Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 8,569 stories synthesized.
Key findings • Ten vulnerabilities in Litellm disclosed on June 21, 2026, affecting versions up to 1.82.5. • Key issues include improper authorization, server-side request forgery (SSRF), and…
A weekly roundup highlights two major security incidents: 74,000 Fortinet firewall credentials were stolen, and a remote code execution vulnerability in Splunk Enterprise is under active attack.
Key findings • CVE-2026-56346 allows unauthenticated PGP message decryption via decryptMessage.json.php • CVE-2026-56345 enables arbitrary user session hijacking through the Meet plugin •…
CyberSentinel AI v3.0 integrates 33 cybersecurity tools like Nmap and SQLMap with a provider-agnostic AI engine supporting Claude, GPT-4o, and fully offline local inference using Ollama.
Key findings • 21 CVEs disclosed together on June 19–20, 2026, all patched in versions 12.128.2 and 12.128.12 • Four unauthenticated cross-tenant bugs target Supabase PostgREST RPC function…
A new ransomware operation named Prinz Eugen targets recently modified files and leaves no ransom note, complicating recovery and ransom communications.
Key findings • CVE-2026-56216 allows app-limited API keys to escalate to unrestricted org-wide keys • Four unauthenticated CVEs target Supabase PostgREST RPC endpoints for cross-tenant attack…
The ShinyHunters extortion gang claims to have stolen 8.8 terabytes of data from Amazon's One Medical unit and is threatening to publish it unless the company meets ransom demands by June 22.
The employee health plan of novelty retailer Spencer's Gifts has paid a $450,000 HIPAA penalty after a federal investigation into a 2021 Conti ransomware breach revealed systemic privacy and security rule failures.
Key findings • Two critical CVEs: arbitrary file read via BaseFileComponent nodes and IDOR in /api/v1/responses • Unauthenticated DoS via oversized multipart boundary on /api/v1/files/upload/…
Key findings • 13 CVEs disclosed together on 2026-06-19, one critical (CVE-2026-54782) and seven high-severity • Critical SAML authentication bypass allows full impersonation of any STS-issue…
Key findings • 13 CVEs disclosed June 18–19, 2026 across Copilot, Azure, Exchange, Dynamics 365, Edge, and developer libraries • Four Copilot-related flaws include an open redirect, command…
Key findings • 25 vulnerabilities disclosed in Joomla! components on June 19, 2026, within a single hour. • Majority of disclosed vulnerabilities are SQL injection flaws across numerous third…
Critical vulnerabilities in the SiderAI and MaxAI Chrome extensions, installed on over 10 million devices, allow attackers to silently extract Gmail, calendar, and AI conversation data without any user interaction.
A weekly roundup covers Apple's Beats eavesdropping patch, a supply chain attack on 1.2 million WordPress sites via OptinMonster, and a decade-long stealth operation by China-linked Velvet Ant.
Key findings • CVE-2026-52910: Use-after-free in BPF reuseport cBPF program handling, reported with a reproducer • CVE-2026-52909: Missing netns_immutable flag in ip6_vti fallback device allo…
Key findings • 12 CVEs disclosed together, all fixed in Apache APISIX 3.17.0 • Five authentication bypass/spoofing flaws across jwt-auth, hmac-auth, jwe-decrypt, opa, and authz-casdoor • …
Qualys researchers have uncovered HazyBeacon, a cyber-espionage campaign targeting Southeast Asian governments that weaponizes AWS Lambda Function URLs as stealthy command-and-control relays.
A breach at an unnamed license-sales vendor for the Texas Parks and Wildlife Department has exposed the personal data of over 3 million Texans, including driver's license and passport numbers.
Check Point researchers uncovered a campaign where attackers used fake GitHub stars, YouTube tutorials, and favorable VirusTotal comments to promote malicious cryptocurrency sniper bots and gambling predictors.
Threat actors injected malicious JavaScript into the Okendo Reviews widget, a platform used by over 18,000 e-commerce sites, to deliver remote access trojans and info-stealers via fake CAPTCHA prompts.
Key findings • CVE-2026-50242 allows authentication bypass via direct database access, leading to full admin control • CVE-2026-56141 enables account takeover through predictable restore code…
Microsoft has acknowledged a bug in all supported Windows releases where the Recycle Bin confirmation dialog displays internal filenames instead of the original file names after installing the June 2026 security updates.
International law enforcement has disrupted the SocGholish malware network, removing malicious code from 15,000 compromised websites and dismantling infrastructure linked to the Evil Corp ransomware group.