[CVE-2026-48558]

July 1, 2026

• SimpleHelp CVE-2026-48558 (CVSS 10.0) intrusions are now dropping a second, previously unreported malware family — TaskWeaver — alongside Djinn Stealer, with the actor focused on credentials, SSH keys, crypto wallets and dev tooling. The Hacker News · Threat Activity

in CitrixBleed Returns: watchTowr Discloses a New NetScaler Pre-Auth Memory Overread

June 30, 2026

• SimpleHelp CVE-2026-48558, a critical authentication-bypass, is being exploited to drop Djinn Stealer, a previously undocumented cross-platform infostealer (Windows/macOS/Linux) that explicitly hunts cloud and AI service credentials linking dev and admin environments. BleepingComputer, Dark Reading · Vulnerabilities & Exploits

in Edge Appliances Bleed: watchTowr Drops Kemp LoadMaster Pre-Auth RCE as Oracle EBS Joins the Exploited List

June 18, 2026

• SimpleHelp CVE-2026-48558 OIDC auth bypass lets attackers create rogue Technician accounts and reach managed endpoints; Horizon3 has published IOCs (Horizon3). · Vulnerabilities & Exploits

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel