threat-intel New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing A new attack method, dubbed FROST, allows websites to track which sites and apps a user opens by analyzing the timing of SSD reads. Developed by researchers at Graz University of Technology, FROST leverages the Origin Pr… The Hacker News · Jun 9, 2026 High DEopfsssdtiming attack
vulnerability Google patches new Chrome zero-day flaw exploited in the wild Google has released a security update to address a newly discovered and actively exploited zero-day vulnerability (CVE-2026-11645) within the Chrome browser. This flaw, originating in the V8 JavaScript engine, allows att… BleepingComputer · Jun 9, 2026 High CVE-2026-11645CVE-2024-0519CVE-2026-2441zero-daychromev8
threat-intel The Hardest Fork This article discusses a concerning trend in the open-source software ecosystem – the emergence of sophisticated, chained vulnerabilities, potentially driven by actors like Move 37. While the specific 'Mythos' model may… The Hacker News · Jun 8, 2026 High USCHopen sourcevulnerabilitysupply chain
other Hands on with Intelligent Terminal, an AI-powered Windows Terminal Microsoft has released Intelligent Terminal, an open-source extension for Windows Terminal that integrates AI assistance directly into the terminal environment. The tool leverages various AI models, such as GitHub Copilo… BleepingComputer · Jun 7, 2026 Low aiwindowsterminal
threat-intel AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs This article details a significant surge in vulnerability discovery, driven largely by autonomous AI agents. Depthfirst identified 21 zero-days in FFmpeg using their AI agent, while Google patched 429 bugs in Chrome 149,… The Hacker News · Jun 6, 2026 High CVE-2026-39210CVE-2026-39218CVE-2026-10881USaivulnerabilityzero-day
threat-intel Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories A security researcher discovered a flaw in Anthropic's Claude Code GitHub Action that allowed attackers to take over vulnerable public repositories by exploiting a permissive trigger check and prompt injection techniques… The Hacker News · Jun 4, 2026 High prompt-injectiongithub-actionsai-security
malware FlutterShell Backdoor Spreads to macOS via Malicious Google and YouTube Ads A new macOS malvertising campaign, dubbed Operation FlutterBridge, is utilizing FlutterShell, a backdoor that spreads adware via malicious Google and YouTube ads. The campaign, traced back to the CL-CRI-1089 threat actor… The Hacker News · Jun 4, 2026 High USCAAUmalvertisingmacoswebview
threat-intel Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover A coding error in several Microsoft 365 Android applications, specifically Excel, Word, PowerPoint, OneNote, Loop, and Microsoft 365 Copilot, exposed user accounts to potential compromise. The issue stemmed from a disabl… Dark Reading · Jun 3, 2026 High CVE-2026-41100CVE-2026-41101CVE-2026-41102authenticationtokensandroid
vulnerability Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag A vulnerability in Microsoft 365 Android apps allowed unauthorized apps to steal user account tokens, potentially granting access to sensitive data like emails and calendar information. The flaw, discovered by Enclave, s… The Hacker News · Jun 3, 2026 High CVE-2026-41100CVE-2026-41101CVE-2026-41102androidtokenspoofing
threat-intel Microsoft Tries to Calm Legal Threat Fears After Zero-Day Disclosure Backlash This article reports on a controversy between Microsoft and a security researcher, known as Nightmare Eclipse, regarding the disclosure of several zero-day vulnerabilities affecting Microsoft products. Microsoft initiall… SecurityWeek · Jun 3, 2026 High CVE-2026-41091CVE-2026-45498CVE-2026-33825USzero-dayvulnerability disclosurelegal action
malware Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content A new malware campaign, dubbed Weedhack, is targeting Minecraft players through YouTube and malicious websites, distributing a MaaS (Malware-as-a-Service) tool. The campaign, active since January 2026, utilizes SEO poiso… The Hacker News · Jun 3, 2026 High USDEINminecraftmalwareyoutube
threat-intel China Uses Dual-Method Cyberattack on Czech Orgs This article details a dual-method cyberattack targeting organizations in the Czech Republic and Taiwan, orchestrated by Chinese nation-state threat actors. The campaign, dubbed "Operation Dragon Weave," utilizes a spear… Dark Reading · Jun 2, 2026 High CZCNTWspear-phishingrustazure
threat-intel Securing AI Agents Before They Go Rogue Is Next to Impossible This article highlights the significant security challenges posed by high-autonomy AI agents, particularly those with broad permissions and access to sensitive data. Gartner research VP Dennis Xu warns that securing thes… Dark Reading · Jun 2, 2026 High aiagentsecurity
threat-intel Two New Reports Offer Competing Explanations for Cybersecurity’s Growing Crisis This SecurityWeek article examines the evolving cybersecurity crisis, highlighting a shift in focus from traditional vulnerability management to the challenges of rapid exploit development and runtime visibility. The rep… SecurityWeek · Jun 2, 2026 High airuntimepatching
threat-intel The Zero-Knowledge Threat Actor and the End of Responsible Disclosure This article discusses the rise of ‘zero-knowledge’ threat actors, empowered by AI, who pose a significant new challenge to cybersecurity. These actors, lacking deep technical expertise, can rapidly discover and exploit… SecurityWeek · Jun 2, 2026 High aivulnerabilityphishing
threat-intel AI-Driven Exploitation is Destroying Vulnerability Management. Here’s How to Handle It. This article discusses the accelerating pace of vulnerability exploitation driven by the use of AI by both attackers and defenders. The traditional approach of simply ‘patching faster’ is no longer sufficient due to the… The Hacker News · Jun 2, 2026 High INaivulnerabilityexploitation
threat-intel Anthropic to Open Mythos AI to EU's ENISA This article reports that Anthropic is granting access to its Mythos AI model to the European Union’s ENISA as part of the Project Glasswing initiative. Mythos, an AI model capable of autonomously discovering and exploit… Dark Reading · Jun 1, 2026 High EUUSaivulnerabilitycybersecurity
malware ChatGPT share links abused to host fake outage pages to deliver malware Threat actors are exploiting ChatGPT's content-sharing feature to host convincing fake outage pages designed to trick users into downloading malware. This 'LLMShare' campaign leverages Google ads and a legitimate OpenAI… BleepingComputer · May 29, 2026 High aimalwarephishing
threat-intel ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface A vulnerability, dubbed ChatGPhish, has been discovered in OpenAI’s ChatGPT that allows attackers to leverage the AI’s summarization feature to create phishing attacks. By appending malicious content to a webpage, attack… The Hacker News · May 29, 2026 High CVE-2026-25592CVE-2026-26030USprompt injectionphishingai
threat-intel Microsoft calls zero-day releases ‘never justifiable’ as researcher threatens to drop more Microsoft is responding to a weeks-long campaign by a pseudonymous researcher, ‘Nightmare Eclipse,’ who released uncoordinated zero-day vulnerabilities in Windows. The researcher, motivated by grievances against Microsof… The Record · May 29, 2026 High zero-dayvulnerabilitydisclosure
