🚨 CISA KEV 3[−]
11 Jun KEVCISA Directs Federal Agencies to Prioritize Security Patches Based on RiskThe new BOD 26-04 requires agencies to review and update vulnerability management policies with a focus on KEV catalog entries. The post CISA Directs Federal Agencies to Prioritize Security Patches Based on Risk appeared first on SecurityWeek .SECURITYWEEK.COM
11 Jun KEVTrolling Microsoft With Vulnerabilities - PSW #930In the security news: - Trolling Microsoft With Vulnerabilities - Fable 5 loves guardrails - Binwalk vulnerability - EMBA and local models - EDRChoker - AI worms - Interesting Arista vulnerability added to KEV - BOD 26-04 and stakeholder specific vulnerability categorization - Br…YOUTUBE.COM
11 Jun KEVCISA BOD 26-04: Frequently asked questions about the new risk-based patching directiveCISA issued BOD 26-04, which replaces BOD 22-01 with a four-variable vulnerability prioritization model requiring federal agencies to patch the most dangerous vulnerabilities in as few as three days. Key takeaways BOD 26-04 replaces BOD 22-01 with a four-variable risk model that …TENABLE.COM
🐛 COMMON VULNERABILITIES AND EXPOSURES 23[−]
11 JunMicrosoft Patches Exploited Exchange Server VulnerabilityThe company warned about zero-day attacks exploiting the Exchange Server vulnerability CVE-2026-42897 on May 14. The post Microsoft Patches Exploited Exchange Server Vulnerability appeared first on SecurityWeek .SECURITYWEEK.COM
11 JunCVE-2026-11822 SQLite before 3.53.2 Memory Corruption in FTS5 ExtensionInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-42536 Apache HTTP Server: mod_xml2enc heap overflowInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-46433 lldpd: Heap OOB Read in VLAN Decapsulation memmoveInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-11824 SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterateInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-10846 Insufficient verification that responses belong to a queryInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-48913 Apache HTTP Server: mod_http2 memory corruption when file handles exhaustedInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-44119 Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modulesInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-43951 Apache HTTP Server: OOB Read in `merge_response_headers` can cause crashInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-29167 Apache HTTP Server: mod_ldap per-dir use-after-freeInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-42535 Apache HTTP Server: mod_dav_fs protected directory accessInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-44631 Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char OverflowInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-44186 Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftpInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-34356 Apache HTTP Server: ProxyPassReverseCookieMap buffer overflowInformation published.MSRC.MICROSOFT.COM
11 JunCVE-2026-44185 Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`Information published.MSRC.MICROSOFT.COM
11 JunCVE-2026-34355 Apache HTTP Server: mod_proxy_html buffer overflowInformation published.MSRC.MICROSOFT.COM
11 JunChina-linked recon botnet outpaces enterprise defensesA botnet made up of compromised small office and Internet of Things devices has grown into a larger reconnaissance network capable of rapidly identifying vulnerable internet-facing systems after public vulnerability disclosures, researchers said. The botnet, tracked by Lumen’s Bl…CSOONLINE.COM
11 Jun KEVOracle PeopleSoft servers under attack, Oracle pushes out-of-band security alertA zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft PeopleTools is being exploited in the wild, Charles Carmakal, CTO at cybersecurity firm Mandiant, part of Google Cloud, warned today. The warning comes a day after Oracle published an out-of-band security alert about …HELPNETSECURITY.COM
11 JunOracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day AttacksOracle has released a patch for CVE-2026-35273, but it has not said whether it’s a zero-day exploited in ShinyHunters attacks. The post Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks appeared first on SecurityWeek .SECURITYWEEK.COM
11 JunVU#862559: crypton-x509-validation Haskell libraries do not enforce X.509 NameConstraintsOverview A vulnerability has been discovered in the Haskell TLS software stack, commonly used by applications built in the Haskell programming language to securely connect to servers over the internet. Specifically, the libraries "crypton-x509-validation" fail to enforce a key se…KB.CERT.ORG
11 Jun KEVOracle mitigates PeopleSoft zero-day exploited in data theft attacksOracle is warning about a critical PeopleSoft Suite zero-day vulnerability tracked as CVE-2026-35273 that allows unauthenticated remote code execution, with the flaw actively exploited in ShinyHunter data theft attacks. [...]BLEEPINGCOMPUTER.COM
11 JunDrupal Core CVE-2026-9082 Active Exploitation Confirmed Within Days of DisclosureSensor Intel Series: June 2026 CVE TrendsF5.COM
⚠️ VULNERABILITY DISCLOSURE 31[−]
11 JunGitHub finally pulls the plug on automatic install script execution for npmThe ability for attackers to leverage automatic install script execution in npm will finally come to an end when expected changes arrive from GitHub in July. Coders will still be able to enable the function, but the default setting will block it. In V12, default settings are chan…CSOONLINE.COM
11 JunWhatsAppening here?This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongs…THECYBERWIRE.COM
11 JunX Square Robot open sources its robot-free data collection frameworkCompanies building robots for physical work spend large amounts of time and money operating machines by hand to gather training examples. Each session with a physical robot produces a small number of demonstrations per day, which slows the growth of datasets used to train embodie…HELPNETSECURITY.COM
11 JunMax severity Ivanti Sentry vulnerability now exploited in attacksAttackers are now targeting a recently patched maximum-severity flaw in Ivanti Sentry, enabling them to execute code with root privileges on Internet-exposed secure mobile gateways. [...]BLEEPINGCOMPUTER.COM
11 JunAged-domain acquisition: The tradecraft phishing operators are using to bypass your mail filter’s reputation scoreI’ve spent the past two years working on incident response and threat intelligence, and the pattern I’m about to describe is one I keep seeing show up in cases that should have been caught at the email gateway. The kit families change. The lure templates change. The constant is t…CSOONLINE.COM
11 JunFrontier AI models offer sneak peak of seismic cyber shifts aheadThe advent of Claude Mythos combined with the release of OpenAI’s GPT-5.5 have changed the threat model for CISOs . The arrival of those frontier AI models — and the ones soon to follow — makes it much easier to discover and chain vulnerabilities at a speed and scale that will re…CSOONLINE.COM
11 Jun‘GreatXML’ Zero-Day Exploit Bypasses BitLockerThe PoC exploits Microsoft Defender’s offline scan to spawn a SYSTEM shell when rebooting in Recovery Mode. The post ‘GreatXML’ Zero-Day Exploit Bypasses BitLocker appeared first on SecurityWeek .SECURITYWEEK.COM
11 JunEnhanced License Plate TrackingThe surveillance company Leonardo wants more data : A surveillance company plans to add sensors to automatic license plate readers (ALPRs) that would mean the devices, as well as capture the license plate of passing vehicles, would also sweep up unique identifiers of mobile phone…SCHNEIER.COM
11 JunWhat SRE teams need before they trust AI agentsThe future of reliability will not be defined by whether site reliability engineering (SRE) teams use AI agents, but by the conditions under which they choose to trust them. In high-stakes systems, trust is never granted because a demo looks impressive; it is earned through obser…CSOONLINE.COM
11 JunSplunk, Palo Alto Networks Patch Severe VulnerabilitiesThe security defects could allow attackers to create or modify arbitrary files and access and modify protected resources. The post Splunk, Palo Alto Networks Patch Severe Vulnerabilities appeared first on SecurityWeek .SECURITYWEEK.COM
11 JunAI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS.For thirty years, vulnerability management ran on a buffer: the months between when a vulnerability was found and when someone could figure out how to weaponize it. The solution was straightforward enough; triage by severity, schedule the fix, validate, and move on. The buffer wa…THEHACKERNEWS.COM
11 JunSignal Alums Reveal ‘Encrypted Spaces,’ a System for Making Private Collaboration AppsThe new open-source project could serve as the basis for a future of apps with features as complex as Slack, Discord, or Google Docs—but with added protection against surveillance.WIRED.COM
11 JunKyushu Electric lost backup drive containing data of 10.9 million clientsKyushu Electric Power Transmission and Distribution Co. has disclosed that an external storage device used for system backups has gone missing from a secure server room. While no evidence of data leakage has been identified so far, the company warns that the device contained pers…CYBERINSIDER.COM
11 JunVRChat discloses cloud breach exposing data of 2.4 million usersVRChat has disclosed a data breach affecting 2,436,782 users after attackers gained unauthorized access to data stored in the company's cloud environment. The incident exposed account-related information, including email addresses, usernames, login history, and linked platform id…CYBERINSIDER.COM
11 JunHackers Exploit Langflow Vulnerability for Remote Code ExecutionDisclosed in March, the security defect enables unauthenticated attackers to write files to arbitrary locations on the system. The post Hackers Exploit Langflow Vulnerability for Remote Code Execution appeared first on SecurityWeek .SECURITYWEEK.COM
11 JunCoupang hit with record $409 million data breach fine in KoreaThe Personal Information Protection Commission (PIPC), South Korea's data protection regulator, has fined e-commerce giant Coupang a record 624.6 billion won (roughly $409 million) following a massive data breach affecting more than 37 million customers [...]BLEEPINGCOMPUTER.COM
11 JunCISA tells govt agencies to patch critical exploited flaws in 3 daysThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced a new Binding Operational Directive, 26-04, that prioritizes security updates for Federal Civilian Executive Branch (FCEB) agencies. [...]BLEEPINGCOMPUTER.COM
11 JunServiceNow fixes API issue after reports of suspicious tenant activityServiceNow is notifying customers after discovering and remediating a vulnerability that could have exposed data via an unauthenticated API endpoint on affected instances. The issue emerged publicly after customers began discussing security notifications from ServiceNow and repor…CSOONLINE.COM
11 JunFrom SQLi to RCE – Exploiting LangGraph’s CheckpointerBy Yarden Porat AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store execution state. But what happens when that persistence layer isn’t locked down? Key Points Background LangGraph is an open-source framewo…RESEARCH.CHECKPOINT.COM
11 JunCriminal AI-as-a-Service in 2026: How the Underground Market Is Operationalizing CybercrimeIntroduction The underground market for criminally oriented generative AI has moved beyond the early hype surrounding 'malicious chatbots.' The gradual integration of AI as a productivity layer within cybercrime operations has become the dominant story, indicating that while the …RAPID7.COM
11 JunAuthorities dismantle 'AudiA6' ransomware crypto-laundering serviceLaw enforcement has dismantled the “AudiA6” cryptocurrency service allegedly used by ransomware actors and other cybercriminals to launder more than $380 million. [...]BLEEPINGCOMPUTER.COM
11 JunThe Gentlemen Ransomware Claims 478 Victims, Can Spread Like a WormA new analysis of The Gentlemen operation has revealed that the financially motivated threat group initially operated as an affiliate responsible for conducting double extortion attacks, while leveraging resources from various ransomware-as-a-service (RaaS) schemes like LockBit (…THEHACKERNEWS.COM
11 JunCyber Force not included in Senate defense policy roadmapAn amendment by Sen. Kirsten Gillibrand (D-NY) to the chamber’s fiscal 2027 national defense authorization bill that would have created the digital-focused service was defeated 14-13 when the Senate Armed Services Committee took up the nearly $1.2 trillion legislation behind clos…THERECORD.MEDIA
11 JunCoupang hit by massive $456 million fine for 2025 data breach incidentSouth Korea's Personal Information Protection Commission (PIPC) has fined e-commerce giant Coupang 624.68 billion won ($456 million) after concluding that poor security practices led to a data breach affecting approximately 37.5 million people. The decision follows a November 202…CYBERINSIDER.COM
11 JunCISA orders federal agencies to “patch smarter”The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a Binding Operational Directive that will change how the US federal government approaches vulnerability management. The directive arrives as the patching problem has become nearly unmanageable, driven by a …HELPNETSECURITY.COM
11 JunNew GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML FilesSecurity researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a new Windows BitLocker bypass dubbed GreatXML, a day after they published an exploit for Microsoft Defender. "This was an accidental discovery, it took a total of 4 hours to find this," the …THEHACKERNEWS.COM
11 JunNexstar investigates potential breach after ShinyHunters claims theft of 1.1M Salesforce recordsNexstar Media Group is investigating a potential cybersecurity incident after the ShinyHunters extortion group claimed to have stolen more than one million Salesforce records and additional internal corporate data from the broadcasting giant. While the threat actors have not publ…CYBERINSIDER.COM
11 JunMax-Severity Ivanti Flaw Exploited 24 Hours After DisclosureInitial methods suggest attackers had likely mapped out Ivanti's asset landscape upfront and acted quickly once the exploit became public.DARKREADING.COM
11 JunOracle warns of security bug that hackers abused to breach 100+ companiesThe tech giant warned of a security flaw that a cybercrime gang said it's exploiting as part of a mass-hacking campaign. Google said it notified more than 100 organizations that had potentially vulnerable servers.TECHCRUNCH.COM
11 JunNightmare Eclipse Trolling MicrosoftThe discussion centers on a persona called “Nightmare Eclipse,” which appears to act as a single researcher or group releasing vulnerabilities in a highly public and strategic way. This includes dropping zero-day vulnerabilities outside of standard vendor patch cycles. This style…YOUTUBE.COM
11 JunJapanese energy firm loses drive with data of 10.9 million clientsKyushu Electric Power Co., Inc. has disclosed a physical security incident that affects private data of more than 10 million customers. [...]BLEEPINGCOMPUTER.COM
📋 SECURITY BULLETINS 1[−]
11 JunMicrosoft fixes BitLocker recovery bug on Windows Server 2025Microsoft has resolved a known issue causing some Windows Server 2025 devices to boot into BitLocker recovery after installing the April 2026 security update. [...]BLEEPINGCOMPUTER.COM
📢 SECURITY ADVISORIES 2[−]
11 JunTrump’s AI pivot.This week, Dave and Ben sit down with N2K's lead analyst Ethan Cook to examine President Trump's recent Executive Order centered on AI. With this order, the Trump administration is looking to increase its oversight of new AI models to better account for potential security vulnera…THECYBERWIRE.COM
11 JunCISA Orders Agencies to Patch by Risk, Not SeverityNew CISA directive tells federal agencies to patch by real-world risk, not CVSS severity scoresINFOSECURITY-MAGAZINE.COM
🔥 INCIDENT REPORTING 13[−]
11 JunPrompt injection still drives most agentic AI security failures in productionA backdoor sat on PyPI for three hours in March 2026. Nearly 47,000 downloads occurred during the window. The compromised package, LiteLLM, serves as the language-model gateway for CrewAI, DSPy, Microsoft GraphRAG, and dozens of other AI agent frameworks. Anyone pulling an update…HELPNETSECURITY.COM
11 JunNottingham University data breach affects over 450,000 studentsThe University of Nottingham confirmed on Wednesday that a hacking group gained access to its student records system in a breach affecting both current students and alums. [...]BLEEPINGCOMPUTER.COM
11 JunUniversity of Nottingham Confirms Breach After Hackers Leak DataThe ShinyHunters hacker group has taken credit for the attack, leaking more than 450,000 email addresses and other information. The post University of Nottingham Confirms Breach After Hackers Leak Data appeared first on SecurityWeek .SECURITYWEEK.COM
11 JunExtortion-Only Attacks Increase, With Data Theft Dominating Ransomware ClaimsExtortion-only attacks are increasing as data theft drives most ransomware claims, with many organizations unable to stop stolen data from being exposedINFOSECURITY-MAGAZINE.COM
11 JunCybersecurity Stars Awards 2026: Winners Announced Across 95 CategoriesMost good security work is invisible by design. Today is the exception. The 2026 Cybersecurity Stars Awards winners are announced across 95 subcategories in four main award categories. The reason is simple. Cybersecurity is full of work that deserves recognition and rarely gets i…THEHACKERNEWS.COM
11 JunSouth Korea hits Coupang with $400M+ fine for data breach that affected millionsSouth Korean authorities issued the record-breaking fine following a data breach that affected over 30 million customers.TECHCRUNCH.COM
11 JunUniversity of Nottingham confirms cyber incident as Shiny Hunters group claims data theftAccording to the university’s statement, it is still working to understand what data has been accessed and said it had already directly contacted affected students and alumni, potentially including those in its foreign campuses in Malaysia and China as well as in Nottingham.THERECORD.MEDIA
11 JunAI Is Upgrading Hackers FastAI is rapidly increasing the effectiveness of cyber attackers at every level. Tasks that once required deeper expertise can now be automated, accelerated, or simplified with AI-assisted tooling. That shift compresses the gap between inexperienced, mid-tier, and highly advanced th…YOUTUBE.COM
11 JunGerman court holds Google liable for AI-generated claims.OpenAI disrupts two China-linked influence operations. Cyberattack disrupts Australian sugar mills.THECYBERWIRE.COM
11 JunBritish high school sends students home following cyberattackGreat Marlow School, which has 1,428 pupils according to the Department for Education (DfE), said it was set to remain closed while it works with specialist IT and cybersecurity professionals to resolve the issue.THERECORD.MEDIA
11 JunRussian national charged in connection with Void Blizzard espionage campaignDenis Obrezko accused of orchestrating cyberattacks that compromised at least 11 U.S. companies as part of the Kremlin-linked group's sprawling espionage operation.\ The post Russian national charged in connection with Void Blizzard espionage campaign appeared first on CyberScoop…CYBERSCOOP.COM
11 JunThe court calls Google’s bluff.Google faces liability for AI-generated claims. Washington pauses public AI model assessments. Anthropic ships a safer AI model. OpenAI disrupts influence operations. Ransomware operators get a powerful new backdoor. Urgent patches land for Ivanti and Veeam. PyPI supply chain att…THECYBERWIRE.COM
11 JunMaine breach portal abused to publish fake data breach disclosuresIn an unusual misinformation campaign, fraudulent data breach disclosures were submitted to Maine's official breach portal and publicly posted before their legitimacy could be verified, prompting companies to deny the claims. [...]BLEEPINGCOMPUTER.COM
🕵️ THREAT INTELLIGENCE 22[−]
11 JunChinese, N. Korean Threat Groups Build on Asia-Pacific SuccessNorth Korea's gross domestic product (GDP) has grown, in part because of the cybercrime gains of groups linked to the nation, which target business and financial firms.DARKREADING.COM
11 JunISC Stormcast For Thursday, June 11th, 2026 https://isc.sans.edu/podcastdetail/9968, (Thu, Jun 11th)(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.ISC.SANS.EDU
11 JunOrganizations can’t see much of their mobile AI activityOrganizations have limited visibility into AI activity on mobile devices despite security leaders expressing confidence in their AI governance, according to Lookout’s “Solving for the Mobile AI Blind Spot: Executive Confidence Meets Technical Reality” report. Mo…HELPNETSECURITY.COM
11 JunThreat actors are recruiting the people who hold cloud loginsCompanies keep most of their data and applications in cloud platforms that anyone can reach with the right login. That setup turns each employee holding those credentials into a security variable, and members of the cybercrime underground have built methods to reach those people.…HELPNETSECURITY.COM
11 JunMaking the cloud prove it followed your privacy wishesMaking companies that store personal data in cloud key-value databases handle deletion requests by running the operation and confirming the job is complete. The people making those requests and the regulators overseeing them have had limited means to confirm the data is gone or t…HELPNETSECURITY.COM
11 JunCheck Point expands MSP platform with with AI governance and unified security bundlesCheck Point has announced a major expansion of its Managed Service Provider (MSP) platform, designed to help MSPs secure AI adoption, streamline operations and simplify managed security delivery. The announcement brings together three strategic innovations under a single MSP visi…HELPNETSECURITY.COM
11 JunIDnow launches Trust Platform to help regulated firms move from KYC to continuous trustIDnow has announced the launch of the IDnow Trust Platform, designed to help regulated organisations orchestrate identity verification, fraud prevention, biometric authentication, and qualified digital trust services throughout the customer lifecycle. “The identity industry…HELPNETSECURITY.COM
11 Jun9 out of 10 people can no longer distinguish real from AI-generated contentOnline fraud is becoming harder to distinguish from legitimate activity as AI-generated messages, voices, photos, reviews, and identities become more convincing. Nearly nine in ten adults say they can no longer tell what is real from AI-generated content, according to the latest …HELPNETSECURITY.COM
11 JunOceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt AttackThe Vietnam-aligned threat actor known as OceanLotus has been attributed to two distinct campaigns that targeted domestic entities and stock investors with a backdoor known as SPECTRALVIPER. The campaigns involve a prolonged cyber espionage operation aimed at a Vietnamese infrast…THEHACKERNEWS.COM
11 JunTrust No Skill: Integrity Verification for AI Agent Supply ChainsProtect enterprise AI agents from supply chain risks by auditing third-party skills for hidden vulnerabilities and multi-stage attack chains. The post Trust No Skill: Integrity Verification for AI Agent Supply Chains appeared first on Unit 42 .UNIT42.PALOALTONETWORKS.COM
11 JunFBI seizes 13 websites linked to alleged Chinese intelligence-gathering effortFederal authorities have seized 13 internet domains allegedly used to target current and former U.S. government employees and military personnel with access to classified and sensitive information. The post FBI seizes 13 websites linked to alleged Chinese intelligence-gathering e…HELPNETSECURITY.COM
11 JunSiemens Says Desigo CC Files Flagged as Malware by Security EnginesA PowerShell script included in patch files appears to be triggering false positives by multiple security engines. The post Siemens Says Desigo CC Files Flagged as Malware by Security Engines appeared first on SecurityWeek .SECURITYWEEK.COM
11 JunFBI Seizes 13 Websites That Officials Say Were Used by China to Target and Recruit US WorkersThe 13 websites purported to be affiliated with consulting companies that advertised job openings for current and former holders of security clearances The post FBI Seizes 13 Websites That Officials Say Were Used by China to Target and Recruit US Workers appeared first on Securit…SECURITYWEEK.COM
11 JunOnyxC2 Stealer Offers Cybercriminals Enterprise-Grade Theft for $250 a MonthResearchers say the OnyxC2 malware targets more than 200 applications and extensions while evading detection through encrypted payloads, DLL sideloading, and in-memory execution techniques. The post OnyxC2 Stealer Offers Cybercriminals Enterprise-Grade Theft for $250 a Month appe…SECURITYWEEK.COM
11 JunAlert Fatigue Is Becoming a Security Threat of Its OwnAs alert volumes outpace human capacity, organizations are turning to AI, automation, and deeper context to separate real threats from the noise. The post Alert Fatigue Is Becoming a Security Threat of Its Own appeared first on SecurityWeek .SECURITYWEEK.COM
11 JunFake Spotify Premium tutorials on TikTok and Instagram Reels spread malwareCybercriminals are using TikTok and Instagram Reels videos to spread Vidar, an infostealer malware, through fake downloads for popular paid software, according to ReversingLabs. The researchers uncovered two campaigns behind the activity, each using a different approach to draw i…HELPNETSECURITY.COM
11 JunProxmox releases Mail Gateway 9.1 with quarantine and backup encryption changesProxmox Mail Gateway 9.1 adds updated system components, changes to the spam quarantine interface, and encryption for backups. It works as a mail proxy positioned between the firewall and internal mail servers, screening incoming and outgoing traffic for spam, viruses, Trojans, a…HELPNETSECURITY.COM
11 JunMaking secret scanning more trustworthy: Reducing false positives at scaleAlerts are more trustworthy and actionable when noise is reduced. See how we improved the verification step with context-aware LLM reasoning. The post Making secret scanning more trustworthy: Reducing false positives at scale appeared first on The GitHub Blog .GITHUB.BLOG
11 JunHacker linked to Void Blizzard faces charges over cyberespionage campaignDenis Obrezko, 36, made his initial appearance in federal court in Boston on Tuesday after being transferred to U.S. custody from Thailand, where he was arrested last November.THERECORD.MEDIA
11 JunEnterprises report increasing budgets for security training in AI and other critical topicsFinding the time to train employees remains the biggest impediment to programs’ success, according to a new report.CYBERSECURITYDIVE.COM
11 JunFIFA World Cup expected to face extensive criminal, hacktivist cyber threatsResearchers warn that thousands of malicious domains are already in place, as fans, tournament organizers face potential attacks.CYBERSECURITYDIVE.COM
11 JunHundreds of iPhone apps found leaking OpenAI, Gemini credentialsAn academic study has found that LLM-powered iOS applications routinely expose API credentials that can be abused to access AI services. Researchers discovered that nearly two-thirds of tested apps leaked credentials or exposed backend access mechanisms, with many vulnerabilities…CYBERINSIDER.COM
🌐 CYBER THREAT LANDSCAPE 4[−]
11 JunGitHub to Disable npm Install Scripts by Default to Stop Supply Chain AttacksGitHub has announced what it said are "breaking changes" coming to npm version 12, one of which turns off install scripts by default to combat software supply chain threats. The changes aim to combat attack techniques that abuse the "npm install" command to trigger the execution …THEHACKERNEWS.COM
11 JunMost Cybersecurity Teams Struggle to Find Time for Training on New Cyber ThreatsOrganizations are aware of the challenges that new technologies like AI bring: but cybersecurity staff struggle to make time for the required training during working hoursINFOSECURITY-MAGAZINE.COM
11 JunThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Action Patch + 28 New StoriesIt's been one of those weeks. You expect the usual noise: recycled malware, sloppy attacks, another easy target getting hit. Instead, there's a supply chain attack kit in a public repo, a $5,000-a-month RAT that clones browsers, and research showing AI agents can be tricked into …THEHACKERNEWS.COM
11 JunCybercriminals Use Fake AI Guides and Dev Tools to Spread AsyncRAT MalwareFake AI guides hide a multi-stage chain that drops AsyncRAT, with signs of AI-assisted codingINFOSECURITY-MAGAZINE.COM
🎙️ PODCASTS 2[−]
11 JunDrug Sites Hijacked Spotify’s Search Ranking Through Fake PodcastsA joint congressional report describes a spam operation that turned tens of thousands of fake podcasts into search-engine bait for illegal pharmacy and scam sites.WIRED.COM
11 JunWhy Identity Must Evolve for AI-Driven Work with Peter Barker from Ping IdentityPeter Barker, Chief Product Officer at Ping Identity, joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices. Peter discusses how AI agents, copilots, and automation are reshaping enterprise identity, creating demand for systems that can operate beyond …THECYBERWIRE.COMHTTPS:
📡 INFOSEC NEWS 13[−]
11 JunNew “Agentjacking” Attacks Could Hijack AI Coding AgentsTenet Security researchers reveal how new “agentjacking” attacks could trick coding agents into executing arbitrary codeINFOSECURITY-MAGAZINE.COM
11 JunChildren’s phones must block nude images by September, UK saysApple and Google have three months to block nude images on children's phones. They're not allowed to collect any data while they do it.MALWAREBYTES.COM
11 JunData of 2.4 million VRChat users stolenWe explain what data was exposed, the potential risks, and the steps you should take now.MALWAREBYTES.COM
11 JunInterpol Dismantles SniperDz Phishing-as-a-Service PlatformNew revelations by Group-IB expose the full scale of the decade-old SniperDz phishing operationINFOSECURITY-MAGAZINE.COM
11 JunLABScon25 Replay | Keynote: Steps to an Ecology of CyberDecades of piling complexity onto non-standardized stacks have left security unsteerable. Juan Andrés Guerrero-Saade makes the case for a new approach.SENTINELONE.COM
11 JunWhy AI-driven threats are exposing the limits of MSP security stacksAI-driven attacks are exposing the limits of fragmented MSP security stacks and slow response workflows. Kaseya breaks down why integrated security, automation, and recovery are becoming essential. [...]BLEEPINGCOMPUTER.COM
11 JunHow threat hunting evolves at scaleWe offer a practical roadmap for evolving informal, ad hoc threat hunting practices into a mature, scalable programREDCANARY.COM
11 JunGoogle can be liable for false AI Overviews, court rules"AI can make mistakes" isn't a good enough legal defense for defamatory or incorrect AI Overviews, a German court has ruled.MALWAREBYTES.COM
11 JunSegmentation Works for OT If Operators Are Paying AttentionOperational technology security remains as difficult as ever, with even the best practice recommendation falling short.DARKREADING.COM
11 JunNew Attacks Trick OpenClaw AI Agent Into Running Code and Leaking SecretsTwo security teams have shown, in separate research published this week, that OpenClaw, the popular self-hosted AI agent, can be driven to run attacker-controlled code or hand over sensitive data through ordinary-looking inputs. Imperva buried instructions inside shared contacts,…THEHACKERNEWS.COM
11 JunA tale of two erasIn this week’s newsletter, Amy reminisces on the tech toys of their childhood, inspired by a hilarious lesson about why your digital privacy shouldn't be left on an open channel.TALOSINTELLIGENCE.COM
11 JunGrok Is Still Hosting Sexualized Deepfakes of Famous WomenA WIRED investigation found dozens of “nudified” deepfake images and videos on Grok's website, including nonconsensual depictions of celebrities and at least one prominent US politician.WIRED.COM
11 JunNY State Congress passes new bills focused on AI and consumer protections.Meta files a complaint against NSO Group.THECYBERWIRE.COM