The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
MagMutual, a medical malpractice insurer, listed as breached by threat actor "LeakNet"
MagMutual Insurance Company, an Atlanta-based medical professional liability insurer serving physicians and healthcare organizations nationwide, was listed by threat actor LeakNet. As an insurer, MagMutual is subject to state insurance data-security laws requiring a written information security…
-
Amazon Q Developer flaw lets a malicious Git repo run code and steal cloud credentials via MCP config (CVE-2026-12957)
Amazon Q's VS Code extension auto-read a workspace .amazonq/mcp.json and launched the MCP servers it defined, with those processes inheriting the developer's full environment (AWS keys, CLI tokens, SSH agent). A single malicious config in a cloned repo could exfiltrate live AWS session credentials…
-
Polymarket loses ~$3M in frontend supply-chain attack; vendor compromise injected malicious script, full refunds promised
A compromised third-party vendor injected malicious JavaScript into Polymarket's web frontend for some users, tricking them into signing unauthorized transactions that drained pUSD/stablecoin holdings, converted to ETH, and moved to attacker wallets. Fewer than 15 accounts were hit; Polymarket…
-
"Gaslight" macOS implant weaponizes prompt injection to derail AI-assisted malware triage; tied to North Korea
Researchers documented Gaslight, a previously undocumented Rust-based macOS backdoor and infostealer assessed with high confidence as the work of North Korea-aligned actors. Its standout feature is an embedded cascade of 38 fabricated "system" failure messages in a Markdown-fenced block, designed…
-
Cisco Catalyst SD-WAN zero-day (CVE-2026-20245) exploited for months before disclosure; Mandiant details root-shell path
Mandiant reported that an unknown threat actor exploited CVE-2026-20245 (CVSS 7.8) in Cisco Catalyst SD-WAN Manager (vManage), Controller (vSmart), and Validator (vBond) as a zero-day for at least two months before public disclosure. The attacker abused a tenant-upload feature in the SD-WAN CLI to…
-
Breach-watch: fresh June 24 leak-site listings (context, not verified)
New extortion or breach listings appeared on June 24 naming Coldstat Refrigeration Inc., Randa Apparel & Accessories, Fast Transit Line (Belgium), IH Engineers, Lee International, and Reynella East College. These are single-source tracker entries and attacker claims, not confirmed disclosures, so…
Also covered by Breachsense
-
Operation Endgame disrupts SocGholish, Amadey, and StealC malware networks
A coordinated international action under Operation Endgame, announced June 24, dismantled infrastructure behind the SocGholish loader and the Amadey and StealC infostealers. Microsoft's Digital Crimes Unit identified and moved against 200-plus malicious command-and-control domains and IPs through…
-
Vienna Airport hit by ransomware claim; APT73/Bashe lists stolen data, airport disputes scope
A ransomware group operating as APT73, also tracked as Bashe, claimed a cyberattack on Flughafen Wien AG (Vienna International Airport), with the breach surfacing publicly on June 24. The group says it took more than half a million emails and over 4,470 files and has set a buy-back deadline before…
-
CISA adds actively exploited Lantronix EDS5000 root command-injection flaw to KEV (CVE-2025-67038)
CISA added CVE-2025-67038 to its Known Exploited Vulnerabilities catalog on June 23 alongside the Ubiquiti UniFi flaws covered in the earlier run. The Lantronix EDS5000 (a serial-to-Ethernet device server) fails to sanitize the username parameter before concatenating it into a shell command that…
Also covered by The Hacker News
-
Industry breach watch: Qilin claims Central Bank of Libya, DragonForce hits BITS Pilani
Fresh leak-site activity in the window includes Qilin claiming the Central Bank of Libya and DragonForce listing BITS Pilani, among others. These are extortion-group claims rather than confirmed disclosures, so treat scope and data-volume figures as unverified until corroborated.
-
CISA publishes batch of June 23 ICS advisories (ICSA-26-174 series)
CISA released a batch of Industrial Control Systems advisories on June 23 (ICSA-26-174-01 through -07), covering vulnerabilities in widely deployed OT vendor equipment. Recent CISA ICS cycles have concentrated on Siemens, Schneider Electric, Rockwell Automation, and ABB products that run in…
-
Cisco Unified CM SSRF flaw (CVE-2026-20230) now exploited in the wild
Attackers began exploiting CVE-2026-20230, a server-side request forgery flaw in Cisco Unified Communications Manager and Unified CM Session Management Edition that can be chained to write files and escalate to root. Defused observed exploitation over the weekend from a single IP using file://…
Also covered by rapid7.com, CISA
-
"Cordyceps" CI/CD flaw lets anyone hijack GitHub Actions pipelines at major orgs
Novee Security disclosed a systemic class of GitHub Actions workflow flaws, named Cordyceps, that lets an unauthenticated user with only a free account forge approvals, inject code via malicious pull requests, or steal long-lived credentials. Tainted input flowing from a low-privilege workflow…
-
Samsung KNOX kernel use-after-free exposed Galaxy S9–S25 (newly disclosed research)
Researchers publicly detailed CVE-2026-20971 (CVSS 7.8), an eight-year-old use-after-free in Samsung's KNOX kernel (PROCA/FIVE integrity subsystems), reachable from any untrusted app and capable of kernel-level memory corruption and full device takeover. It spans Galaxy S9 through S25 plus…
Also covered by CISA
-
OpenAI expands Daybreak: GPT-5.5-Cyber, Codex Security plugin, "Patch the Planet"
OpenAI expanded its Daybreak cybersecurity initiative on June 23, adding a Codex Security plugin (scans codebases, traces attack paths, builds threat models, generates patches, exports SARIF/CodeQL), broader access to GPT-5.5-Cyber (85.6% CyberGym, 39.5% ExploitGym, 69.8% SEC-bench Pro), a Cyber…
-
FortiBleed campaign: compromised firewalls turned into credential stealers
New June 23 reporting details how FortiBleed operators deploy "FortigateSniffer," abusing the FortiOS built-in diagnose sniffer packet command to passively capture authentication traffic across 24 protocols on already-compromised FortiGate devices. The broader campaign exposed valid admin/SSL-VPN…
-
Two Ubiquiti UniFi OS flaws added to CISA Known Exploited Vulnerabilities catalog
CISA added CVE-2026-34908 (path traversal) and CVE-2026-34909 (improper input validation enabling command injection) in Ubiquiti UniFi OS to the KEV catalog on June 23. Both allow a network-positioned attacker to reach files on the underlying system or inject commands; the path-traversal flaw can…
-
Tata Electronics confirms breach; World Leaks dumps alleged Apple and Tesla supplier files (backfill, dated June 22-23)
Tata Electronics, a major manufacturing supplier to Apple and Tesla, confirmed a cybersecurity incident after the group World Leaks, widely believed to be a rebrand of Hunters International, posted a roughly 204,000-file, 630 GB cache it says contains component designs, schematics, mechanical…
-
LastPass confirms customer-data breach via Klue OAuth-token theft (Salesforce)
LastPass confirmed attackers accessed its Salesforce CRM data after the Icarus extortion group compromised Klue, a third-party market-intelligence platform integrated with LastPass's Salesforce and Gong. Attackers used compromised legacy integration credentials to obtain OAuth tokens connecting…
-
ShapedPlugin WordPress Pro plugins backdoored in vendor supply-chain attack
ShapedPlugin's build and update pipeline was breached (around May 21, 2026) and backdoored code was pushed through official licensed Pro update channels. Affected builds include Real Testimonials Pro 3.2.5, Product Slider Pro for WooCommerce (CVE-2026-49777, CVSS 10.0), and Smart Post Show Pro…
-
Linux kernel "pedit COW" local root (CVE-2026-46331)
A missing-bounds-check write in the kernel's actpedit traffic-control action corrupts the shared page cache, letting a local unprivileged user reach root where actpedit is reachable and unprivileged user namespaces are enabled. Public PoC poisons cached /bin/su. Affects RHEL 8/9/10, Debian…