls for managing and securing AI agents, data protection capabil…HELPNETSECURITY.COM
3 JunCISA warns of active attacks exploiting Android, Linux bugsThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting vulnerabilities in the Linux kernel and Android operating system. [...]BLEEPINGCOMPUTER.COM
3 JunWhen Pages Hijack AI ResponsesAI assistants that summarize third-party content may render markdown links and images from those sources directly in their response UI. These elements can be displayed as clickable or embedded content inside what users perceive as a trusted assistant interface. A malicious page c…YOUTUBE.COM
3 JunOver 100 Dutch hotels hit by breach exposing guest reservation dataMore than 100 hotels in the Netherlands have been impacted by a data breach that exposed guest and reservation information. The stolen data enabled cybercriminals to send convincing phishing messages to travelers, while similar incidents have also been reported by hotels in Belgi…CYBERINSIDER.COM
3 JunA Day in the Life of an MDR Analyst: Inside the Modern SOCWhat actually happens inside a SOC when an incident unfolds? Most teams see the alerts and the outcomes, but the decision-making in between is often less visible. At the Rapid7 2026 Global Cybersecurity Summit, the signature session Inside the Modern SOC: Who Carries You Through …RAPID7.COM
📢 SECURITY ADVISORIES 3[−]
3 JunTrump Signs Order Inviting Voluntary Review of Frontier AI ModelsTrump's executive order invites voluntary pre-release review of frontier AI modelsINFOSECURITY-MAGAZINE.COM
3 JunCitizen Lab urges Canada to withdraw parts of Bill C-22 over privacy concernsCitizen Lab and the Canadian Civil Liberties Association (CCLA) are urging lawmakers to withdraw key provisions of Canada's proposed lawful access legislation, Bill C-22, warning that it would create sweeping surveillance powers, undermine privacy rights, and pose significant cyb…CYBERINSIDER.COM
3 JunCISA, FBI warn that hackers are targeting systems used to monitor industrial fluidsAutomatic tank gauge systems are widely used across multiple industries, including energy, agriculture and transportation.CYBERSECURITYDIVE.COM
🔥 INCIDENT REPORTING 8[−]
3 JunWelcoming the Philippine Government to Have I Been PwnedPresently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite Today, we welcome the 46th government onboarded to Have I Been Pwned’s free gov service: the Philippines. The Philippines’…TROYHUNT.COM
3 JunA small Slovenian team handles 6,000 cyber incidents a yearOnline fraud complaints, ransomware cases, and phishing tips reach Slovenia’s national cyber response center in steady volume, and a team of around a dozen analysts sorts through them. Gorazd Božič, who manages SI-CERT at the public agency ARNES, described that work in an i…HELPNETSECURITY.COM
3 JunPreinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaignA large-scale npm supply chain attack compromised over 90 versions of @redhat-cloud-services packages, silently infecting CI/CD environments and developer systems. The malicious code steals credentials from GitHub, cloud platforms, and local machines, then spreads like a worm by …MICROSOFT.COM
3 JunSecurity of 100 AI Agents Tested and Ranked – What You Need to KnowThe AI Risk Quadrant evaluates AI agents based on three factors: how vulnerable they are to compromise, the potential impact of a breach, and the strength of their security defenses. The post Security of 100 AI Agents Tested and Ranked – What You Need to Know appeared first on Se…SECURITYWEEK.COM
3 JunHackers Target Global Stock Exchange in Espionage OperationThe attackers had access to a senior executive’s email account for 150 days and exfiltrated data for months. The post Hackers Target Global Stock Exchange in Espionage Operation appeared first on SecurityWeek .SECURITYWEEK.COM
3 JunIMA Diligence Services Data Breach Impacts 525,000 PeopleThe affected individuals’ personal information was stolen from a legacy server managed by a third party. The post IMA Diligence Services Data Breach Impacts 525,000 People appeared first on SecurityWeek .SECURITYWEEK.COM
3 JunThe worst hacks and breaches of 2026 (so far)From a massive DOGE data breach and the hacking of critical energy and water systems to the hack of an FBI surveillance system, here are the most damaging security incidents and data breaches of 2026.TECHCRUNCH.COM
3 JunUltrahuman says hackers accessed customers’ wellness data via internal toolThe breach at wearable ring maker Ultrahuman stemmed from credentials stolen from a malware-infected employee laptop.TECHCRUNCH.COM
🕵️ THREAT INTELLIGENCE 16[−]
3 JunISC Stormcast For Wednesday, June 3rd, 2026 https://isc.sans.edu/podcastdetail/9956, (Wed, Jun 3rd)(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.ISC.SANS.EDU
3 JunAgent Threat Rules: Open detection rule format for AI agent security threatsAI agents run inside coding assistants, MCP servers, and multi-agent frameworks, and the access that makes them useful also opens paths to prompt injection, tool poisoning, and credential theft. Public CVE feeds carry agent-execution flaws that reach production faster than the to…HELPNETSECURITY.COM
3 JunWhat CISOs need to do about post-quantum migration in the next 24 monthsIn this Help Net Security video, Garfield Jones, SVP Global Strategy and Research, QuSecure, lays out what CISOs should do over the next 24 months. A recent Google paper moved the expected arrival of a cryptographically relevant quantum computer from 2035 to 2029, leaving organiz…HELPNETSECURITY.COM
3 JunNetskope adds AI asset discovery and AISecOps agent to AI security portfolioNetskope has announced Netskope One AI Command Center, bringing together AI discovery, risk intelligence, and autonomous response capabilities in a single platform. As the latest expansion of the Netskope One AI Security suite, it helps security teams understand what AI is runnin…HELPNETSECURITY.COM
3 JunCritical Start expands MDR capabilities with multi-agent AI systemCritical Start has released SOC AI, a production-proven multi-agent framework powering its AI-led Managed Detection and Response (MDR). SOC AI coordinates ten specialized agents across the full alert investigation and response lifecycle, covering detection, triage, response, thre…HELPNETSECURITY.COM
3 JunInfosecurity Europe: Execs Must Treat Cyber Threats as Statecraft, ISACA Expert SayPrivate firms are being targeted by nation-state groups for reasons beyond finance, argued ISACA’s Bharat ThakrarINFOSECURITY-MAGAZINE.COM
3 JunMicrosoft Scout agent opens a new category of always-on AutopilotsWorkplace AI assistants have mostly waited for a prompt before doing anything. A user asks, the tool answers, and the exchange ends there. Microsoft is putting a different kind of agent inside its Office applications, one designed to keep operating in the background once a person…HELPNETSECURITY.COM
3 JunGlobal Stock Exchange Hit by Monthslong Email CampaignA threat actor got a near-continuous view into an influential finance executive's email inbox, thanks to clever use of legitimate, native Windows tools.DARKREADING.COM
3 JunAI Used to Decrypt Medieval CiphersResearchers are using machine learning algorithms to decrypt historical pencil-and-paper ciphers.SCHNEIER.COM
3 JunOnly 11% of production agents pass the AI agent security barEnterprise teams are running AI agents that write code, drive browsers, answer customer calls, manage cloud infrastructure, and query data warehouses with standing credentials. A new independent assessment of 100 production agents finds that nearly all of them carry the condition…HELPNETSECURITY.COM
3 JunMalware campaign targeting Minecraft users infects over 116,000 systemsA Malware-as-a-Service (MaaS) operation named WeedHack is targeting Minecraft users and allows threat actors to gain remote access to victims’ screens, webcams, and files through a web-based dashboard, McAfee researchers found. Minecraft, developed by Mojang Studios and rel…HELPNETSECURITY.COM
3 JunImpersonation, Click Hijacking, and TDS: Inside a Malware Distribution EcosystemResearch by: Alexey Bukhteyev Key Takeaways Introduction When we search Google for a popular piece of software, we usually click the first result, sometimes without even looking at the rest, because official project sites tend to rank highest and appear near the top of the r…RESEARCH.CHECKPOINT.COM
3 JunThe $10M Exit DisappearedThis clip argues that the traditional founder exit may be changing. In the past, reaching a certain level of revenue could create a meaningful acquisition opportunity. For many entrepreneurs, selling the company was the expected next step. If valuations, ownership dilution, or ma…YOUTUBE.COM
3 Jun‘Don’t panic’: AI reality checks dominate major cybersecurity conferenceCISOs and their colleagues should focus on network security basics, not AI vendors’ overhyped promises, analysts said at an annual Gartner cybersecurity event.CYBERSECURITYDIVE.COM
3 JunHow attackers are gaining access to LLM inferenceThreat actors are wiring live LLM APIs into malware to generate malicious logic at runtime, and this research maps the five routes they use to access AI models for free. The post How attackers are gaining access to LLM inference appeared first on Intezer .INTEZER.COM
3 JunCoralogix Raises $200M at $1.6B Valuation to Scale AI Observability PlatformCoralogix offers a full-stack observability platform that unifies logs, metrics, traces, security, and AI observability. The post Coralogix Raises $200M at $1.6B Valuation to Scale AI Observability Platform appeared first on SecurityWeek .SECURITYWEEK.COM
🌐 CYBER THREAT LANDSCAPE 3[−]
3 JunWeedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated ContentCybersecurity researchers have flagged a new campaign targeting Minecraft players via YouTube to spread malware capable of gaining control of victims' systems. The Minecraft-focused malware-as-a-service (MaaS) campaign has been codenamed Weedhack by McAfee Labs, stating the activ…THEHACKERNEWS.COM
3 JunArgamal: Malware hidden in hentai gamesKaspersky researchers analyze new Argamal RAT distributed via infected hentai games and allowing the attacker to control the target machine.SECURELIST.COM
3 JunInfostealers are becoming the go-to phishing payloadCybercriminals prefer infostealers to traditional phishing techniques because they reduce friction, scale well, and are widely available.MALWAREBYTES.COM
📰 CYBERSECURITY BRIEFINGS 1[−]
📡 INFOSEC NEWS 15[−]
3 JunWeekly Threat Bulletin – June 3rd, 2026These are the top threats you should know about this week.F5.COM
3 JunInfosecurity Europe: AI-Powered Cybercrime Tools Surge on Dark WebHalcyon’s Cynthia Kaiser lifts the lid on the dark web market for AI cybercrime toolsINFOSECURITY-MAGAZINE.COM
3 JunInfosecurity Europe: Patch Responsibility Remains Up for Grabs as AI Unearths Decades of FlawsThe emergence of AI models capable to autonomously find and fix vulnerabilities at scale is having a significant impact on patching management, experts sayINFOSECURITY-MAGAZINE.COM
3 JunGoogle adds Android protection against AI deepfake scam callsGoogle is introducing a new Android security feature that will detect and flag phone calls in which scammers use artificial intelligence to impersonate a user's personal contacts. [...]BLEEPINGCOMPUTER.COM
3 JunAnthropic Expands Mythos Access to 150 More OrganizationsAnthropic widens Project Glasswing access to 150 more firms as patching becomes the bottleneckINFOSECURITY-MAGAZINE.COM
3 JunInfosecurity Europe: How to Get Boards to Prioritize Cyber Risk QuantificationCybersecurity leaders major companies discuss how they got support from the board on cyber riskINFOSECURITY-MAGAZINE.COM
3 JunMalicious Notifications Could Trick Google Gemini UsersA prompt injection flaw in Google Gemini's voice assistant let attackers hide malicious commands in notifications, enabling social engineering and more.DARKREADING.COM
3 JunShrinking the IAM Attack Surface through Identity Visibility and Intelligence Platforms (IVIP)The Fragmented State of Modern Enterprise Identity Enterprise IAM is approaching a breaking point. As organizations scale, identity becomes increasingly fragmented across thousands of applications, decentralized teams, machine identities, and autonomous systems. The result is Ide…THEHACKERNEWS.COM
3 JunKeep getting calls from questionable numbers? Meet Scam Number CheckScam Number Check lets you quickly check whether a number has been linked to scams before you call back, share information, or send money.MALWAREBYTES.COM
3 JunContinuing Scans for swagger.json, (Wed, Jun 3rd)Enterprise applications often still use complex standards like SOAP for web services. The big advantage of SOAP is its tight and extensive standards, which enable interoperability across an enterprise governed by web services. The disadvantage of SOAP: First, while it is de facto…ISC.SANS.EDU
3 JunWhat 345 Days of Untested Exposure Looks Like at a BankA two-week penetration test can leave roughly 345 days of real-world exposure unvalidated. Sprocket Security explores why continuous testing is becoming critical as attack surfaces constantly change. [...]BLEEPINGCOMPUTER.COM
3 JunInstagram is alerting users who were targeted by hackers during AI chatbot attacksHackers appeared to take over victims’ accounts even after Meta said it fixed its AI-powered support chatbot, which granted hackers access to victims’ accounts.TECHCRUNCH.COM
3 JunWe found this fake-invoice campaign while scammers were still building itInvoices pretending to be from Amazon, PayPal, and others reveal how criminals use fear and phone calls to steal money and devices.MALWAREBYTES.COM
3 JunxAI Asks Court to Strip Alleged Grok Deepfake Nudes Victims of AnonymityFour people suing Elon Musk's AI firm under pseudonyms due to the risks of being identified may face a difficult choice: Reveal your real names, or drop the lawsuit.WIRED.COM
3 JunThreat Hunting Case Study: FileFixFileFix bypasses Mark of the Web (MotW) protections by hijacking the Windows File Explorer address bar. Here is how to hunt for it.INTEL471.COM