News

Microsoft has launched its agentic AI system, Copilot Cowork, aimed at facilitating complex task execution for enterprises. After a three-month preview, many Fortune 500 companies have adopted it. Copilot Cowork not only automates collaboration across tools…

FulcrumSec, a data-theft extortion group, leaked 1.3TB of data from Novo Nordisk, including clinical records and AI research assets, after the company rejected a $25 million ransom demand. The breach confirmed unauthorized access to internal systems,…

The SANS Institute's 2026 SOC Survey reveals that staffing remains the biggest challenge for Security Operations Centers (SOCs), as 14% of practitioners identify it as a primary issue, though 59% of cybersecurity leaders believe management is proactive about…

The JDY botnet, a reconnaissance network linked to Chinese state-sponsored hackers, has re-emerged, expanding from 650 to over 1,500 compromised devices since early 2024. Primarily targeting military-related networks, the botnet conducts rapid scans for new…

Recent updates for Chrome and Firefox address over 70 vulnerabilities, including high-severity memory safety bugs. Chrome versions 149.0.7827.155/.156 fix 33 security flaws, including six critical use-after-free issues that could lead to remote code…

ESET researchers have identified two new Windows variants of the SprySOCKS backdoor, previously known only in its Linux form, attributed to the China-linked actor FishMonger. These variants, named WIN_DRV and WIN_PLUS, utilize innovative tactics to increase…

A major supply chain attack, known as the Mastra attack, has impacted the JavaScript ecosystem, compromising over 140 npm packages. The attack involves a clean Mastra package that uses a malicious typosquatted package named 'easy-day-js' as a dependency.…

The UK government announced a new ban on social media access for minors under 16, targeting platforms like Facebook, Instagram, and TikTok, set to take effect in early 2027. This decision, supported by a significant majority of parents and public polling,…

The UK government announced a nationwide ban on social media for users under 16, set to take effect in spring 2027. This policy mandates age verification for all accounts, including adult registrations. A public consultation revealed strong support, with 90%…

The article discusses the compromise of 144 npm packages within the Mastra ecosystem following a hijacked contributor account. Key points include: 1. The breach highlights vulnerabilities in package management systems, especially within open-source software…

The content discusses a new remote access trojan (RAT) called SilabRAT, which is marketed on dark web forums as a subscription service for $5,000 per month. The malware, also known as SnappyClient, is designed primarily for cryptocurrency theft and operates…

Three newly patched vulnerabilities in Fortinet's FortiSandbox, rated critical, are actively being exploited. Defused's honeypots detected attempts targeting CVE-2026-39808, CVE-2026-39813, and CVE-2026-25089. CVE-2026-39808 allows authentication bypass,…

CISA has issued a warning about an actively exploited vulnerability in the Joomla JCE (Joomla Content Editor) component that allows for PHP code execution. This flaw poses significant risks as it is being actively targeted in supply chain attacks,…

This article discusses the launch of Google Wear OS 7, highlighting its key features and enhancements aimed at improving user experience and device performance. Notable updates include: 1. **Live Updates**: Introduction of real-time information delivery for…

The content discusses the current state of the AI market, focusing on ChatGPT's declining market share as it slips below 50% for the first time, while rivals like Google's Gemini and Anthropic's Claude are experiencing significant growth. ChatGPT currently…

Cloudflare has officially launched its DMARC Management feature, which is designed to enhance email authentication and prevent domain spoofing and phishing attacks. This feature provides users with a user-friendly interface to enforce DMARC policies, aiding…

The content reports on the launch of Google's Android 17 operating system and the June Pixel Drop update. Key features include enhanced user privacy controls, advanced multitasking options with a new 'Bubbles' feature, and AI integration via the Gemini model…

Google has released a major security update for Chrome, addressing 33 vulnerabilities, including seven rated as critical. These critical flaws primarily involve use-after-free errors that may allow remote code execution. Key vulnerabilities include…

A critical vulnerability has been identified in Fortra BoKS, tracked as CVE-2026-9862, exposing privileged access servers in Linux and UNIX systems. The flaw, an OS command injection within the autoregistration handler, allows remote attackers to execute…

Microsoft is facing significant server capacity issues due to the surge in AI coding activities, leading to frequent outages on GitHub. To manage this crisis, they have started renting cloud computing resources from Amazon, a primary competitor, while also…

On June 17, 2026, an attacker compromised the @mastra npm organization and published malicious versions of 13 packages in the Mastra AI framework. All infected packages included a new typosquat package named easy-day-js, which mimicked the popular dayjs…

Security researchers have identified critical vulnerabilities in the Yarbo robot's mobile apps. The first vulnerability (CVE-2026-10557) involves hard-coded MQTT credentials common across all devices, allowing attackers to exploit and control the entire…

The content summarizes a daily ISC Stormcast for June 17, 2026, presented by handler Xavier Mertens, with the threat level rated as green. It includes links to resources on SANS courses by Dr. Johannes Ullrich, discussions, and various security-related data…

SpaceX is set to acquire Cursor, an advanced AI programming tool, for $60 billion. This acquisition aims to enhance SpaceX’s competitive position against rivals like OpenAI and Anthropic in the AI-assisted coding domain. The deal involves a stock merger with…

A critical vulnerability, tracked as CVE-2026-41005, has been identified in Cloud Foundry's User Account and Authentication (UAA) component. This flaw, scoring 9.0 on the CVSS scale, allows attackers to bypass SAML authentication by exploiting a logic error…

NVIDIA has issued an urgent update for its NeMo Framework, addressing three high-severity vulnerabilities rated CVSS 7.8. The vulnerabilities include a code injection flaw (CVE-2026-24155) affecting all platforms and two Linux-specific issues…

A new vulnerability in MongoDB servers has been identified, with four critical flaws posing risks to widely used document databases. The most serious vulnerabilities, CVE-2026-11933 and CVE-2026-9740, score 8.7 on the CVSS scale and can lead to memory leak…

The article discusses a new threat called Phantom Stealer, a fileless malware targeting banks and high-value organizations through phishing campaigns. It employs sophisticated evasion techniques and operates entirely in memory, making detection difficult.…

The security community has criticized the U.S. government's decision to ban the export of Anthropic's AI models, Mythos and Fable, to foreign nationals. This decision followed a national security concern regarding the models' capabilities to discover software…

The article discusses the growing threat of npm and Python supply chain attacks on developer machines, highlighting recent incidents such as the Miasma and Hades worms. It introduces Package Configs, a feature of Dev Machine Guard designed to audit developer…

The report outlines an ongoing Russian cyber operation, primarily by GRU-linked APT28/Fancy Bear, focusing on intelligence gathering through compromised routers and messaging platforms. Key findings include the manipulation of SOHO routers for DNS hijacking,…

iRhythm Technologies, a U.S. digital healthcare company, reported a cyberattack that resulted in stolen patient and proprietary data, accompanied by a ransom demand. The attack was disclosed in a SEC Form 8-K on June 10, 2026, identifying unauthorized…

The article discusses a significant vulnerability found in Google Vertex AI SDK that allows attackers to hijack model uploads through a technique called bucket squatting. This security flaw could lead to unauthorized access and manipulation of machine…

FishMonger, a threat group linked to China, has utilized a new Windows variant of the SprySOCKS backdoor to infiltrate government targets in countries such as Honduras, Taiwan, Thailand, and Pakistan. This version employs kernel drivers, enhancing its…

The article discusses the ClickFix campaigns that have expanded the delivery of malware using new loaders and fake update lures. These tactics exploit users by disguising malicious software as legitimate updates, increasing the vectors through which…