Cybersecurity Brief – 2026-06-26

Fri, 26 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Personal data belonging to politicians, military leaders, and executives was left publicly accessible due to a security misconfiguration at an elite networking organization, leading to a data breach affecting high-profile individuals ^[40].
Authorities in Poland arrested four members of a cybercrime group accused of breaching telecommunications partners and hijacking email accounts to conduct SIM-swapping attacks, resulting in millions in cryptocurrency theft ^[13].

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2026-12569) in PTC Windchill enabling remote code execution has been exploited in the wild and added to CISA’s Known Exploited Vulnerabilities catalog ^[28].
A server-side request forgery (SSRF) flaw in Cisco Unified Communications Manager (CUCM) and Unified CM SME, which can escalate privileges to root, was weaponized by attackers less than 24 hours after disclosure ^[21].
A vulnerability in Lantronix Serial-to-IP converters (CVE-2025-67038), disclosed in April, has been exploited following OT threat warnings ^[33].
Chrome patched 18 vulnerabilities, including four critical flaws, two of which are WebGL bugs that could allow sandbox escape ^[38].
GitLab CE/EE released updates addressing 13 vulnerabilities, including three rated high severity that could lead to code execution or information disclosure ^[34].
The open-source curl tool patched 18 vulnerabilities, including a 25-year-old flaw, though all were rated medium or low severity ^[35].
A popular Chrome ad blocker extension for YouTube, with over 10 million installs, was found to have dormant script injection capability that could allow arbitrary JavaScript execution ^[7].

Notable Threat Actor Activity

The Russian state-sponsored threat actor Turla has deployed a previously undocumented .NET backdoor named STOCKSTAY in espionage attacks targeting government and military organizations in Ukraine ^[6].
The Gamaredon APT group has upgraded its toolset, increasing its use of legitimate online services for command and control and data exfiltration, and is forming new alliances to enhance operational security ^[5]^[22].
A new backdoor named Mistic, linked to the KongTuke group, has been used in financially motivated attacks targeting sectors including insurance, education, IT, and professional services ^[11].
Iranian hacker group Handala claimed responsibility for a cyberattack on California Water Service, but investigation found no evidence of OT system compromise ^[32].

Trends, Tools, or Tactics of Interest

Sophisticated phishing kits are increasingly targeting device code authentication flows to breach accounts without requiring passwords ^[2].
The Bluekit phishing-as-a-service platform has adopted browser-in-the-middle techniques for login theft and expanded its infrastructure with nearly 70 new hostnames in the past week ^[18].
Threat actors are abusing the Shop order-tracking app by inserting fake purchase receipts into users’ histories to launch callback phishing attacks ^[14].
New macOS malware named Gaslight uses prompt injection payloads and embeds fake errors specifically designed to confuse AI-assisted malware analysis tools ^[10]^[16].
There is a rise in attacks against SMBs involving fake AI tools, phishing, and the sale of stolen data on the dark web ^[1].
Ransomware operators are increasingly targeting EU organizations and their suppliers, making Europe the primary region of interest after a global lull ^[25].
EdTech attackers are shifting focus from direct attacks on schools to targeting their software suppliers, increasing supply chain risk ^[23].
Parcel mule scams are spreading via fake job offers, tricking victims into handling stolen goods ^[37].
Fake domain renewal emails and websites are being used to deceive website owners into paying scammers ^[39].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has extended its free Windows 10 Extended Security Updates (ESU) program for consumers by one year, allowing continued receipt of security updates until October 2027 ^[15].
The new enterprise-ready Model Context Protocol (MCP) specification shifts security responsibilities from the protocol itself to developers and platform operators, introducing new security challenges ^[29].
A WIRED investigation highlighted reliability issues with a UK police predictive analytics system built as part of the adoption of AI in law enforcement ^[26].

Sources

Elite network says it was hacked after members’ personal data was left exposed - malwarebytes.com
Poland busts SIM-swapping gang tied to millions in crypto theft - bleepingcomputer.com
First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild - securityweek.com
In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw - darkreading.com
Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning - securityweek.com
Update Chrome to patch critical browser security flaws - malwarebytes.com
GitLab Patches Code Execution, Information Disclosure Vulnerabilities - securityweek.com
25-Year-Old Vulnerability Patched in Curl - securityweek.com
Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability - thehackernews.com
Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks - thehackernews.com
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances - welivesecurity.com
Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses - darkreading.com
New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns - thehackernews.com
Cal Water Says No OT Systems Breached in Iranian Handala Cyberattack - securityweek.com
Report: Device Code Phishing is Surging - blog.knowbe4.com
Bluekit phishing kit adopts browser-in-the-middle for login theft - bleepingcomputer.com
Order-tracking app Shop abused to push callback phishing attacks - bleepingcomputer.com
New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis - thehackernews.com
New macOS malware embeds fake errors to confuse AI analysis tools - bleepingcomputer.com
Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools - securelist.com
Europe Evolves Into Ransomware's Favorite Region - darkreading.com
EdTech Attackers Shift From Schools to Their Software Suppliers - darkreading.com
Beware of “Parcel Expert” job offers: They’re parcel mule scams - malwarebytes.com
Fake domain renewal emails trick website owners into paying scammers - malwarebytes.com
Microsoft quietly extends free Windows 10 ESU support to October 2027 - bleepingcomputer.com
New Enterprise-Ready MCP Specification Brings New Security Challenges - securityweek.com
British Police Built a Sprawling Crime-Prediction Machine. Some Results Couldn’t Be Trusted - wired.com

CVE-2026-12569 on DanSec Daily

Cybersecurity Brief – 2026-06-26

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources