NIST Opens Updated IoT Security Guidance to Public Review The guidance aims to establish product cybersecurity requirements for IoT devices integrated into federal agencies’ networks. The post NIST Opens Updated IoT Security Guidance to Public Review appeared first on SecurityW… SecurityWeek · Jun 25, 2026
vulnerability Chrome 149 Update Resolves 18 Severe Vulnerabilities More than half of the bugs are use-after-free defects, which can potentially lead to remote code execution. The post Chrome 149 Update Resolves 18 Severe Vulnerabilities appeared first on SecurityWeek . SecurityWeek · Jun 25, 2026 High
vulnerability Cisco SD-WAN Zero-Day Exploited Months Before Patching CVE-2026-20245, the 7th Cisco SD-WAN vulnerability exploited in 2026, was used for months prior to its disclosure and patching. The post Cisco SD-WAN Zero-Day Exploited Months Before Patching appeared first on SecurityWe… SecurityWeek · Jun 25, 2026 Critical CVE-2026-20245CVE-2026-20127CVE-2026-20182
threat-intel Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access A zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN was exploited by an unknown threat actor, gaining root access to a communications service provider’s network. The attack involved anti-forensic technique… The Hacker News · Jun 25, 2026 Critical CVE-2026-20245CVE-2026-20127CVE-2026-20182zero-daysd-wanroot access
malware What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrime [Guest Diary], (Wed, Jun 24th) This SANS Internet Storm Center guest diary details an analysis of automated cybercrime activity observed through a honeypot, focusing on the Terrabot IoT botnet. The author, a BACS student, highlights the prevalence of… SANS Internet Storm Center · Jun 25, 2026 Medium CVE-2016-20017CVE-2018-10561CVE-2016-20016USiotbotnetscanning
threat-intel Google releases new privacy controls for activity history, personalization Google is releasing new privacy controls for its Search services and Google Play, allowing users to manage their saved history and personalized recommendations more granularly. The changes separate these functions into d… BleepingComputer · Jun 24, 2026 Low privacysearchpersonalization
threat-intel Smashing Security podcast #473: How a hacker could have Rickrolled the entire World Cup This Smashing Security podcast episode discusses a potential security risk at FIFA where a hacker could have used a ‘rickroll’ tactic to disrupt the World Cup. The conversation highlights a Black Kite report detailing a… Graham Cluley · Jun 24, 2026 High UKNLSEransomwaresupply chainrickroll
policy DraftKings hacker 'Snoopy' sentenced to 18 months in prison A 21-year-old using the alias "Snoopy" was sentenced to 18 months in prison for his role in hacking DraftKings accounts in the November 2022 cyberattack. BleepingComputer · Jun 24, 2026
vulnerability Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access A Mandiant report details how attackers exploited a zero-day vulnerability (CVE-2026-20245) in Cisco SD-WAN Manager, Controller, and Validator software to gain root access on targeted devices. The attackers initially gai… BleepingComputer · Jun 24, 2026 High CVE-2026-20245CVE-2026-20127CVE-2026-20182USzero-dayprivilege escalationroot access
vulnerability Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure Attackers exploited a critical vulnerability in Cisco Catalyst SD-WAN Controller (CVE-2026-20245) approximately two months before Cisco publicly disclosed it. The vulnerability, stemming from insufficient input validatio… Dark Reading · Jun 24, 2026 High CVE-2026-20245CVE-2026-20182CVE-2026-20127USsd-wanprivilege escalationzero-day
malware Malicious Edge extension abuses Native Messaging as bridge to malware A malicious Microsoft Edge extension, ‘Edgecution,’ was used in a ransomware attack by exploiting Native Messaging to bypass browser security sandboxes and deploy a Python-based backdoor. The attack, linked to the Payout… BleepingComputer · Jun 24, 2026 High USbrowser extensionnative messagingransomware
threat-intel 2026 FIFA World Cup Faces Surge in Cyber Threats The 2026 FIFA World Cup is facing a surge in cyber threats across the US, Canada, and Mexico, driven by a complex threat landscape including financial and nation-state actors. These threats primarily involve social engin… Dark Reading · Jun 24, 2026 High USCAMXcybercrimesocial engineeringfraud
threat-intel Three ‘cybercrime as a service’ operations undercut by Microsoft, law enforcement A coordinated international effort, led by Microsoft and Europol, successfully dismantled a significant cybercrime-as-a-service infrastructure used by multiple threat actors. The operation resulted in the seizure of subs… The Record · Jun 24, 2026 High RUcybercrime-as-a-servicesupply chaininfostealer
threat-intel Do CISOs Need a Code of Ethics? This article discusses the potential need for a code of ethics for Chief Information Security Officers (CISOs) due to concerns about self-dealing and prioritizing personal gain over organizational security. Robert "RSnak… Dark Reading · Jun 24, 2026 Medium cisoethicsvendor influence
threat-intel When Information Becomes the Attack Surface – Understanding AI Agent Traps This article discusses a new security risk related to AI agents – "traps" – where malicious information can be injected into the data sources an agent uses, leading it to make incorrect decisions or take unintended actio… SecurityWeek · Jun 24, 2026 High aiagentsecurity
vulnerability CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation of a critical security flaw impacting Lantronix EDS5000 Series devices, urging Federal Civilian Executive Branch (… The Hacker News · Jun 24, 2026 Critical CVE-2025-67038CVE-2026-34908CVE-2026-34909
threat-intel More Malicious OpenClaw Skills Threaten AI Supply Chain A recent investigation by Palo Alto Networks' Unit 42 revealed five malicious skills hidden within OpenClaw's ClawHub marketplace, a platform for AI agent skills. These skills, including infostealers, detection evasion t… Dark Reading · Jun 24, 2026 High USaisupply chaininfostealer
ransomware Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered A coordinated international law enforcement operation, involving Bitdefender, Bitsight, ESET, Microsoft, and Europol, successfully disrupted the Amadey and StealC malware networks, recovering 27 million stolen credential… The Hacker News · Jun 24, 2026 High NLCADEmaascredential theftransomware
malware Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware Hundreds of C&C servers were disrupted in an operation involving law enforcement and several cybersecurity companies. The post Microsoft and Allies Smash Shared Infrastructure of Amadey and StealC Malware appeared first… SecurityWeek · Jun 24, 2026 High
CISA warns of max severity Ubiquiti flaws exploited in attacks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of hackers actively exploiting flaws in Ubiquity UniFi OS and Lantronix serial-to-ethernet servers. BleepingComputer · Jun 24, 2026 CVE-2026-34908CVE-2026-34909CVE-2026-34910
