Cybersecurity, vulnerabilities, threats, and defense
Attackers compromised 50+ npm packages to distribute IronWorm, a self-spreading worm, and a Rust-based stealer with eBPF rootkit capabilities. The malware targets AI API keys and uses stolen credentials to propagate further across the registry.
A new Microsoft Defender zero-day called ‘RoguePlanet’ lets attackers gain SYSTEM privileges on fully patched Windows 10 and 11 machines. The race condition exploit published by researcher Nightmare Eclipse works against June 2026 Patch Tuesday systems — and there’s no fix yet.
SAP’s June 2026 patch package fixes 15 vulnerabilities including four critical flaws in NetWeaver and Commerce Cloud. CVE-2026-44748 (CVSS 9.9) lets attackers bypass SAML authentication, while CVE-2026-27671 (CVSS 9.8) enables unauthenticated memory corruption.
Varonis researchers tricked an OpenClaw AI agent into leaking AWS keys, database credentials, and customer records using basic social engineering. The agent caught phishing links and malicious OAuth apps — but fell for urgent-sounding emails from fake internal staff every time.
Attackers exploited an unauthenticated API endpoint in ServiceNow to access customer instance data. The company quietly patched the flaw on June 5 after detecting anomalous activity, but not before data was queried.
Attackers abused Meta’s AI-powered High Touch Support tool to hijack over 20,000 Instagram accounts, exploiting a missing email verification check to bypass 2FA and access passwords, DMs, and personal data for over six weeks before detection.
A threat actor called PCPJack hijacked 230 cloud servers across AWS, Google Cloud, and Azure, converting them into a covert SMTP relay network for spam. Researchers found the entire operation exposed on an unauthenticated server.
Microsoft released an investigative playbook for security teams to efficiently analyze incidents involving Copilot and Azure AI. It provides a structured, telemetry-driven method to determine what AI actions occurred, what data was involved, and whether it was a threat.
Hackers are abusing Google’s DoubleClick domain to deliver a .NET-based RAT through targeted phishing emails. The attack chain uses dynamically personalized landing pages and process hollowing to evade detection, making it harder for security tools to flag malicious traffic.
Microsoft removed 73 GitHub repositories after the Miasma supply-chain worm compromised them to distribute password-stealing malware. All repos are restored, but the worm’s targeting of AI coding tools signals a new phase in supply-chain attacks.
