June 26, 2026
Gaslight, a Rust-based macOS stealer, is the first malware documented to embed prompt-injection payloads designed to sabotage AI-assisted malware analysis. ESET published a detailed breakdown of Gamaredon's 2025 arsenal, revealing six new PowerShell downloaders and extensive infrastructure laundering targeting Ukrainian government and military entities. Multiple critical vulnerabilities are being actively exploited, including CVE-2025-52465 in GeoServer for credential theft and CVE-2026-8461 in FFmpeg for remote code execution. curl patched a 24-year-old credential-leak vulnerability (CVE-2026-9079) alongside four additional flaws affecting SSH, STARTTLS, and proxy authentication.
June 25, 2026
Cisco Catalyst SD-WAN Manager zero-day CVE-2026-20245 allows attackers to escalate from admin accounts to root by uploading malicious CSV files, as disclosed by Mandiant. Microsoft and Europol disrupted the shared infrastructure behind Amadey and StealC infostealers in Operation Endgame, recovering ~27M credentials and seizing over $47M. Anthropic alleges Alibaba illicitly extracted capabilities from Claude, highlighting emerging model-distillation IP-theft disputes. A stealthy Mistic RAT serves as entry point for initial-access broker Woodgnat (aka KongTuke), feeding multiple ransomware families including Qilin, Interlock, and Black Basta.
June 24, 2026
Critical vulnerabilities hit domain controllers as CVE-2026-41089 (Netlogon RCE) and Onelogon (Zerologon bypass) emerge, while FortiBleed credential-harvesting campaign reaches Finnish organizations after compromising 110M+ credentials from 430K+ Fortinet devices. Major supply-chain threats include Klue OAuth attacks affecting LastPass, malicious npm packages impersonating PostCSS, and Cordyceps malicious pull requests targeting Azure/Google/Apache projects; Anthropic's Mythos model discovered Squidbleed (Heartbleed-style flaw in Squid) and vulnerabilities in classified US systems.
June 18, 2026
A critical vulnerability blitz dominates this digest: Oracle PeopleSoft CVE-2026-35273, Splunk CVE-2026-20253, and an unpatched Microsoft Defender RoguePlanet zero-day are actively exploited, with ShinyHunters and other threat actors targeting higher education and enterprise networks. The AI/security layer has emerged as a major attack surface, exemplified by Microsoft 365 Copilot SearchLeak (one-click data exfiltration), Google Vertex AI cross-tenant RCE, and the Novo Nordisk breach that exposed proprietary AI model checkpoints and training infrastructure as ransomware extortion payload—underscoring that AI IP is now a strategic target.