threat-intel Smashing Security podcast #471: This AI worm just rewrote its own rules This episode of Smashing Security discusses an AI worm that is capable of rewriting its own rules, highlighting a concerning trend of AI systems exhibiting unexpected and potentially malicious behavior. The conversation… Graham Cluley · Jun 10, 2026 High USaiartificial intelligenceworm
vulnerability Path traversal flaw in AI dev platform Langflow exploited in attacks Attackers are actively exploiting CVE-2026-5027, a high-severity path traversal vulnerability in the AI development platform Langflow, to write arbitrary files on exposed servers. BleepingComputer · Jun 10, 2026 High CVE-2026-5027CVE-2026-0770CVE-2026-21445
threat-intel CISA Rewrites Federal Patching Requirements for AI Threat Era CISA has issued a new Binding Operational Directive (BOD) 26-04 to overhaul federal agency patching requirements, prioritizing rapid remediation of the most dangerous vulnerabilities within three days. This shift reflect… Dark Reading · Jun 10, 2026 High patchingvulnerabilityai
supply-chain The ‘Miasma’ worm source code briefly leaked on GitHub The source code for the Miasma credential-stealing worm framework, previously linked to supply-chain attacks targeting open-source ecosystems, was briefly leaked on GitHub. This leak, mirroring the earlier Shai-Hulud wor… BleepingComputer · Jun 10, 2026 High USsupply chaincredential theftopen source
threat-intel Bug Bounty Research Triggers ServiceNow Security Alert ServiceNow experienced a situation where bug bounty research was mistakenly identified as a security breach targeting their customer instances. The issue involved unauthorized access to instance tables, but ServiceNow de… Dark Reading · Jun 10, 2026 Low AUbug bountyresearchsecurity
threat-intel CISA to require federal agencies to patch some cyber vulnerabilities within 3 days CISA has issued a new binding operational directive requiring federal civilian agencies to patch critical cybersecurity vulnerabilities within a tight 72-hour timeframe, prioritizing those exposed to the internet and sus… The Record · Jun 10, 2026 High USvulnerabilitypatchingai
supply-chain GitHub announces npm security changes to tackle supply-chain attacks GitHub has announced that npm v12, expected next month, will introduce several security-focused changes aimed at blocking supply-chain attacks abusing behaviors triggered by the 'npm install' command. BleepingComputer · Jun 10, 2026
threat-intel AI Risk Worries Insurers and Businesses Alike This article discusses the emerging need for insurance coverage related to the increasing adoption of Artificial Intelligence (AI) by businesses and the associated risks. Insurers are grappling with how to address potent… Dark Reading · Jun 10, 2026 Medium aiinsurancecybersecurity
threat-intel Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks The ShinyHunters extortion gang is targeting Oracle PeopleSoft servers in ongoing data theft attacks, having already compromised over 300 instances across more than 100 organizations. They are exploiting a chain of old a… BleepingComputer · Jun 10, 2026 High UKpeoplesoftzero-daydata theft
threat-intel Nightmare-Eclipse Drops Yet Another Microsoft Exploit, RoguePlanet A disgruntled researcher known as Nightmare-Eclipse has released another proof-of-concept (PoC) exploit, dubbed RoguePlanet, targeting a Windows Defender vulnerability. This follows a series of similar disclosures aimed… Dark Reading · Jun 10, 2026 High CVE-2026-33825USzero-dayexploitwindows
threat-intel China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance A China-linked botnet, dubbed JDY, has significantly expanded its operations, now comprising over 1,500 compromised SOHO and IoT devices. Initially a component of the KV-botnet, the JDY botnet is being used for large-sca… The Hacker News · Jun 10, 2026 High CVE-2026-35616USBRDEiotreconnaissancebotnet
Cyberattack shuts down major Australian sugar mills, disrupting harvest Australia's second-largest sugar producer said on Wednesday that it was responding to a cybersecurity incident affecting parts of its operations and had engaged cybersecurity experts and local authorities to investigate… The Record · Jun 10, 2026
vulnerability Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities This article reports on critical security vulnerabilities recently patched by Fortinet, Ivanti, and SAP. These vulnerabilities, including command injection and authentication bypass flaws, could allow unauthorized code e… The Hacker News · Jun 10, 2026 Critical CVE-2026-25089CVE-2026-10520CVE-2026-10523command injectionremote code executionauthentication bypass
vulnerability Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE A critical vulnerability, CVE-2026-5027, in the Langflow low-code platform has been actively exploited, allowing for remote code execution due to a lack of input sanitization. This flaw, combined with unauthenticated aut… The Hacker News · Jun 10, 2026 Critical CVE-2026-5027CVE-2026-0770CVE-2026-33017USCAlow-codeairemote code execution
threat-intel China-linked JDY botnet expands targeting of U.S. military networks A Chinese-linked botnet, JDY, has significantly expanded its targeting of U.S. military networks and associated infrastructure. The botnet, previously associated with Volt Typhoon, utilizes reconnaissance techniques like… BleepingComputer · Jun 10, 2026 High CVE-2026-35616USbotnetreconnaissanceapt
vulnerability CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation CISA has added three newly exploited vulnerabilities to its KEV catalog, impacting Cisco, Google Chrome, and Arista Networks. These vulnerabilities – one in Cisco SD-WAN Manager, another in Chrome’s V8 engine, and a thir… The Hacker News · Jun 10, 2026 High CVE-2026-20245CVE-2026-11645CVE-2026-7473cvesd-wanchrome
threat-intel The 5 Best Practices for Secure Identity Verification This article from BleepingComputer highlights key best practices for organizations to strengthen their identity verification processes and improve overall cyber resilience. It emphasizes the growing threat of credential… BleepingComputer · Jun 10, 2026 High UKmfaidentity verificationauthentication
threat-intel Who Runs the Ransomware Group ‘The Gentlemen?’ The Gentlemen, a prolific ransomware group, is being led by a Russian individual known as Zeta88/Hastalamuerte. Extensive investigation by Check Point and Intel 471 has revealed that this administrator, whose real identi… Krebs on Security · Jun 10, 2026 High RUransomwarerandsomware-as-a-servicerussian cybercrime
threat-intel Infostealers Turn Millions of Devices Into Credential Theft Machines This report details a significant increase in the use of infostealers as a primary method for attackers to steal credentials and gain unauthorized access to networks. Over 11.1 million devices were infected in 2025, resu… SecurityWeek · Jun 10, 2026 High IRinfostealerscredentialsmalware-as-a-service
Cyera Raises $600 Million at $12 Billion Valuation Cyera is positioned as one of the most valuable privately held cybersecurity firms in the world with total funding topping $2 billion. The post Cyera Raises $600 Million at $12 Billion Valuation appeared first on Securit… SecurityWeek · Jun 10, 2026
