Find what you’re looking for
Browse everything
6,903 results in Threat Reports
Djinn Stealer Exploits SimpleHelp Vulnerability CVE-2026-48558
In June 2026, attackers exploited CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp's OpenID Connect (OIDC) authentication flow, to gain unauthorized access to remote monitoring and management (RMM) systems. By submitting forged identity tokens, they obtained technician-level access without valid credentials, enabling them to deploy the Djinn Stealer malware across Windows, macOS, and Linux systems. Djinn Stealer targeted a wide range of sensitive information, including cloud service credentials, source control data, package registry credentials, AI development tools, and cryptocurrency wallets, posing significant risks to enterprise environments. This incident underscores the increasing focus of threat actors on exploiting vulnerabilities in trusted administrative tools to gain broad access to enterprise networks. The rapid exploitation of CVE-2026-48558 highlights the urgency for organizations to promptly apply security patches and implement robust monitoring to detect unauthorized access, especially in systems that manage critical infrastructure and sensitive data.
Critical Vulnerabilities in Indian Government Portals Expose Millions' Data
In April 2026, independent cybersecurity researcher Sushant Bhardwaj discovered 14 vulnerabilities within Indian government IT systems, including two critical and four high-severity issues. These vulnerabilities affected major national platforms, such as education and civil service portals, exposing sensitive personally identifiable information (PII) of millions of students and job applicants, including names, addresses, and bank account numbers. Notably, one critical flaw in the Union Public Service Commission (UPSC) portal allowed unauthorized access to administrative interfaces, potentially enabling full system takeover. The Indian government responded promptly, patching all identified vulnerabilities within two to three weeks. This incident underscores the persistent risks associated with inadequate access controls and outdated security practices in government systems. It highlights the necessity for continuous security assessments, robust access management, and prompt remediation to protect citizen data from unauthorized access and potential exploitation.
Oracle E-Business Suite Flaw CVE-2026-46817 Under Active Attack
In late June 2026, security researchers identified active exploitation of a critical vulnerability (CVE-2026-46817) in Oracle E-Business Suite's Payments module. This flaw, present in versions 12.2.3 through 12.2.15, allows unauthenticated attackers to remotely compromise the system via HTTP, potentially leading to full control over the affected instances. The vulnerability was initially disclosed in May 2026, with a CVSS score of 9.8, indicating severe risks to confidentiality, integrity, and availability. ([thehackernews.com](https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html?utm_source=openai)) The exploitation of CVE-2026-46817 underscores the persistent threat posed by unpatched vulnerabilities in critical business applications. Organizations relying on Oracle E-Business Suite are urged to apply the latest security patches promptly to mitigate potential breaches and safeguard sensitive financial data. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/?utm_source=openai))
Apple's June 2026 Security Updates: Addressing AI-Discovered WebKit Vulnerabilities
In June 2026, Apple released security updates for iOS, macOS, and Safari to address over 30 vulnerabilities, including four critical WebKit flaws discovered using AI tools like Anthropic Claude and OpenAI Codex. These vulnerabilities, such as CVE-2026-43707, involved memory corruption issues that could lead to unexpected crashes when processing malicious web content. Apple promptly addressed these issues with improved memory handling. ([thehackernews.com](https://thehackernews.com/2026/06/apple-patches-30-ios-macos-safari-flaws.html?utm_source=openai)) This incident underscores the growing role of AI in both identifying and potentially exploiting software vulnerabilities, highlighting the need for accelerated patch management and proactive security measures to mitigate emerging threats.
Critical Vulnerabilities in AirDrop and Quick Share Impact Billions
In June 2026, security researchers identified six vulnerabilities in Apple's AirDrop and Android's Quick Share, affecting over five billion devices. These flaws allow attackers within wireless range to crash file-sharing services or bypass security checks without user interaction. Specifically, three vulnerabilities in AirDrop can disable services like AirPlay and Handoff, while Quick Share flaws enable unauthorized session initiation and potential remote code execution. ([thehackernews.com](https://thehackernews.com/2026/06/airdrop-and-quick-share-flaws-let.html?utm_source=openai)) This discovery underscores the risks associated with proximity-based file-sharing protocols, highlighting the need for robust security measures in such widely used features. The incident has prompted vendors to expedite patches and reinforces the importance of regular software updates to mitigate emerging threats. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/30/apple-airdrop-google-samsung-quick-share-vulnerabilities/?utm_source=openai))
Critical Vulnerability in Progress Kemp LoadMaster: CVE-2026-8037
In June 2026, a critical vulnerability (CVE-2026-8037) was identified in Progress Kemp LoadMaster, an application delivery controller and load balancer. This flaw allows unauthenticated attackers to execute arbitrary commands as root by sending crafted requests to the API, due to improper input sanitization in the escape_quotes() function. The vulnerability affects LoadMaster GA v7.2.63.1 and earlier, and LTSF v7.2.54.17 and earlier. Progress released patches (GA v7.2.63.2 and LTSF v7.2.54.18) to address this issue. ([thehackernews.com](https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html?utm_source=openai)) The discovery of this vulnerability underscores the ongoing risks associated with API security and input validation flaws. Organizations are urged to promptly apply the provided patches and review their API security measures to prevent potential exploitation. ([thehackernews.com](https://thehackernews.com/2026/06/progress-kemp-loadmaster-flaw-could-let.html?utm_source=openai))
BioShocking Attack: A Wake-Up Call for AI Browser Security
In June 2026, security firm LayerX unveiled a novel attack technique named 'BioShocking,' which exploits AI-powered browsers and assistants to extract user credentials. By presenting a malicious webpage designed as a puzzle game, attackers manipulated AI agents into disregarding their safety protocols. The agents, including OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude browser extension, were deceived into accessing and transmitting sensitive information, such as SSH login credentials from users' GitHub repositories, to unauthorized parties. This method leverages indirect prompt injection, where malicious commands are embedded within seemingly benign content, leading AI agents to execute unauthorized actions without detection. ([thehackernews.com](https://thehackernews.com/2026/06/new-bioshocking-attack-tricks-ai.html?utm_source=openai)) The BioShocking attack underscores the pressing need for enhanced security measures in AI-driven applications. As AI browsers become more integrated into daily workflows, their potential to access and manipulate sensitive data grows, making them attractive targets for cybercriminals. This incident highlights the importance of implementing robust safeguards, such as explicit user confirmations before accessing logged-in accounts and setting strict boundaries on AI agent capabilities, to prevent similar exploits in the future. ([layerxsecurity.com](https://layerxsecurity.com/blog/bioshocking-ai-gaming-the-ai-browser-and-escaping-its-guardrails/?utm_source=openai))
Critical SimpleHelp Vulnerability (CVE-2026-48558) Exposes Systems to Unauthorized Access
In June 2026, a critical authentication bypass vulnerability, CVE-2026-48558, was identified in SimpleHelp versions 5.5.15 and earlier, as well as 6.0 pre-release versions. This flaw resides in the OpenID Connect (OIDC) authentication flow, where identity tokens are accepted without verifying their cryptographic signatures. Exploiting this vulnerability, remote unauthenticated attackers can forge tokens to gain full technician access, potentially bypassing multi-factor authentication and compromising managed endpoints. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/16/simplehelp-rmm-cve-2026-48558/?utm_source=openai)) The exploitation of CVE-2026-48558 underscores the escalating risks associated with remote monitoring and management (RMM) tools, which are increasingly targeted by cybercriminals. Organizations must prioritize the timely application of security patches and enhance monitoring of authentication mechanisms to mitigate such threats.
Critical SimpleHelp Vulnerability Exploited to Deploy TaskWeaver and Djinn Stealer
In June 2026, attackers exploited a critical authentication bypass vulnerability (CVE-2026-48558) in SimpleHelp's remote monitoring and management software. This flaw allowed unauthenticated attackers to create privileged technician sessions by submitting forged identity tokens. Leveraging this access, they deployed two new malware families: TaskWeaver, a heavily obfuscated Node.js loader, and Djinn Stealer, an information stealer targeting Windows, macOS, and Linux systems. Djinn Stealer harvested credentials from cloud platforms, source control systems, package registries, AI development tools, browsers, SSH, and cryptocurrency wallets. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/30/simplehelp-vulnerability-exploited-cve-2026-48558/?utm_source=openai)) The exploitation of CVE-2026-48558 underscores the increasing targeting of remote management tools by threat actors. This incident highlights the critical need for organizations to promptly apply security patches, especially for tools that provide extensive access to IT environments. The deployment of cross-platform malware like Djinn Stealer also reflects a trend towards more versatile and widespread credential theft campaigns.
Study Reveals 282 iOS AI Apps Exposing LLM API Credentials
In June 2026, researchers from Wake Forest University analyzed 444 AI-powered iOS applications and discovered that 282 of them (approximately 64%) exposed exploitable LLM API credentials through network traffic. The vulnerabilities were categorized into three main types: plaintext API key transmission (19%), unauthenticated backend proxy access (33%), and JWT-based token leakage (48%). These security lapses allowed unauthorized access to AI services, potentially leading to financial losses for developers and compromising user data. Notably, only 28% of the affected applications had addressed these issues three months after being notified. This incident underscores a systemic gap in secure integration practices within the iOS ecosystem, highlighting the urgent need for developers to implement robust security measures when integrating large language models into mobile applications. The prevalence of such vulnerabilities calls for enhanced developer awareness, explicit security guidance from AI service providers, and potential platform-level enforcement to mitigate risks associated with credential leakage.
GuardFall: Exposing Shell Injection Vulnerabilities in AI Coding Agents
In June 2026, Adversa AI disclosed a vulnerability named 'GuardFall' affecting ten out of eleven popular open-source AI coding agents. This flaw allows attackers to bypass safety checks using decades-old shell injection techniques, enabling the execution of malicious commands that can delete files or exfiltrate sensitive data such as SSH keys and cloud credentials. The vulnerability arises because these agents rely on blocklists that fail to account for how the Bash shell processes commands, leading to discrepancies between filtered and executed commands. ([thehackernews.com](https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html?utm_source=openai)) This incident underscores the persistent risks associated with AI coding agents, especially as they become more integrated into development workflows. The exploitation of longstanding shell injection methods highlights the need for robust security measures and continuous vigilance in the deployment of AI tools to prevent potential supply chain attacks.
Silent Swap Crypto Clipper: A New Threat to Cryptocurrency Security
In June 2026, cybersecurity researchers identified a malicious campaign named 'Silent Swap,' which targets cryptocurrency users through a fake 'Google Notes' browser extension. Delivered via unsigned .NET and Golang installers, this extension infiltrates Chromium-based browsers by modifying their settings to install itself without user consent. Once active, it monitors the system clipboard for cryptocurrency wallet addresses and replaces them with attacker-controlled addresses, leading to unauthorized fund transfers. The campaign employs advanced techniques like 'EtherHiding,' utilizing blockchain technology to dynamically update command-and-control servers, enhancing its resilience and evasion capabilities. This incident underscores a growing trend of sophisticated attacks leveraging trusted platforms and applications to distribute malware. The use of blockchain for command-and-control infrastructure highlights the evolving tactics of threat actors, making detection and mitigation more challenging. Organizations and individuals must remain vigilant, ensuring that browser extensions are sourced from reputable developers and regularly reviewing installed extensions for unauthorized additions.