Cybersecurity Brief – 2026-06-21

Sun, 21 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Threat actors are exploiting a recently patched vulnerability in the Gravity SMTP WordPress plugin, which has approximately 100,000 installations. The flaw, tracked as CVE-2026-4020, allows attackers to expose API keys used for email delivery services, potentially leading to further compromise of affected sites ^[1].
Hackers claim to have leaked stolen data from Madison Square Garden, indicating a potential data breach affecting the venue’s systems ^[4].

A security flaw in the Gravity SMTP WordPress plugin, identified as CVE-2026-4020, has been actively exploited. The vulnerability enables attackers to access sensitive API keys from plugin configurations ^[1].

Microsoft has attributed the recent Mastra AI supply chain attack, which compromised over 140 npm packages, to the North Korean hacking group Sapphire Sleet (BlueNoroff) ^[3].

The newly identified Prinz Eugen ransomware operation is notable for prioritizing the encryption of recently modified files and for not leaving a ransom note on infected systems, which may hinder victim response and detection ^[2].

The French President has called for cooperation among wealthy democracies to regulate advanced AI systems, urging the United States to share cutting-edge AI technologies and align on regulatory approaches ^[5].