June 2026

Bitdefender uncovers 12,000+ scam ads across APAC health finance

EU to use Anthropic's Mythos AI for cybersecurity research

Chinese malware cluster harvests user data through fake app sites

Most organizations that miss 24-hour patch window report breaches

Zoom CISO Sandra McLeod talks AI, mentorship, cyber careers

Kali365 Device Code Phishing Hits AWS, Okta, Russian Apps

Attackers leverage AI to bypass leading EDR defences

CISA flags Mirasvit cache flaw CVE-2026-45247 as exploited.

Dashlane confirms brute force attack hit 20 encrypted vaults

IronWorm Rust malware steals secrets via compromised npm packages

Chinese hacking group TA4922 widens attacks across Asia, Europe

4 Critical Threats Where Attackers Have the Advantage

Sound Blaster Speaker Bluetooth Flaw Lets Hackers Control PCs

CISA warns of exploited SolarWinds Serv-U flaw, urges patching

US Gas Stations Warned as Hackers Target Exposed Fuel Tank Gauges

CISA flags SolarWinds ServU DoS bug CVE-2026-28318 for patch

Anthropic engineers help NSA use Mythos for offensive cyber ops

ChatGPT rolls out Lockdown Mode to curb data exfiltration risk

CVE-2026-49261 flaw in MariaDB lets attackers run remote code

Silent Ransom Group spurns $1.8M demand, leaks law firm data

DentaQuest breach exposes 2.6M patient data after ShinyHunters

Phishing attacks strike Microsoft Teams, posing as IT support

Silent Ransom Group Targets Law Firms Using Vishing to Steal Data

Japan Hospital Data Leak Exposes 180,000 Records From Sold Drives

Microsoft patches CVE-2026-41091 amid record 208 CVE update

Microsoft ships record patch batch amid AI driven vuln surge

Attackers Exploit Cloud Logging Weaknesses to Hide Their Tracks

US charges Russian hacker Denis Obrezko in Void Blizzard case

Chelan County faces third week outage after Memorial Day malware

Critical UpdraftPlus CVE-2026-10795 Exploit Targets Millions

ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities

CISA Adds Ivanti Sentry Command Injection Flaw to KEV Catalogue

AI‑driven phishing rises despite overall drop, Zscaler warns

New macOS Tahoe 26 artefact logs menu choices for forensic probes

Handala hackers breach Cal Water, leak 2M customers' data

CISA Adds Oracle PeopleSoft Flaw CVE-2026-35273 to KEV Catalog

GitHub will stop NPM script auto run to curb supply chain attacks

Washington Pulled the Plug on Anthropic ‘s Fable 5 and Mythos 5 models. The Rest of the World Is Watching.

Critical Splunk flaw lets attackers run code without auth

BWH Hotels data breach exposes guest names, emails and addresses

Novo Nordisk reports breach of deidentified patient trial data

Security Affairs Newsletter Highlights New Malware Variants

Attackers now exfiltrate data within 72 minutes, Unit 42 warns

EtherRAT malware exploits Ethereum blockchain for resilient C2

Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails

Phantom Stealer hits banks via phishing, steals data in memory

US export ban on Anthropic AI models sparks security backlash

Dev Machine Guard Thwarts npm and Python Supply Chain Attacks

Windows crypto clipper malware hijacks clipboard via Tor

Roblox Developers Lose Games to Malware via Fake Job Offers

Russian hackers breach Fortinet SSL VPN using GPU cluster

New USB Spread Crypto Clipper malware hijacks wallets via Tor

CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches

Novo Nordisk breach exposes 1.3TB after GitHub token leak

15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers

Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain

The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes

Hackers Bypass MFA by Targeting ArcGIS Recovery Weaknesses

The Gentlemen ransomware gang deploys eight variant EDR killer

Injunctions Fail to Stop Global Schools Group Data Leak

Security Affairs flags 1.2M site supply chain breach

Brazil Civil Defence Alert System Compromised, Sends False Alerts

FortiBleed Spray Hits Thousands Amid WordPress Malware Surge

Attackers exploit bucket hijacking to reroute cloud data

Leaked files show APT35 runs like a government department

Kaspersky flags WhatsApp malware that sends fake debt notices

LastPass reports data breach after Klue hack exposes CRM data

CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV Catalog

CVE-2026-20971 flaw in Samsung KNOX risks Galaxy takeover

Cisco Catalyst SD WAN bug exploited pre patch, gave root access

Microsoft led takedown stops Amadey and StealC malware networks

Experts Warn 2026 FIFA World Cup Faces Ticket Fraud Surge

Hospitality hit by ZIP LNK PowerShell phishing campaign

CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog

Critical PTC Windchill flaw CVE-2026-12569 under active attack

Jaguar Land Rover ransomware attack costs UK economy £1.9 billion

FBI warns Russian hackers target Signal backup recovery keys

AI Pen Testing Trust Drops to 9% Over False Positives and Costs

Ukraine says Russian fake texts used to hijack messenger accounts

FBI warns of Russian phishing stealing Signal recovery keys

Hospitality Hit by TonRAT Phishing via Fake Guest Complaints

KDDI breach exposes 14.22M emails, passwords via third party flaw

KDDI reveals 14.2 million email breach linked to third party flaw

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 103

WhatsApp rolls out usernames for 3bn users to boost privacy

SimpleHelp Auth Bypass Flaw (CVE‑2026‑48558) Grants Tech Access

Silent Ransom Group hits Fox Rothschild, leaks law firm data

Police Arrest Suspect in Takedown of XSS.is Cybercrime Forum

Agentjacking flaw lets hackers hijack AI coding tools via Sentry

Bill threatens journalists with jail over state threat contacts