Major Incidents or Breaches

  • Dashlane, a password manager, disclosed a brute-force attack resulting in the download of encrypted vaults for fewer than 20 personal users. Affected accounts were automatically locked to prevent further compromise. Users also reported account lockouts due to login attempts from unfamiliar locations and devices [3][12][30].
  • Over 30 npm packages under Red Hat’s @redhat-cloud-services namespace were compromised in a supply chain attack dubbed “Miasma,” distributing a variant of the Shai-Hulud malware to steal developer credentials and secrets [4][10].
  • A malicious supply chain campaign targeted developers using OpenAI Codex via a fraudulent npm package, codexui-android, which was designed to steal authentication tokens [8].
  • Dutch police dismantled a botnet comprising 17 million devices that was used as a residential proxy network and facilitated various cybercrimes [33].
  • Nearly 2,000 WordPress websites were infected with malware that uses Steam Community profile comments to hide command-and-control data [13].
  • A fake BlueWallet application targeting Mac users was observed stealing passwords, crypto wallet information, and clipboard data [40].
  • Threat actor DriveSurge hijacked thousands of websites to distribute malware via ClickFix and FakeUpdate campaigns [9].
  • The Spanish National Police arrested an individual responsible for leaking sensitive data of government employees, including those from the National Cybersecurity Institute (INCIBE) [11].
  • The Instagram accounts of high-profile individuals and organisations were compromised via Meta’s AI support bot, allowing attackers to seize and deface accounts with pro-Iranian content [27].

Newly Discovered Vulnerabilities

  • A critical Windows Netlogon remote code execution vulnerability (CVE-2026-41089) is now being actively exploited. Organisations are urged to patch immediately [16][34].
  • A new Linux kernel vulnerability, known as CIFSwitch and present for 19 years, allows low-privileged users to escalate to root. Proof-of-concept exploit code has been released [5][37].
  • A vulnerability in the WP Maps Pro WordPress plugin (CVE-2026-8732) is being exploited to allow unauthenticated attackers to create administrative accounts on affected sites [32].
  • Palo Alto Networks PAN-OS authentication bypass vulnerability (CVE-2026-0257) has been under active exploitation since four days after its public disclosure, with at least two observed attack waves [5][22][38].

Notable Threat Actor Activity

  • China-aligned threat groups launched Operation Dragon Weave, targeting officials and citizens in the Czech Republic and Taiwan with the AdaptixC2 agent for cyber espionage [6].
  • Recent campaigns have seen attackers leveraging SVG files in phishing emails, bypassing traditional detection methods [28].
  • Carnival Corporation, a major cruise line operator, was named among top targets in recent cyber incidents [39].

Trends, Tools, or Tactics of Interest

  • Attack vectors in containerised environments remain focused on exposed secrets, privilege misconfigurations, API compromise, and supply chain attacks [1].
  • Malware campaigns are increasingly using unconventional channels for command-and-control, such as hiding payloads in Steam Community profiles [13].
  • There is a trend towards faster exploitation of vulnerabilities following public disclosure, underscoring the importance of rapid patch management [15][38].
  • A new browser-based technique, FROST, enables websites to infer user activity on SSDs using JavaScript, raising concerns over novel tracking vectors [26].
  • MSPs are moving beyond traditional vCISO tools, seeking integrated security growth platforms for broader service delivery [7].

Regulatory or Policy Developments Affecting the Security Industry

  • Anthropic will open its Mythos AI system to the EU’s ENISA as part of Project Glasswing, reflecting deepening cooperation between the European Commission and AI vendors [20].
  • Microsoft’s legal threats against researchers disclosing zero-day exploits have sparked backlash, raising concerns about the chilling effect on vulnerability research [21].
  • Oracle has shifted to a monthly patch cadence, with its first rollout addressing 77 vulnerabilities [31].

Sources#

  1. Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded - thehackernews.com
  2. Dashlane password manager users locked out by brute force attacks - bleepingcomputer.com
  3. Dashlane Brute-Force Attack Leads to Limited Encrypted Vault Downloads - securityweek.com
  4. Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm - thehackernews.com
  5. Red Hat npm packages compromised to steal developer credentials - bleepingcomputer.com
  6. OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack - thehackernews.com
  7. Dutch Police Dismantle Massive 17-Million-Device Botnet - securityweek.com
  8. WordPress malware campaign hides payloads in Steam profiles - bleepingcomputer.com
  9. Fake BlueWallet steals passwords, accounts, and crypto from Macs - malwarebytes.com
  10. Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks - bleepingcomputer.com
  11. Spain arrests doxer leaking sensitive data of govt employees - bleepingcomputer.com
  12. Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts - krebsonsecurity.com
  13. Critical Windows Netlogon RCE flaw now exploited in attacks - bleepingcomputer.com
  14. Critical Windows Netlogon Vulnerability in Attackers’ Crosshairs - securityweek.com
  15. ⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More - thehackernews.com
  16. 19-Year-Old Linux Kernel Vulnerability Exposes Systems to Root Access - securityweek.com
  17. WP Maps Pro Vulnerability Exploited to Take Over WordPress Sites - securityweek.com
  18. Patch Now: Another Palo Alto Auth Bypass Bug Under Active Exploit - darkreading.com
  19. Recent Palo Alto Networks Vulnerability Exploited for Weeks - securityweek.com
  20. China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan - thehackernews.com
  21. New Wave Of Phishing Emails with SVG Files, (Tue, Jun 2nd) - isc.sans.edu
  22. 1st June – Threat Intelligence Report - research.checkpoint.com
  23. Containers on fire: from container escapes to supply chain attacks - securelist.com
  24. Race Against Time: Why Faster Vulnerability Alerts Matter - bleepingcomputer.com
  25. Websites Can Now Spy on You Through Your Hard Drive - wired.com
  26. The Security Growth Platform: Why MSPs Are Moving Beyond vCISO Tools - thehackernews.com
  27. Anthropic to Open Mythos AI to EU's ENISA - darkreading.com
  28. Microsoft's Zero-Day Legal Threats Spark Backlash - darkreading.com
  29. Oracle’s First Monthly Patches Resolve 77 Vulnerabilities - securityweek.com