Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,746 stories synthesized.
This week's ThreatsDay roundup covers a 24-year-old curl vulnerability, smart TVs turned into proxyware, AI-powered crime forums, and 13 other security stories.
Ukraine's state postal operator Ukrposhta reported a cyberattack disrupting its mobile app, with a pro-Russian group claiming responsibility.
Russian authorities used Cellebrite's UFED device to extract data from a dissident's phone three months after the company said it had stopped working with the country, raising questions about the firm's ability to control its surveillance technology.
ManageEngine disclosed CVE-2026-11374, a high-severity vulnerability in AD360 integration that lets unauthenticated attackers predict SSO tokens, enabling account takeover and privilege escalation.
A paper titled 'Prompt Injection as Role Confusion' shows that large language models fail to distinguish instruction blocks from user data because they learn stylistic patterns rather than respecting tag boundaries.
GitLab released security updates fixing 13 vulnerabilities in Community and Enterprise Editions, including three high-severity bugs that could enable code execution and information disclosure.
Google released Chrome 149.0.7827.196/197 for Windows and Mac, fixing 18 vulnerabilities including four critical bugs, with two WebGL use-after-free flaws that could enable sandbox escape.
Google released Gemini 3.5 Flash with built-in computer use capabilities, enabling AI agents to autonomously navigate browsers and desktops while introducing new enterprise security safeguards.
Kaspersky's 2026 SMB threat report reveals a fivefold increase in attacks disguised as AI tools, with over 33,300 incidents in early 2026, and highlights that most dark-web corporate access sales target small businesses.
Cisco Talos published deep-dive research on how threat actors abuse Windows Component Object Model and Distributed COM for lateral movement, persistence, evasion, and system discovery.
A June 2026 phishing campaign targeting Italian users drops a malicious Chrome extension that abuses Native Messaging to bypass the browser sandbox and execute arbitrary PowerShell commands, enabling session hijacking and remote backdoor access.
Curl 8.11.0 patches 18 vulnerabilities, including a 25-year-old heap overflow bug (CVE-2026-3620) introduced in 1999.
ESET researchers document Russia's FSB-linked Gamaredon group deploying new malware families and increasingly relying on legitimate cloud services, tunneling platforms, and social media to conceal command-and-control infrastructure in ongoing attacks against Ukraine.
Dialog, an exclusive invite-only network founded by billionaire Peter Thiel, exposed the personal data of hundreds of high-profile members—including a NATO commander and US senators—through a misconfigured app distribution site that required no password to access.
A Qilin ransomware affiliate exploited CVE-2026-50751, a critical authentication bypass in Check Point Remote Access VPN, for six weeks before CISA issued an emergency directive on June 21.
WhatsApp is introducing a warning screen that appears before users open chats with unfamiliar phone numbers, aiming to reduce scams and phishing.
ESET research reveals Gamaredon's 2025 evolution: cloud-based dead drops, Turla collaboration, and a CVE-2025-8088 exploit for persistent access in 35+ campaigns against Ukraine.
A 17-year-old UK student discovered his school's Active Directory domain controller tools were accessible without authentication, with the domain admin password stored in plaintext in a description field.
Irregular's AI security lab launched FrontierCyber, a benchmark that uses novel, unpublished vulnerabilities to evaluate AI models' genuine offensive-cyber capabilities without relying on known exploits or public writeups.
Australia's domestic intelligence agency disclosed that nation-state actors compromised a critical infrastructure provider, stealing administrator credentials and maintaining persistent access for potential future sabotage.
Anthropic formally accused Alibaba of orchestrating the largest known adversarial distillation attack, using 25,000 fraudulent accounts to extract capabilities from its Claude AI model over six weeks.
A SANS ISC guest diary dissects the TerraBot IoT botnet, revealing how automated cybercrime campaigns succeed through volume despite technical flaws.
Mandiant details STOCKSTAY, a .NET backdoor used by Russia-linked Turla since 2022 against Ukrainian government and Italian foreign policy entities.
Key findings • CISA added Cisco CVE-2026-20230 to the KEV catalog on June 25, 2026, confirming active exploitation. • Federal agencies must remediate by July 16, 2026, under BOD 22-01 require…