Major Incidents or Breaches

  • Personal data belonging to politicians, military leaders, and executives was left publicly accessible due to a security misconfiguration at an elite networking organization, leading to a data breach affecting high-profile individuals [40].
  • Authorities in Poland arrested four members of a cybercrime group accused of breaching telecommunications partners and hijacking email accounts to conduct SIM-swapping attacks, resulting in millions in cryptocurrency theft [13].

Newly Discovered Vulnerabilities

  • A critical vulnerability (CVE-2026-12569) in PTC Windchill enabling remote code execution has been exploited in the wild and added to CISA’s Known Exploited Vulnerabilities catalog [28].
  • A server-side request forgery (SSRF) flaw in Cisco Unified Communications Manager (CUCM) and Unified CM SME, which can escalate privileges to root, was weaponized by attackers less than 24 hours after disclosure [21].
  • A vulnerability in Lantronix Serial-to-IP converters (CVE-2025-67038), disclosed in April, has been exploited following OT threat warnings [33].
  • Chrome patched 18 vulnerabilities, including four critical flaws, two of which are WebGL bugs that could allow sandbox escape [38].
  • GitLab CE/EE released updates addressing 13 vulnerabilities, including three rated high severity that could lead to code execution or information disclosure [34].
  • The open-source curl tool patched 18 vulnerabilities, including a 25-year-old flaw, though all were rated medium or low severity [35].
  • A popular Chrome ad blocker extension for YouTube, with over 10 million installs, was found to have dormant script injection capability that could allow arbitrary JavaScript execution [7].

Notable Threat Actor Activity

  • The Russian state-sponsored threat actor Turla has deployed a previously undocumented .NET backdoor named STOCKSTAY in espionage attacks targeting government and military organizations in Ukraine [6].
  • The Gamaredon APT group has upgraded its toolset, increasing its use of legitimate online services for command and control and data exfiltration, and is forming new alliances to enhance operational security [5][22].
  • A new backdoor named Mistic, linked to the KongTuke group, has been used in financially motivated attacks targeting sectors including insurance, education, IT, and professional services [11].
  • Iranian hacker group Handala claimed responsibility for a cyberattack on California Water Service, but investigation found no evidence of OT system compromise [32].

Trends, Tools, or Tactics of Interest

  • Sophisticated phishing kits are increasingly targeting device code authentication flows to breach accounts without requiring passwords [2].
  • The Bluekit phishing-as-a-service platform has adopted browser-in-the-middle techniques for login theft and expanded its infrastructure with nearly 70 new hostnames in the past week [18].
  • Threat actors are abusing the Shop order-tracking app by inserting fake purchase receipts into users’ histories to launch callback phishing attacks [14].
  • New macOS malware named Gaslight uses prompt injection payloads and embeds fake errors specifically designed to confuse AI-assisted malware analysis tools [10][16].
  • There is a rise in attacks against SMBs involving fake AI tools, phishing, and the sale of stolen data on the dark web [1].
  • Ransomware operators are increasingly targeting EU organizations and their suppliers, making Europe the primary region of interest after a global lull [25].
  • EdTech attackers are shifting focus from direct attacks on schools to targeting their software suppliers, increasing supply chain risk [23].
  • Parcel mule scams are spreading via fake job offers, tricking victims into handling stolen goods [37].
  • Fake domain renewal emails and websites are being used to deceive website owners into paying scammers [39].

Regulatory or Policy Developments Affecting the Security Industry

  • Microsoft has extended its free Windows 10 Extended Security Updates (ESU) program for consumers by one year, allowing continued receipt of security updates until October 2027 [15].
  • The new enterprise-ready Model Context Protocol (MCP) specification shifts security responsibilities from the protocol itself to developers and platform operators, introducing new security challenges [29].
  • A WIRED investigation highlighted reliability issues with a UK police predictive analytics system built as part of the adoption of AI in law enforcement [26].

[1]: https://securelist.com/smb-threat-report-2026/120357/ [2]: https://blog.knowbe4.com/device-code-phishing-tsunami [5]: https://www.welivesecurity.com/en/eset-research/gamaredon-2025-leveraging-tunnels-workers-dead-drops-new-alliances/ [6]: https://thehackernews.com/2026/06/google-details-turlas-new-stockstay.html [7]: https://thehackernews.com/2026/06/chrome-ad-blocker-with-10m-installs.html [10]: https://thehackernews.com/2026/06/new-gaslight-macos-malware-uses-prompt.html [11]: https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html [13]: https://www.bleepingcomputer.com/news/security/poland-busts-sim-swapping-gang-tied-to-millions-in-crypto-theft/ [14]: https://www.bleepingcomputer.com/news/security/order-tracking-app-shop-abused-to-push-callback-phishing-attacks/ [15]: https://www.bleepingcomputer.com/news/microsoft/microsoft-quietly-extends-free-windows-10-esu-support-to-october-2027/ [16]: https://www.bleepingcomputer.com/news/security/new-macos-malware-embeds-fake-errors-to-confuse-ai-analysis-tools/ [18]: https://www.bleepingcomputer.com/news/security/bluekit-phishing-kit-adopts-browser-in-the-middle-for-login-theft/ [21]: https://www.darkreading.com/cyberattacks-data-breaches/less-than-24-hours-attackers-weaponize-cisco-cucm-flaw [22]: https://www.darkreading.com/threat-intelligence/russia-apt-gamaredon-arsenal-defense [23]: https://www.darkreading.com/cyberattacks-data-breaches/edtech-attackers-shift-schools-software-suppliers [25]: https://www.darkreading.com/cybersecurity-analytics/europe-evolves-ransomware-favorite-region [26]: https://www.wired.com/story/british-police-built-a-sprawling-crime-prediction-machine-some-results-couldnt-be-trusted/ [28]: https://www.securityweek.com/first-ever-exploitation-of-ptc-windchill-vulnerability-discovered-in-the-wild/ [29]: https://www.securityweek.com/new-enterprise-ready-mcp-specification-brings-new-security-challenges/ [32]: https://www.securityweek.com/cal-water-finds-no-evidence-of-ot-activity-after-hackers-claimed-they-could-disrupt-water-supply/ [33]: https://www.securityweek.com/lantronix-serial-to-ip-converter-flaw-exploited-in-attacks-after-ot-threat-warning/ [34]: https://www.securityweek.com/gitlab-patches-code-execution-information-disclosure-vulnerabilities/ [35]: https://www.securityweek.com/25-year-old-vulnerability-patched-in-curl/ [37]: https://www.malwarebytes.com/blog/scams/2026/06/beware-of-parcel-expert-job-offers-theyre-parcel-mule-scams [38]: https://www.malwarebytes.com/blog/news/2026/06/update-chrome-to-patch-critical-browser-security-flaws [39]: https://www.malwarebytes.com/blog/threat-intel/2026/06/fake-domain-renewal-emails-trick-website-owners-into-paying-scammers [40]: https://www.malwarebytes.com/blog/privacy/2026/06/elite-network-says-it-was-hacked-after-members-personal-data-was-left-exposed

Sources#

  1. Elite network says it was hacked after members’ personal data was left exposed - malwarebytes.com
  2. Poland busts SIM-swapping gang tied to millions in crypto theft - bleepingcomputer.com
  3. First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild - securityweek.com
  4. In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw - darkreading.com
  5. Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning - securityweek.com
  6. Update Chrome to patch critical browser security flaws - malwarebytes.com
  7. GitLab Patches Code Execution, Information Disclosure Vulnerabilities - securityweek.com
  8. 25-Year-Old Vulnerability Patched in Curl - securityweek.com
  9. Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability - thehackernews.com
  10. Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks - thehackernews.com
  11. Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances - welivesecurity.com
  12. Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses - darkreading.com
  13. New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns - thehackernews.com
  14. Cal Water Says No OT Systems Breached in Iranian Handala Cyberattack - securityweek.com
  15. Report: Device Code Phishing is Surging - blog.knowbe4.com
  16. Bluekit phishing kit adopts browser-in-the-middle for login theft - bleepingcomputer.com
  17. Order-tracking app Shop abused to push callback phishing attacks - bleepingcomputer.com
  18. New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis - thehackernews.com
  19. New macOS malware embeds fake errors to confuse AI analysis tools - bleepingcomputer.com
  20. Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools - securelist.com
  21. Europe Evolves Into Ransomware's Favorite Region - darkreading.com
  22. EdTech Attackers Shift From Schools to Their Software Suppliers - darkreading.com
  23. Beware of “Parcel Expert” job offers: They’re parcel mule scams - malwarebytes.com
  24. Fake domain renewal emails trick website owners into paying scammers - malwarebytes.com
  25. Microsoft quietly extends free Windows 10 ESU support to October 2027 - bleepingcomputer.com
  26. New Enterprise-Ready MCP Specification Brings New Security Challenges - securityweek.com
  27. British Police Built a Sprawling Crime-Prediction Machine. Some Results Couldn’t Be Trusted - wired.com