Klue OAuth Breach Impacts Huntress, Recorded Future and Others
June 23, 2026
Klue’s OAuth breach enabled the Icarus threat group to extract Salesforce CRM data from cybersecurity companies including Huntress and Recorded
News
Klue OAuth Breach Impacts Huntress, Recorded Future and Others
Klue's OAuth breach enabled the Icarus threat group to extract Salesforce CRM data from cybersecurity companies including Huntress and Recorded Future.
Operation Endgame Dismantles SocGholish Botnet, Cleans 15K Sites
International law enforcement destroys 15K SocGholish-infected WordPress sites and 106 C2 servers in coordinated takedown of Evil Corp-linked cybercrime network.
ShapedPlugin Update System Compromised, Malicious WordPress Plugins Pushed to Customers
Attackers hijacked ShapedPlugin update distribution system to inject malicious code into legitimate plugin releases delivered directly to paying WordPress customers through official update channels.
F5 Patches Critical NGINX RCE in QUIC Module, CVSS 9.2 Use-After-Free Fixed
F5 emergency patches address CVE-2026-42530, a critical CVSS 9.2 unauthenticated RCE in NGINX QUIC HTTP3 module that can be exploited remotely without credentials on NGINX ...
Microsoft Details Windows Clipper USB LNK Worm with Tor Command-and-Control
Microsoft disclosed a Windows Clipper malware campaign active since February using clipboard interception, USB LNK self-spreading, and Tor command-and-control infrastructure to steal cryptocurrency addresses.
Check Point Documents Crypto Clipper Using Fake Reviews and AI Narrators
Check Point Research uncovered a crypto clipper distribution campaign using fake reviews on GitHub and SourceForge, AI-narrated YouTube videos, and fabricated VirusTotal comments to build ...
Microsoft Confirms RoguePlanet Defender Zero-Day EoP, Patch in Development
Microsoft confirmed CVE-2026-50656, a CVSS 7.8 elevation of privilege zero-day in Microsoft Defender Malware Protection Engine actively exploited by the Nightmare-Eclipse threat group.
Mastra AI npm Supply Chain Attack Hits 1.1M Weekly Downloads
Attackers hijacked a dormant npm contributor account and backdoored 144 Mastra AI packages, exposing 1.1 million weekly downloads to a RAT dropper payload.
15 JetBrains Plugins Steal AI API Keys in Eight-Month Campaign
Fifteen malicious JetBrains Marketplace plugins stole OpenAI, DeepSeek, and SiliconFlow API keys from 70,000 IDE users across an eight-month campaign.
ShinyHunters Claims 2.2 Million Kodak Records, Sets Leak Deadline
ShinyHunters claimed 2.2 million stolen Kodak records and set a publication deadline; Kodak confirmed a breach and engaged external cybersecurity experts.
Operation Endgame Dismantles SocGholish Botnet, Cleans 15K Sites
June 23, 2026
International law enforcement destroys 15K SocGholish-infected WordPress sites and 106 C2 servers in coordinated takedown of Evil Corp-linked cybercrime network.
ShapedPlugin Update System Compromised, Malicious WordPress Plugins Pushed to Customers
June 23, 2026
Attackers hijacked ShapedPlugin update distribution system to inject malicious code into legitimate plugin releases delivered directly to paying WordPress customers
F5 Patches Critical NGINX RCE in QUIC Module, CVSS 9.2 Use-After-Free Fixed
June 23, 2026
F5 emergency patches address CVE-2026-42530, a critical CVSS 9.2 unauthenticated RCE in NGINX QUIC HTTP3 module that can be exploited
Microsoft Details Windows Clipper USB LNK Worm with Tor Command-and-Control
June 23, 2026
Microsoft disclosed a Windows Clipper malware campaign active since February using clipboard interception, USB LNK self-spreading, and Tor command-and-control infrastructure
Check Point Documents Crypto Clipper Using Fake Reviews and AI Narrators
June 23, 2026
Check Point Research uncovered a crypto clipper distribution campaign using fake reviews on GitHub and SourceForge, AI-narrated YouTube videos, and
Microsoft Confirms RoguePlanet Defender Zero-Day EoP, Patch in Development
June 23, 2026
Microsoft confirmed CVE-2026-50656, a CVSS 7.8 elevation of privilege zero-day in Microsoft Defender Malware Protection Engine actively exploited by the
Mastra AI npm Supply Chain Attack Hits 1.1M Weekly Downloads
June 17, 2026
Attackers hijacked a dormant npm contributor account and backdoored 144 Mastra AI packages, exposing 1.1 million weekly downloads to a
15 JetBrains Plugins Steal AI API Keys in Eight-Month Campaign
June 17, 2026
Fifteen malicious JetBrains Marketplace plugins stole OpenAI, DeepSeek, and SiliconFlow API keys from 70,000 IDE users across an eight-month campaign.
ShinyHunters Claims 2.2 Million Kodak Records, Sets Leak Deadline
June 17, 2026
ShinyHunters claimed 2.2 million stolen Kodak records and set a publication deadline; Kodak confirmed a breach and engaged external cybersecurity
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.