The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
SonicWall SMA 1000 zero-days let attackers chain to full admin command execution
SonicWall confirmed active zero-day exploitation of two flaws in SMA 1000 series appliances (SMA6210, SMA7210, SMA8200v): CVE-2026-15409, a CVSS 10.0 unauthenticated SSRF in the Work Place interface, and CVE-2026-15410, a CVSS 7.2 post-auth code injection in the Management Console. Chained…
-
New macOS infostealer PamStealer poses as clipboard manager Maccy, verifies passwords before stealing them
PamStealer is distributed through a lookalike site (maccyapp[.]com) impersonating the real Maccy clipboard tool. A first-stage AppleScript payload downloads a Rust-based Mach-O infostealer that validates stolen credentials against macOS's own PAM authentication before exfiltrating them, along with…
-
FBI and Google dismantle NetNut, a 2-million-device residential proxy botnet used by criminals and state actors
The FBI seized domains tied to NetNut (aka Popa), a residential proxy service run by publicly traded Israeli firm Alarum Technologies. The underlying botnet is built from roughly 2 million compromised Android devices, smart TVs and streaming boxes infected via trojanized apps and Badbox 2.0…
-
Sysdig documents JADEPUFFER, the first ransomware attack run start to finish by an AI agent
Sysdig's threat research team found an LLM-driven agent that broke into an exposed Langflow server via an old, already-patched flaw (CVE-2025-3248), harvested cloud and AI provider credentials, moved laterally into a MySQL/Nacos setup using a default signing key from 2020, encrypted 1,342 config…
-
CISA confirms active exploitation of SharePoint RCE, gives federal agencies until July 4 to patch
CISA added CVE-2026-45659 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog on July 1 after confirming active exploitation. The bug is a deserialization flaw in SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, patched by Microsoft in…
-
Cisco ships two July advisories: Catalyst Center file-read flaw and ClamAV bundle
Cisco published two advisories: an arbitrary file-read vulnerability in Catalyst Center (CVE-2026-20191, High, CVSS 7.5) and a set of seven ClamAV vulnerabilities affecting Cisco products (High, CVSS 7.5). Both are rated High rather than Critical, with no confirmed active exploitation reported…
-
19-year-old Scattered Spider suspect extradited from Finland, charged in US
Peter Stokes, 19, a dual US-Estonian citizen, was extradited from Finland and made his first federal court appearance in Chicago on June 30, charged with conspiracy, computer intrusion, and fraud. He was arrested in Finland in April under an Interpol Red Notice. DOJ alleges Stokes, active since…
-
Microsoft accelerates quantum-safe security roadmap, targets 2029
Microsoft is moving up its Quantum Safe Program timeline, aiming to transition critical products and services to post-quantum cryptography by 2029 and folding PQC requirements into its Secure Future Initiative. Near-term focus: TLS 1.3 adoption, crypto-agility for stored data, and PQC for trust…
-
First documented case of an AI model independently building working browser-native ransomware
Check Point found a Python Flask malware sample, built using DeepSeek, that combines a phishing lure with Chrome's File System Access API to encrypt local files entirely inside the browser, no native payload, browser exploit, or root access required, on both Windows and Android. The sample…
-
DHS confirms hackers breached HSIN info-sharing platform
DHS confirmed a cyberattack compromised the Homeland Security Information Network (HSIN), an unclassified platform used by federal, state, local, and private-sector partners to share threat and incident information. The intrusion, first reported by Nextgov, is believed to have occurred between…
-
Cyber insurance market holds steady on price, but SME coverage gap keeps widening
Two GlobalData/Insurance Journal pieces landed the same day: the US cyber insurance market saw its eighth straight quarter of pricing cuts in Q1 2026, with the 2025 loss ratio climbing to 53, its highest since the pandemic ransomware spike, driven by rising third-party claims. Separately…
-
Aflac Japan discloses breach of 4.38 million policyholders, including bank account numbers
Aflac Life Insurance Japan disclosed a breach affecting roughly 4.38 million policyholders. The company discovered unauthorized access on June 25 and determined attackers were inside systems from June 15 to June 25. Around 230,000 records included bank account numbers used for premium payments…
-
Blackfield ransomware demands $2 million from Nidec after Taiwan subsidiary breach
Blackfield ransomware claimed an attack on Nidec Chaun Choung Technology, Nidec's Taiwanese subsidiary. Nidec confirmed "ransomware-originated damage" to part of the subsidiary's servers on June 22 and shut down affected systems. Blackfield is demanding $2 million to delete allegedly stolen data…
-
Apple patches WebKit bugs found by Anthropic Claude and OpenAI Codex Security, cites AI-driven exploit speed
Apple shipped iOS 26.5.2, iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2 out of cycle, fixing over three dozen flaws including four WebKit bugs found using AI tooling. Three (CVE-2026-43707, CVE-2026-43716, CVE-2026-43745) are credited to OpenAI's Codex Security; the fourth, CVE-2026-43715…
-
CISA: Windows "BlueHammer" flaw now weaponized by ransomware gangs
CISA confirmed ransomware groups are now exploiting CVE-2026-33825, a Microsoft Defender local privilege escalation bug leaked by a researcher going by "Nightmare Eclipse" back in April, alongside working PoC code. Microsoft patched it April 14, but CISA's Monday KEV update flags active ransomware…
-
Post-quantum cryptography: why "harvest now, decrypt later" starts with credentials
Analysis piece arguing the quantum threat is a present-tense data problem, not a future one: traffic and credentials captured today can be decrypted once a capable quantum computer exists, so long-lived secrets intercepted now should be treated as already exposed. The recommended move is shifting…
-
Hijacked npm and Go packages use VS Code autorun and blockchain dead drops to deploy a Python infostealer
JFrog flagged two hijacked npm packages (html-to-gutenberg 4.2.11, fetch-page-assets 1.2.9); Nextron found 16 Go packages with the same malware. The trick is a hidden VS Code task named "eslint-check" set to runOn folderOpen, so simply opening the project in VS Code or Cursor triggers execution…
-
SimpleHelp RMM flaw CVE-2026-48558 exploited to drop TaskWeaver loader and new "Djinn" stealer; added to CISA KEV June 29
Attackers are abusing an unauthenticated auth-bypass in SimpleHelp (a remote monitoring and management tool) to create privileged "Technician" accounts, then deploy the TaskWeaver loader (an obfuscated jquery.js pulled from a throwaway Cloudflare domain) and the previously undocumented Djinn…
-
Oracle E-Business Suite flaw CVE-2026-46817 now exploited in the wild
Threat-intel firm Defused detected first in-the-wild exploitation over the June 27-28 weekend against EBS honeypots. The bug is an unauthenticated takeover in the File Transmission component of Oracle Payments; captured traffic shows POST requests to the iPayment endpoint pulling /etc/passwd, a…
-
The Gentlemen RaaS ships "GentleKiller" EDR-killer framework to affiliates, targeting 400+ processes across 48 security products
The Gentlemen ransomware-as-a-service operation maintains a modular suite of EDR/AV killers, centered on GentleKiller, with at least eight variants that impersonate legitimate products (Kaspersky, Valorant, Javelin, WatchDog). The tooling uses bring-your-own-vulnerable-driver (BYOVD) to elevate…
-
Polymarket frontend supply-chain hack, losses revised to $3.1M
A compromised third-party vendor injected a malicious script into Polymarket's front end for some users. Attackers drained roughly $3.1M in the platform's pUSD stablecoin from 11 wallets, bridged Polygon to Ethereum, and converted to ETH. Polymarket contained the issue, removed the affected…
-
ShinyHunters extortion spree via Oracle PeopleSoft zero-day (CVE-2026-35273), 100+ orgs, education hit hardest
ShinyHunters (tracked by Mandiant as UNC6240) exploited an unauthenticated RCE in Oracle PeopleSoft PeopleTools (CVE-2026-35273, CVSS 9.8) as a zero-day before Oracle's June 10 advisory. The group claims data from 100-plus organizations across roughly 300 PeopleSoft instances, with about 68…
-
Operation Endgame disrupts StealC, Amadey, and SocGholish; 27M credentials recovered, 47M USD crypto frozen
An international takedown coordinated by Europol's EC3 and J-CAT, with Microsoft and agencies from Germany, the Netherlands, Denmark, the UK, Canada, and the US, dismantled the infrastructure behind the StealC and Amadey infostealers and the SocGholish loader. The operation seized 326 servers and…
-
"Mistic" fileless backdoor tied to access broker KongTuke/Woodgnat, insurance and education among targets
Symantec detailed Mistic, a stealthy memory-only backdoor used in financially motivated intrusions since April 2026 against insurance, education, IT, and professional-services orgs. It runs C2 payloads directly in memory, avoids writing to disk, then self-deletes after the mission, defeating…
-
DirtyClone Linux kernel local privilege escalation (CVE-2026-43503) gets first public exploit walkthrough
CVE-2026-43503 (CVSS 8.8) is a new variant in the DirtyFrag family. A local user can corrupt file-backed page-cache memory by forcing the kernel to clone a crafted network packet through an attacker-controlled IPsec tunnel, overwriting a privileged binary like /usr/bin/su to gain root. The flaw…