Google, the FBI, and industry partners have disrupted NetNut, a residential proxy network built on at least 2 million hijacked home devices. In one June week, 316 threat clusters rode its exit nodes. Why the takedown matters, and why defenders should expect churn rather than extinction.
Apple's Hide My Email is supposed to keep your real address secret. A researcher found any alias can be traced back to your Apple account, reported it over a year ago, and it still is not fixed. As of this week, it still works.
Britain's costliest cyberattack was claimed by a Telegram crew. Investigators now point to Russian operators: novel ransomware, no ransom demand, encrypted backups. The defensive lessons that hold regardless of who was really at the keyboard.
Backdoor.Mistic (Zscaler: MLTBackdoor), used since April 2026 by the access broker Woodgnat/KongTuke, is a fileless RAT that establishes durable remote access and sells it to ransomware crews including Qilin, Akira, and Black Basta. It spreads via fake IT-helpdesk lures on Microsoft Teams.
Miasma/Shai-Hulud trojanized 20+ Leo Platform and RStreams npm packages in a sub-three-second burst on June 24, hiding its install hook in binding.gyp. It reads CI runner memory for masked secrets and exfiltrates via the victim's own GitHub token, beating egress blocklists.
A high-severity flaw in Amazon Q Developer (CVE-2026-12957, CVSS 8.5) let a single config file in a cloned repo run commands and steal live AWS credentials. Amazon patched it in Language Servers for AWS 1.65.0. Update to 1.69.0.
Lantronix EDS5000 serial-to-IP converters are under active attack via CVE-2025-67038, a CVSS 9.8 unauthenticated command-injection flaw that yields root code execution. Forescout saw it exploited before public details existed, and CISA has added it to KEV with a 26 June federal deadline.
SentinelOne has detailed Gaslight, a Rust-based macOS implant tied to North Korea-aligned actors that embeds 38 fake system messages to trick AI-assisted triage tools into aborting analysis. It runs a Telegram-based C2 shell and drops a Python stealer that lifts browser data and the Keychain.
FulcrumSec is a financially motivated data-extortion group that breaches large organizations, loots plaintext cloud secrets and over-privileged IAM roles, exfiltrates at scale, then publishes detailed breakdowns to extort. Confirmed victims include LexisNexis and Arup Group.
Elastic Security Labs has uncovered OXLOADER, a previously undocumented Windows loader delivering the CASTLESTEALER infostealer through malicious Google Ads impersonating Node.js. It abuses the PE .reloc section to stage shellcode and evades static engines and sandboxes.
Ireland's DPC has fined the HSE €300,000 over a 2018 ransomware attack on a hospital lab system that encrypted diagnostic data belonging to 84,000 patients - the fine took eight years to land.
Splunk has patched CVE-2026-20253, a CVSS 9.8 flaw in Splunk Enterprise where an unauthenticated PostgreSQL sidecar endpoint allows arbitrary file writes. watchTowr Labs chained it to pre-auth remote code execution. Splunk Cloud is unaffected - patch to 10.0.7 or 10.2.4 now.
Threats
Group-IB, INTERPOL and Algerian police dismantled SniperDz, a decade-old free phishing-as-a-service platform: 80 templates, 30+ brands, 20,000+ domains, 45,000+ stolen records. Its developer Guedz was arrested after exposing his own admin panel in recruitment videos.
Alerts
A public PoC named GreatXML bypasses BitLocker on Windows systems that have ever run a Defender Offline Scan. With brief physical access, an attacker copies two files to the recovery partition, reboots into WinRE, and gets a SYSTEM shell on the encrypted volume. No patch, no CVE.
Breaches
ShinyHunters has listed Ralph Lauren on its leak site, claiming 220GB of customer PII, transaction records and unreleased 2027 product designs. The posting sets a June 14 leak deadline and is framed as a final warning. Ralph Lauren has not confirmed a breach.
Threats
Attackers are exploiting CVE-2026-10520, a max-severity OS command injection flaw in Ivanti Sentry, to run code as root on internet-exposed gateways. Shadowserver reports most exposed instances already backdoored. Patched Tuesday in R10.5.2, R10.6.2, R10.7.1 — patch now.
Threats
Attackers are actively exploiting CVE-2026-5027 in Langflow, writing arbitrary files to exposed servers. Default unauthenticated auto-login means a single request reaches the vulnerable endpoint with no credentials. Roughly 7,000 instances were exposed; patch in 1.10.0.
Breaches
ServiceNow has quietly warned customers that attackers exploited an unauthenticated API endpoint to query data from customer instances. A June 5 update locked the endpoint to authenticated users only. Admins point to /api/now/related_list_edit set to requires_authentication=false.
Alerts
Nightmare Eclipse has released "RoguePlanet," a Microsoft Defender race-condition zero-day that spawns a SYSTEM shell on fully patched Windows 10 and 11 — including systems with this week's June updates. ThreatLocker independently reproduced it against patched Windows 11. No fix exists yet.
Alerts
SAP's June 2026 Security Patch Day addresses 15 vulnerabilities, four of them critical — led by a CVSS 9.9 XML Signature Wrapping flaw enabling SAML authentication bypass in NetWeaver and an unauthenticated CVSS 9.8 memory corruption bug exploitable via crafted RFC requests.
Alerts
"Ghost-Sender" lets attackers send email as any address — internal or external — to orgs running Exchange Online or hybrid Exchange behind a third-party MX record. SPF, DKIM, and DMARC are all bypassed, fewer than half of exposed orgs have mitigations, and Microsoft says no patch is coming.
Alerts
Veeam has patched CVE-2026-44963, a CVSS 9.4 flaw in Backup & Replication that lets any authenticated domain user execute remote code on the backup server. All version 12 builds are affected — version 13 is immune due to architectural changes. Ransomware groups routinely target Veeam first.
Alerts
Microsoft's June 2026 Patch Tuesday addresses 200 vulnerabilities, including three publicly disclosed zero-days covering a CTFMON privilege escalation, the "HTTP/2 Bomb" denial-of-service technique, and the YellowKey BitLocker bypass released by Nightmare Eclipse.
Threats
Google Mandiant attributes a sustained data theft and extortion campaign to UNC3753, combining voice phishing, IT impersonation, and in-person office break-ins to compromise US law and financial firms — progressing from initial contact to ransom demand in under an hour.