CISA Adds Zimbra Flaw To KEV; NASA GUI Exposed
The U.S. Cybersecurity and Infrastructure Security Agency added the critical Zimbra Collaboration Suite vulnerability CVE‑2026‑73570 to its Known Exploited Vulnerabilities catalogue, noting unauthenticated remote code execution and active exploitation in the past 24 hours [C7] A separate high‑severity flaw in the NASA/JPL AIT‑GUI, scored CVSS 9.4, permits unauthenticated arbitrary command execution on spacecraft instruments and is likewise being exploited [C6]
ToxicPanda 2.0 Spikes; New Banking Trojans Emerge
ToxicPanda 2.0, evolving from a simple dropper to a VPN‑permission‑abusing malware, now targets 349 banking applications across 16 countries, bypassing Google Play Protect to deliver secondary payloads [C1] Concurrently, fresh Android and Windows banking trojans such as Manic are being deployed against banks worldwide, combining spyware and financial theft capabilities [C5] Medicaid Data Leaked; Developers Face Supply-Chain Risks — Gainwell Technologies reported on 25 June 2026 that an unauthorized party accessed a provider system, exposing payment and claims information for approximately 41,000 HUSKY Health members in Connecticut [C2] Separately, Unit 42 warns that developers are confronting a surge in supply‑chain threats aimed at code‑tools and build environments, urging enhanced verification and provenance controls [C9].