June 25, 2026
Cisco Catalyst SD-WAN Manager zero-day CVE-2026-20245 allows attackers to escalate from admin accounts to root by uploading malicious CSV files, as disclosed by Mandiant. Microsoft and Europol disrupted the shared infrastructure behind Amadey and StealC infostealers in Operation Endgame, recovering ~27M credentials and seizing over $47M. Anthropic alleges Alibaba illicitly extracted capabilities from Claude, highlighting emerging model-distillation IP-theft disputes. A stealthy Mistic RAT serves as entry point for initial-access broker Woodgnat (aka KongTuke), feeding multiple ransomware families including Qilin, Interlock, and Black Basta.
June 23, 2026
The Five Eyes intelligence alliance warns that frontier AI models could reshape offensive cyber operations within months, lowering barriers to high-impact attacks. Meanwhile, dirkjanm disclosed a critical Entra ID Conditional Access bypass via resource exclusion, and researchers demonstrated multiple AI security flaws including DifyTap vulnerabilities in the Dify platform and AutoGen Studio RCE. The Klue data breach fallout expanded to include major security vendors like HackerOne, Huntress, Recorded Future, and Snyk, while a decade-old infostealer credential was used to hijack Brazil's Emergency Alert System at national scale.
June 22, 2026
A usbliter8 BootROM exploit for Apple A12/A13 devices and the LACUNA Chain EDR evasion technique represent major offensive advances, while Klue's OAuth token-theft incident exposed Salesforce customers to the Icarus actor. Supply-chain threats include a malicious node-fetch-utils npm package deploying fileless Python implants and active exploitation of CVE-2026-4020 in Gravity SMTP WordPress plugin.