Major Incidents or Breaches

  • Tata Electronics confirmed a cyberattack that impacted parts of its IT infrastructure, with hackers leaking company data online [11].
  • Healthtech firm Xsolis suffered a data breach impacting nearly 1.4 million individuals after attackers gained access via a phishing attack [13].
  • LastPass reported a data breach resulting from the Klue supply chain attack, where attackers used stolen OAuth tokens to access customer data in its Salesforce environment [17][19].
  • The scope of Salesforce attacks has expanded, with more victims reporting data breaches as a result of attackers leveraging Klue’s compromised OAuth tokens [19].
  • Dialog, a private events group, experienced a data exposure incident due to a misconfigured website, leaving member information accessible without evidence of a break-in [23].
  • The Texas Parks and Wildlife Department suffered a breach at a third-party vendor, exposing passport and driver’s license data of over three million Texans [39].

Newly Discovered Vulnerabilities

  • A critical SSRF vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager is being actively exploited in the wild after public proof-of-concept code was released [3][10][28].
  • Researchers found data exposure vulnerabilities in the Dify AI platform, potentially allowing attackers to read private chats, preview documents, and access internal APIs across over one million apps [31].
  • An eight-year-old high-severity use-after-free vulnerability in Samsung’s KNOX security framework affected Galaxy devices from S9 through S25, exposing millions of devices to kernel-level attacks [32].
  • The FFmpeg PixelSmash flaw enables remote code execution via crafted media files when processed by applications using the libavcodec library [35].
  • Malicious npm packages masquerading as PostCSS tools have been identified delivering a Windows-based remote access trojan (RAT) [9].
  • A new macOS ClickFix attack uses terminal commands to silently mount DMG files and deploy infostealer malware without user interaction [14].

Notable Threat Actor Activity

  • The Russian-speaking FortiBleed initial access broker is behind a large-scale campaign targeting over 430,000 FortiGate firewalls globally, harvesting 110 million credentials using a Golang-based sniffer [4][22].
  • A newly identified extortion group, “Pink,” is using voice phishing and IT support impersonation calls to breach organizations, possibly as a rebrand of previous extortion actors [2].
  • Two members of the Scattered Spider cybercrime group pleaded guilty to hacking Transport for London in 2024, following an attack that disrupted public transport systems [15][24].
  • SocGholish, linked to Evil Corp, continues using traffic distribution systems (TDSs) to facilitate initial access for cybercrime operations [21].

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly leveraging workplace collaboration tools such as Microsoft Teams to launch social engineering and phishing attacks [1].
  • Fake AI agent skills have been shown to pass security scans and reach thousands of corporate and individual agents via skill marketplaces and social media promotion [5].
  • There is a trend of attackers exploiting newly disclosed vulnerabilities rapidly, often before organizations can patch, with security teams urged to validate exploitability as soon as vulnerabilities are public [16].
  • GitHub updated its actions/checkout to block common pwn request attack patterns, targeting the misuse of pull_request_target workflows in CI/CD pipelines [7].
  • Malicious pull requests, dubbed “Cordyceps,” are threatening developer workflows across multiple major platforms including Azure Sentinel, Google’s AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and Python Software Foundation’s Black [20].
  • Dragos introduced EmberAI, an AI-driven capability for operational technology security, leveraging its OT cybersecurity dataset [30].
  • OpenAI has shifted its cybersecurity focus toward patching vulnerabilities over merely discovering them, expanding its Daybreak initiative with new tools and partnerships [36].

Regulatory or Policy Developments Affecting the Security Industry

  • A US executive order signed on June 22 mandates federal agencies to migrate high-value assets and high-impact systems to post-quantum cryptography by 2030, with specific deadlines for key establishment and digital signature protections [6].

[1]: https://blog.knowbe4.com/teams-phishing-social-engineering-collaboration-tools
[2]: https://blog.knowbe4.com/new-pink-extortion-group-vishing-it-support-scams
[3]: https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html
[4]: https://thehackernews.com/2026/06/fortibleed-targeted-fortigate-firewalls.html
[5]: https://thehackernews.com/2026/06/fake-ai-agent-skill-passed-security.html
[6]: https://thehackernews.com/2026/06/trump-order-sets-2030-deadline-for.html
[7]: https://thehackernews.com/2026/06/github-updates-actionscheckout-to-block.html
[9]: https://thehackernews.com/2026/06/malicious-npm-packages-pose-as-postcss.html
[10]: https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/
[11]: https://www.bleepingcomputer.com/news/security/tata-electronics-confirms-cyberattack-as-hackers-leak-data/
[13]: https://www.bleepingcomputer.com/news/security/healthtech-firm-xolis-suffers-data-breach-impacting-14-million-people/
[14]: https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/
[15]: https://www.bleepingcomputer.com/news/security/scattered-spider-members-plead-guilty-to-hacking-transport-for-london/
[16]: https://www.bleepingcomputer.com/news/security/the-exploit-doesnt-exist-you-can-still-prove-it-works-against-you/
[17]: https://www.bleepingcomputer.com/news/security/lastpass-confirms-data-breach-in-klue-supply-chain-attack/
[19]: https://www.darkreading.com/cyberattacks-data-breaches/scope-salesforce-attacks-expands-icarus-leaks-data
[20]: https://www.darkreading.com/application-security/cordyceps-malicious-pull-requests-developer-workflows
[21]: https://www.darkreading.com/cyber-risk/socgholish-takedown-malicious-tds-threats
[22]: https://www.darkreading.com/cyberattacks-data-breaches/fortibleed-attackers-firewalls-credentials-stealers
[23]: https://www.wired.com/story/dialog-hack-website-misconfiguration/
[24]: https://krebsonsecurity.com/2026/06/scattered-spider-hackers-plead-guilty-on-day-1-of-trial/
[28]: https://www.securityweek.com/hackers-exploiting-cisco-unified-cm-vulnerability/
[30]: https://www.securityweek.com/dragos-unveils-ai-for-ot-security/
[31]: https://www.securityweek.com/data-exposure-flaws-threaten-dify-ai-platform-powering-over-1-million-apps/
[32]: https://www.securityweek.com/eight-year-old-samsung-knox-flaw-exposed-millions-of-galaxy-devices-to-kernel-attacks/
[35]: https://www.securityweek.com/ffmpeg-pixelsmash-flaw-allows-rce-on-video-players-media-servers-nas-appliances/
[36]: https://www.securityweek.com/openai-refocuses-cybersecurity-efforts-on-patching-over-discovery/
[39]: https://www.malwarebytes.com/blog/data-breaches/2026/06/hackers-steal-passport-and-drivers-license-data-of-3-million-texans

Sources#

  1. Tata Electronics confirms cyberattack as hackers leak data - bleepingcomputer.com
  2. Healthtech firm Xolis suffers data breach impacting 1.4 million people - bleepingcomputer.com
  3. LastPass confirms data breach in Klue supply chain attack - bleepingcomputer.com
  4. Scope of Salesforce Attacks Expands as Icarus Leaks Data - darkreading.com
  5. Dialog Claims It Was Hacked. A Misconfigured Website Left Its Members Exposed - wired.com
  6. Hackers steal passport and driver’s license data of 3 million Texans - malwarebytes.com
  7. Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root - thehackernews.com
  8. Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks - bleepingcomputer.com
  9. Hackers Exploiting Cisco Unified CM Vulnerability - securityweek.com
  10. Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps - securityweek.com
  11. Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel Attacks - securityweek.com
  12. FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances - securityweek.com
  13. Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT - thehackernews.com
  14. New macOS ClickFix attack silently mounts DMGs to push infostealer - bleepingcomputer.com
  15. FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation - thehackernews.com
  16. FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist - darkreading.com
  17. New Extortion Brand Uses IT Impersonation to Breach Organizations - blog.knowbe4.com
  18. Scattered Spider members plead guilty to hacking Transport for London - bleepingcomputer.com
  19. Scattered Spider Hackers Plead Guilty on Day 1 of Trial - krebsonsecurity.com
  20. SocGholish Takedown Highlights Malicious TDS Threats - darkreading.com
  21. Social Engineering Attacks Abuse Workplace Collaboration Tools - blog.knowbe4.com
  22. Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents - thehackernews.com
  23. The Exploit Doesn't Exist. You Can Still Prove It Works Against You - bleepingcomputer.com
  24. GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns - thehackernews.com
  25. 'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows - darkreading.com
  26. Dragos Unveils AI for OT Security - securityweek.com
  27. OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery - securityweek.com
  28. Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration - thehackernews.com