Month: June 2026

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install…

Read more →

Nearly three in five banks do not enforce the strongest email authentication protections as impersonation threats continue to grow.

Read more →

A new Microsoft Teams admin policy, Manage external bots and their access to meetings, gives organizations greater visibility and control over external bots in meetings. The policy identifies bots and applies safeguards before they are admitted. Microsoft will begin retiring the existing Require verification by participants (CAPTCHA) meeting policy. Admitting a bot should be a…

Read more →

In this Help Net Security video, Greg Young, VP Cybersecurity and Corporate Development at TrendAI, explains how to build Enterprise Risk Management that a board will pay for. Drawing on nearly four decades in cybersecurity, including time as a CISO and 14 years as a Gartner analyst, he argues that boards fund ERM when they…

Read more →

Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that could be exploited by an attacker to facilitate arbitrary file reads or trigger a denial-of-service (DoS) condition. The vulnerabilities are listed below – CVE-2026-8451 (CVSS score: 8.8) – An insufficient input validation

Read more →

Every AI accelerator on the planet is hungry, and lately it’s memory it craves most: the capacity to hold enormous models right next to the chip.

Read more →

Meta is letting WhatsApp’s 3 billion users hide their phone number behind a username, the privacy trick Signal and Telegram shipped years ago. Reservations open this week. The…

Read more →

Key benefits include improved data integrity, streamlined processes and enhanced visibility across the organisation, supporting more informed decision-making and better service…

Read more →

In this post, I will talk about the global market trends and business developments shaping the future. Global markets are changing faster than ever, creating both opportunities and challenges for businesses, investors, and professionals. You may find it increasingly difficult to predict customer demand, keep pace with technological advancements, respond to economic uncertainty, or identify…

Read more →

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Read more →

The crews stealing corporate data today operate like registered businesses. They have the equivalent of CEOs and CFOs, they run recruiting drives, and some of them sit inside…

Read more →

Samsung, LG, and Sony TVs can pose data privacy risks – here’s how to avoid one of the biggest.

Read more →

The group compromised at least 10 regional organizations, including two state-owned entities, and deployed a new backdoor.

Read more →

Sultan to lead growth strategy, customer engagement, and market expansion across Asia Pacific and Japan

Read more →

Anthropic has confirmed that the Department of Commerce has lifted export controls on Claude’s two most powerful models, Fable 5 and Mythos 5. […]

Read more →

The model has been shut down for 2½ weeks due to security concerns, roiling the AI industry.

Read more →

Anthropic is now rolling out Sonnet 5, and it’s almost as good as the Opus range, but it is designed to be cheaper than the company’s flagship model. […]

Read more →

Police arrested the alleged admin of XSS.is, a major cybercrime forum whose trusted escrow service helped power the underground economy. On 22 July 2025, French and Ukrainian police arrested a 38-year-old man in Kyiv and shut down XSS.is, the most influential Russian-language cybercrime forum of the past decade. Europol, which coordinated the operation under the…

Read more →

Proton has unveiled Lumo 2.0, a major upgrade to its zero-access encrypted AI assistant. Built on a new architecture, the release brings the assistant closer to frontier AI models with new AI models, multimodal capabilities, Memory, improved web search, and enterprise features. The free plan includes Lumo’s core features. Lumo Plus subscribers get unlimited chats,…

Read more →

A new prompt injection attack dubbed “BioShocking” could trick AI-powered browsers into treating real-world risky actions as part of a fictional scenario, causing them to ignore any safety guardrails. […]

Read more →

Citrix published a security bulletin Tuesday disclosing six vulnerabilities in NetScaler ADC and NetScaler Gateway appliances, including a high-severity memory disclosure flaw that researchers say belongs to a vulnerability class first identified in the 2023 incident known as CitrixBleed. The company rated the overall bulletin severity as high and assigned CVSS scores ranging from 6.9…

Read more →

“Agentjacking” is the latest demonstration of how easily attackers can exploit an AI agent’s inability to differentiate between content and instructions.

Read more →

Microsoft announced today that it is accelerating its quantum-safe security roadmap, saying advances in quantum computing are bringing the need to replace today’s encryption standards sooner than previously expected. […]

Read more →

watchTowr researchers have discovered a vulnerability in Citrix NetScaler that can allow unauthenticated attackers to read portions of process memory from internet-facing appliances.   The flaw affects NetScaler ADC and Gateway appliances configured as SAML identity providers (IdPs).  In its security advisory, Citrix described the vulnerability as “insufficient input validation leading to memory overread” and assigned…

Read more →

Scammers wasted no time exploiting Venezuela’s devastating earthquake, with researchers uncovering 212 newly-registered relief-themed domains in just five days. Read more in my article on the Hot for Security blog.

Read more →

A campaign active since last November has been targeting Python developers building Telegram bots with trojanized Pyrogram forks that allow attackers to read arbitrary files on compromised servers. […]

Read more →

Attackers don’t need any special authentication to reach a target endpoint — they just need to know where it is.

Read more →

Read more →

Trump administration budget chief Russell Vought told lawmakers Tuesday that he’s willing to work with Department of Homeland Security Secretary Markwayne Mullin on re-staffing up the Cybersecurity and Infrastructure Security Agency, following deep personnel cuts and further proposed reductions in the fiscal 2027 budget blueprint. Mullin said last week at a House Appropriations Subcommittee on…

Read more →

Remote, flexible, high‑paying work is a tempting prospect, and the holy grail for many people looking for a new role. But it’s not just recruiters who are aware of this, job scammers do too and are happy to use it as an easy lure. That lure tends to be even more tempting when they claim…

Read more →

Leaders urge faster workforce adaptation as AI reshapes cyber and infrastructure.

Read more →

All three brands make great Bluetooth speakers, but an unpredictable beach environment exposes their true strengths and weaknesses.

Read more →

McAfee researchers have uncovered a cryptocurrency theft campaign that uses malicious browser extensions to steal digital assets.  The Silent Swap campaign disguises itself as a Google Notes browser extension that silently replaces cryptocurrency wallet addresses during transactions, redirecting funds to attackers.   Key Takeaways about Silent Swap Silent Swap disguises itself as a fake Google Notes…

Read more →

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a SimpleHelp flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SimpleHelp flaw, tracked as CVE-2026-48558 (CVSS score v3.1 of 10.0), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-48558 is a critical authentication bypass vulnerability in SimpleHelp versions 5.5.15 and earlier and…

Read more →

Amazon Web Services is making a broad push to deepen its position in the U.S. public sector, announcing a series of initiatives that collectively expand its government cloud strategy, strengthen opportunities for software partners, and accelerate enterprise AI adoption. The announcements span three key areas: expanding the federal OneGov procurement program to include independent software…

Read more →

Critical Oracle EBS flaw now exploited, prompting urgent patching guidance.

Read more →

This new version adds option –stats. For more details, take a look at SANS Internet Storm Center diary entry “Evil MSI Background: BASE64 Statistical Analysis“. base64dump_V0_0_30.zip (http)MD5: E54FFB4F618E47FAA724C9F16CF21E7ASHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D

Read more →

As AI reshapes cybersecurity workflows, John Paul Cunningham, CISO at SIlverfort, says the technology is creating opportunities rather than eliminating jobs — and there are more ways than ever to break into the essential field.

Read more →

Separate but similar campaigns described by Microsoft and Trend Micro use malicious zip files to spread malware via social engineering and obsfucation, including blockchain abuse.

Read more →

BOSTON, June 30, 2026, CyberNewswire – Reflectiz, the web exposure management platform, today announced a live webinar with Taboola, “Securing Third-Party Marketing in the AI Era,” taking place July 8 at 9 AM EDT / 3 PM CEST. Every marketing vendor a company approves can silently introduce third and fourth-party scripts that no security team…

Read more →

Not every new model is all it’s cracked up to be. Our tracker keeps each release in context with its peers, so you know which models are worth your time.

Read more →

MELBOURNE, Fla., June 30, 2026, CyberNewswire – OpenMatter Network today announced the launch of its cryptographically verifiable platform for secure collaboration and AI governance, built on a simple premise: Don’t Trust Data. Prove It. For decades, organizations have relied on trust-based assumptions to secure data, execute workloads, and govern digital systems. But as data becomes…

Read more →

New Microsoft research shows how attackers can hijack AI agents that act on a user’s behalf, using nothing more than a poisoned tool description to make the agent quietly hand over company data to an outsider. The trick is that the agent never breaks a rule. Every step looks routine, so in a default setup no alarm…

Read more →

A new two-stage malware family called RustDuck is hijacking home routers, IP cameras, Android boxes, and poorly secured servers, then stitching them into a network built to knock websites and online services offline. Researchers at QiAnXin’s XLab have tracked it since February 2026, and say the real story is not how big it is today, but how…

Read more →

EvilTokens phishing hides takeover clues until browser execution leaving SOC teams needing deeper visibility to validate threats faster and reduce account risk.

Read more →

The recently reported cyberattack against Tata Electronics is shaping up to be one of the most consequential attacks exposing important trade secrets belonging to Apple and, conceivably, other clients, including a slew of details about the upcoming iPhone 18 Pro. The attack follows May’s assault against key Apple manufacturing partner Foxconn. World Leaks iPhone 18 Pro Hackers from…

Read more →

Find out the key differences between Cat6, Cat6A, and Cat7 cables. Discover which option delivers the right balance of speed, cost, and future readiness for your business network. Every business depends on reliable connectivity. Whether it is a small office, a retail store, a school, or a growing enterprise, the network infrastructure behind daily operations…

Read more →

Learn how modern businesses can judge office software for ISO 27001 certification, GDPR-aligned data handling, encryption, and safer PDF workflows with clarity.

Read more →

Read more →

Plus, South Korea plots new chip plants, and AI brings bumper profits for memory producers

Read more →

Nissan says employees’ data was stolen via the Oracle PeopleSoft zero-day campaign

Read more →

Hackers stole data from 4.38 million Aflac Japan customers after accessing its systems for 10 days before the breach was detected. Aflac Japan disclosed that hackers stole the personal information of 4.38 million customers and agents after gaining access to its systems between June 15 and June 25. Attackers stole data from the company policyholder…

Read more →

The PCI Security Standards Council (PCI SSC) has launched its Training Venue Host Program, creating a new way for organizations with suitable training facilities to support payment security education while bringing industry training directly to their teams.

Read more →

Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner. The activity has been found to weaponize CVE-2026-33017 (CVSS score: 9.3), an unauthenticated remote code execution (RCE) vulnerability in Langflow, indicating threat actors are scanning and targeting exposed artificial intelligence (AI)

Read more →

A malicious extension in the Chrome Web Store is masquerading as the Perplexity AI answer engine, intercepting search traffic and collecting browsing information. […]

Read more →

How’s the view?! Back to business, it’s now 8 years ago that Scott and I thought it would be a cool idea to build Why no HTTPS? We used the site to shame companies for not implementing their transport later security property, and to make it a bit of fun, we shamed by country as…

Read more →

Cybersecurity researchers have flagged an active browser extension campaign that is designed to steal cryptocurrency by stealthily replacing wallet addresses when unsuspecting users initiate a transaction. The cryptocurrency clipper activity has been codenamed Silent Swap by McAfee Labs. “The campaign is delivered through unsigned installers – observed in both .NET and Golang variants – that

Read more →

Attackers exploited a critical SimpleHelp RMM bug to deploy TaskWeaver and Djinn Stealer malware

Read more →

Parham Eftekhari discusses AI, quantum and the future of critical infrastructure trust.

Read more →

The Department of Homeland Security is bringing back a key cybersecurity information sharing effort with critical infrastructure, more than a year after the Trump administration shuttered an existing nerve center between government and private sector. The Alliance of National Councils for Homeland Operational Resilience – Critical Infrastructure program, first reported by CyberScoop in January, is meant…

Read more →

A fake FIFA World Cup 2026 T-shirt giveaway scam is spreading Voidrift malware through personalized emails using company logos and trusted websites to bypass security filters.

Read more →

This is the way: The old will protect the young until the young protects the old.

Read more →

DC, United States, 30th June 2026, CyberNewswire

Read more →

Three-day patching deadlines, exposed fuel-tank systems, scams costing billions of dollars, and social media bans for children all gave Tony plenty to unpack in June 2026

Read more →

Apple has released security updates for more than two dozen security vulnerabilities across iPhone, iPad, and Mac. The updates for iOS/iPadOS, MacOS Tahoe, and Safari were issued after testing on iOS 26.6 and iPadOS 26.6 betas. What stands out in the update is that a lot of the vulnerabilities were found in WebKit, the browser…

Read more →

Boston, Massachusetts, 30th June 2026, CyberNewswire

Read more →

After using multiple security cameras from Ring, Blink, and more, I’ve found the best arrangement for my home.

Read more →

The safety check that is supposed to stop an AI coding agent from running a dangerous command can be walked straight past using a shell trick that has been public for decades. New research from Adversa AI, which is named the bypass GuardFall, found it works against ten of the eleven popular open-source coding and computer-use…

Read more →

Netflix has award-winning originals and a smart algorithm, but Peacock counters with live sports and a lower price.

Read more →

The Department of State is offering up to $10 million for information on two Russian-linked hacking groups targeting Signal and WhatsApp users.  This reward is being offered through the department’s Rewards for Justice (RFJ) program, which seeks information on foreign state-backed cyber actors targeting U.S. critical infrastructure and national security interests.  The latest bounty focuses…

Read more →

Aikido Security has acquired Root, uniting behind a shared mission to make it easy for developers and agents to build with secure open source and tackle the growing threat of supply chain attacks. Open source is the foundation of almost every application in the world, and it has become the primary entry point for attackers.…

Read more →

Business Email Compromise is more than an email scam. It’s a coordinated operation involving compromised accounts, financial research, and cash-out networks. Flare explores how underground forums reveal how BEC attacks are planned and executed. […]

Read more →

Exploitation attempts targeting a critical vulnerability (CVE-2026-46817) in Oracle Payments, the payment-processing module within Oracle’s E-Business Suite (EBS), have been spotted over the weekend, threat intelligence company Defused warned on Monday. The detected exploitation attempts (Source: Defused) “On 27 June 2026 our Oracle E-Business Suite decoys recorded the first in-the-wild exploitation of CVE-2026-46817 — roughly…

Read more →

Cequence Security has announced general availability of Cequence Platform 9.0, an AI-native release that changes how users interact with API security tools. Platform 9.0 ships with a built-in AI Assistant, an open Model Context Protocol (MCP) server that exposes every platform capability to an organisation’s agents or automation workflows, a compliance-ready risk rules library mapped…

Read more →

Researchers tested 444 AI chatbot apps for iPhone and found that 282 of them, nearly two-thirds, exposed paid AI access through their network traffic. In many cases, the path in was visible just by watching what the app sent: a plaintext API key, a reusable token, or a backend server that accepted requests with no…

Read more →

Jamf has announced general availability of AI Governance, a new capability within Jamf for Mac that enables IT and security teams to discover actively-used AI tools, enforce policy controls, and generate audit-ready reporting. Many organizations struggle to confidently audit and report on AI tool usage across their device fleet, including both sanctioned applications and unsanctioned…

Read more →

Software updates are rolling out now for iPhone, iPad, and Mac, bringing fixes that weren’t supposed to arrive so soon. Here’s why.

Read more →

Digi International has announced the launch of DANI, the Digi Artificial Network Intelligence agent, a purpose-built AI network operations agent natively embedded in a networking device management platform, Digi Remote Manager (DRM). Embedded directly within DRM as a value-added service, DANI enables network operators and managed service providers to monitor and diagnose network issues, identify…

Read more →

Aflac has disclosed a data breach at its Japan subsidiary that exposed sensitive customer information, including policy details and bank account data. According to a filing with the U.S. Securities and Exchange Commission (SEC), Aflac Life Insurance Japan Ltd. discovered the unauthorized access on Jun. 25, 2026.  The company determined that attackers accessed certain systems…

Read more →

The TaskWeaver loader delivers Djinn Stealer, which targets dev credentials and AI tokens.

Read more →

OpenMatter Network has announced the launch of its cryptographically verifiable platform for secure collaboration and AI governance, built on a simple premise: Don’t Trust Data. Prove It. For decades, organizations have relied on trust-based assumptions to secure data, execute workloads and govern digital systems. But as data becomes increasingly distributed and AI agents begin operating…

Read more →

New York, United States, 30th June 2026, CyberNewswire

Read more →

Melbourne, Florida, 30th June 2026, CyberNewswire

Read more →

CISA’s BOD 26-04 changes how federal agencies patch and how security leaders must measure, justify, and communicate cyber risk to executives and boards. Key takeaways BOD 26-04 requires agencies to make and defend risk-based vulnerability prioritization decisions, including decisions to defer vulnerability remediation. This accountability requirement transforms vulnerability management from a technical operation into a…

Read more →

Machine and agent identity security organization, AppViewX, has announced the launch of its first global partner program. The program is designed to provide the infrastructure, resources, and an engagement framework necessary to engage prospects and customers more effectively, deliver greater value, and maximize co-sell opportunities and profitability. AppViewX formalizes its channel strategy The AppViewX Partner…

Read more →

Cybersecurity company Huntress has announced the general availability of its Managed Identity Security Posture Management (ISPM) service, expanding its Agentic Security Platform with tools that continuously identify and remediate identity security weaknesses across Microsoft 365 environments. The launch follows an Early Access program involving more than 12,000 Microsoft 365 tenants, where Huntress says it uncovered…

Read more →

Cybersecurity leader Bitdefender has recently released an annual report in which cybersecurity professionals detailed their most urgent concerns, key challenges, and threat perceptions shaping security. Agentic AI, LLMs, and infrastructure breaches top the list of security concerns The 2026 Cybersecurity Assessment Report is an independent survey of over 1,200 IT and security professionals. Those surveyed…

Read more →

Teams are dealing with a truly dangerous problem — automation that works, but that no one understands.

Read more →

Patients are also three times more likely to trust AI in their doctor’s secure portal than a public chatbot.

Read more →

Learn how Red Canary engineered a super agent—blending ML, a rules engine, similarity, agentic AI, and LLMs—to classify phishing emails. With 94% accuracy, it makes the case for what a hybrid AI SOC can achieve.    

Read more →

In this post, I will show you how artificial intelligence is changing project management. Projects rarely go exactly as planned. A task takes longer than expected, priorities change midway through, or a small issue suddenly affects the whole schedule. Most project managers have dealt with situations like these. That is why many professionals look into…

Read more →

This blog post is #4 in our series on Verifiable Digital Credentials (VDCs). Our other posts can be found via Post #1, Post #2, and Post #3. In earlier posts, we discussed how verifiable digital credentials (VDCs) are issued and compared the underlying credential formats (ISO/IEC “mdoc” vs. W3C Verifiable Credentials). In this post, we…

Read more →

ReliaQuest report warns of a surge in ClickFix social engineering attacks against Windows and macOS users

Read more →

The growing use of AI agents is set to increase corporate AI token spend, and some companies are using techniques from the cloud era to control costs.

Read more →

Google has removed a malicious browser extension masquerading as Perplexity AI after Microsoft researchers found it was intercepting users’ search traffic and routing queries through attacker-controlled servers before forwarding them to legitimate search engines. Microsoft Threat Intelligence said the extension masqueraded as the AI-powered answer engine to trick users into installing it. Based on its…

Read more →

Apple released updates for iOS, iPadOS, macOS, and Safari, fixing WebKit flaws, four of which were found using AI tools like Claude and Codex Apple pushed out security updates for iOS, iPadOS, macOS, and Safari on Monday, and this round comes with a twist worth noticing. Four of the WebKit vulnerabilities patched were found using…

Read more →

The FIFA World Cup 2026 opened on June 11. By that date, according to Check Point Research, the fraud infrastructure targeting it had already been built, staged, and partially deployed. Threat actor activity was pre-planned, months out, across three sectors and at least ten languages. Check Point Exposure Management published the FIFA World Cup 2026…

Read more →

An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer. The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass vulnerability impacting the OpenID Connect (OIDC) flow that an unauthenticated

Read more →

American insurance giant Aflac has disclosed a new data breach after attackers breached its Japan subsidiary’s systems and stole personal and bank account information. […]

Read more →

WhatsApp is letting users reserve usernames before its 2026 launch, giving people a way to chat without sharing phone numbers. Here is how it works, why it matters, and the security limits to know

Read more →