Attackers are actively exploiting a critical vulnerability in SimpleHelp remote monitoring and management software to deliver TaskWeaver and Djinn Stealer malware. The compromise leverages the RMM platform's trusted access to deploy information-stealing and backdoor capabilities on affected systems.
Three-day patching deadlines, exposed fuel-tank systems, scams costing billions of dollars, and social media bans for children all gave Tony plenty to unpack in June 2026
ReliaQuest has identified a significant increase in ClickFix-based social engineering attacks targeting both Windows and macOS users, establishing the technique as a preferred malware delivery method among cybercriminals. The attacks leverage deceptive user interactions to compromise systems across multiple platforms, posing a growing threat to enterprise and individual users alike.
Post-quantum cryptography is now accessible to Python developers with the release of cryptography v48, which implements NIST-standard ML-KEM and ML-DSA algorithms—critical as the White House has mandated federal systems migrate to quantum-resistant cryptography by 2030-2031 to counter "harvest now, decrypt later" attacks. However, successful migration requires more than swapping primitives; organizations must redesign protocols and data formats to accommodate significantly larger key sizes and signatures (often 1-2 orders of magnitude larger than classical counterparts). With pyca/cryptography handling cryptographic operations for 1.2 billion monthly downloads across projects like Certbot and Ansible, this library's
Threat actors targeted Japanese hotels partnered with Booking.com through phishing emails in May, using blockchain infrastructure to host malware payloads. The campaign exploited the trust relationship between accommodation providers and the popular booking platform to distribute malicious code.
The UK healthcare sector experienced a dramatic surge in cyber-attacks during the first five months of 2026, with SonicWall recording 264,000 events targeting hospitals and related infrastructure. This tenfold increase represents a significant escalation in threats against critical healthcare facilities, underscoring the sector's growing vulnerability to coordinated cyber campaigns.
84% of sports organizations had a cyber incident in the past 12 months. Here is what the data and our analysis tells us about why sport has become such a target.
Report Fraud data reveals that more than half of 323 UK ransomware victims last year were SMEs
A critical pre-authentication remote code execution vulnerability in Progress Kemp LoadMaster, a widely deployed edge load balancer in enterprise networks, stems from an uninitialized heap condition that attackers can exploit to gain initial access. Given LoadMaster's common placement at network perimeters, successful exploitation could provide attackers with a direct entry point into enterprise environments. watchTowr Labs' analysis highlights how edge appliances, when compromised, can become attack vectors rather than security boundaries.
OpenAI is previewing its GPT-5.6 Sol model to a vetted few at the US government's request
Group-IB has identified a Telegram-based malware campaign distributing Millenium RAT, a remote access trojan rewritten in C++, which has successfully infected over 62,000 devices across more than 160 countries. The widespread nature of the campaign highlights the continued threat posed by commodity RAT malware leveraging popular messaging platforms for command and control infrastructure.
Threat actors leveraged Bing Search results to distribute Bumblebee malware, which then deployed AdaptixC2 as a secondary payload leading to Akira ransomware deployment. The campaign was observed in multiple intrusions and reported by The DFIR Report in coordination with Swisscom B2B CSIRT. This attack chain demonstrates a multi-stage infection flow using legitimate search engines as initial compromise vectors.
An attacker exploited a zero-day vulnerability in Oracle PeopleSoft to breach the IT systems of the NAIC, the standards-setting body for the US federal insurance regulatory framework. The incident represents a significant compromise of critical insurance industry infrastructure, potentially exposing sensitive data handled by the regulator. The breach underscores ongoing risks associated with unpatched enterprise software vulnerabilities in high-value government and regulatory targets.
Russian state-backed hackers are suspected of conducting a destructive cyber-attack against Jaguar Land Rover, with security experts identifying characteristics typical of Kremlin-linked threat actors including deployment of previously undocumented ransomware and deliberate obfuscation tactics. The breach's strategic timing and technical indicators have led analysts to attribute the incident to Russian state-sponsored operations, though attribution efforts have been complicated by the attackers' counter-forensic measures.
Discover how Self-Learning AI tackles event security challenges like the 'access paradox' and IT/OT convergence with speed and precision.
Your inbox is an identity system all of its own: whoever owns it may own a lot more
The FBI has issued a warning that Russian intelligence operatives are conducting phishing campaigns specifically aimed at compromising Signal backup keys. By targeting these encryption recovery mechanisms, attackers seek to undermine the security of Signal's encrypted messaging platform and potentially gain access to user communications.
Prompt analysis is reshaping AI security. Learn why prompts are behavioral signals, not just text, and why context is critical to identifying real enterprise risk.
00:00 - Introduction 01:00 - Start of nmap 03:20 - Searching for vulnerabilities in Wing FTP Server 06:20 - Testing the RCE and running a command 09:30 - Weaponizing the POC to get a reverse shell 12:10 - Shell returned, grabbing the password hashes, discovering it uses a hard-coded salt and then cracking it 22:40 - Got the wacky password and can run a python script with sudo, searching for CVE's found one in tarfile 31:40 - Got our Elevated File Write working, finding safe files to get a shell, crontab did not work. But overwriting the script or sudoers.d file did work
Learn how to detect, govern, and reduce Shadow AI risk with enterprise-wide visibility, behavioral analysis, and AI security best practices.