Find what you’re looking for
Browse everything
6,903 results in Threat Reports
Apple's June 2026 Security Updates: Over 25 Vulnerabilities Patched
In June 2026, Apple released security updates for iOS/iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2, addressing over 25 vulnerabilities. The majority of these issues were found in WebKit and related web technologies, potentially leading to crashes, memory corruption, or data disclosure. Additionally, vulnerabilities in the kernel and IOGPUFamily were patched. Notably, Apple expedited these updates in response to concerns about AI-assisted hacking tools, aiming to reduce the window between vulnerability disclosure and patch deployment. ([macrumors.com](https://www.macrumors.com/2026/06/29/apple-ios-26-5-2-early-release/?utm_source=openai)) This proactive approach underscores the growing threat posed by AI-enhanced cyberattacks, highlighting the necessity for organizations to adopt agile security practices and promptly apply software updates to mitigate emerging risks.
Malicious Chromium Extension Exploits AI Branding for Search Hijacking
In June 2026, a malicious Chromium-based browser extension impersonating the AI-powered search engine Perplexity AI was discovered. This extension intercepted user search queries and real-time suggestions, routing them through attacker-controlled infrastructure before redirecting to legitimate search providers. The primary objective appeared to be data collection for potential misuse, such as profiling or targeted advertising. Microsoft Threat Intelligence reported the extension to Google, leading to its removal from the Chrome Web Store. This incident underscores the evolving tactics of threat actors leveraging AI-related branding to enhance the credibility of their malicious tools. The use of legitimate APIs and advanced permissions highlights the need for heightened vigilance and robust security measures to protect against sophisticated browser-based threats.
GitHub Advisory Database Overwhelmed by Record Vulnerability Reports
In May 2026, the GitHub Advisory Database published 1,560 reviewed advisories, marking a fivefold increase over its typical monthly output and the highest in its history. This surge reflects a structural change in the vulnerability disclosure ecosystem, with private vulnerability reports escalating from approximately 550 per week in January to over 3,000 per week by May. Repository advisories and CVE requests have similarly increased, leading to extended review times and a backlog in processing new advisories. ([github.blog](https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/?utm_source=openai)) The unprecedented volume of vulnerability reports underscores the need for enhanced coordination among researchers, maintainers, and security teams. It also highlights the importance of submitting complete and accurate vulnerability data to expedite the review process. As the ecosystem adapts to this new scale, stakeholders must collaborate to maintain the quality and timeliness of advisory publications. ([github.blog](https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/?utm_source=openai))
Discovery of 'Short-Sleeve' RSA Keys Poses Significant Security Risk
In June 2026, researchers from Trail of Bits and the badkeys project identified a critical vulnerability in RSA keys characterized by patterns of zeros, termed "short-sleeve" RSA keys. These keys, found in public sources like Certificate Transparency logs and SSH hosts, were associated with major organizations such as Yahoo and Verizon, as well as devices running NetApp software and CompleteFTP software from EnterpriseDT. The vulnerability, stemming from improper key generation processes, allows attackers to factor the public modulus and derive private keys, compromising encrypted communications and data integrity. ([blog.trailofbits.com](https://blog.trailofbits.com/2026/06/12/factoring-short-sleeve-rsa-keys-with-polynomials/?utm_source=openai)) This discovery underscores the persistent risks associated with flawed cryptographic implementations. Organizations must prioritize regular audits of cryptographic keys and ensure adherence to secure key generation practices to mitigate potential breaches.
Black Basta Ransomware Group: A Comprehensive Analysis of Its Rise and Fall
Black Basta, a ransomware-as-a-service (RaaS) group, emerged in April 2022 and rapidly became a significant threat by employing double extortion tactics—encrypting victims' data and exfiltrating sensitive information to pressure organizations into paying ransoms. The group targeted over 500 organizations worldwide across various critical infrastructure sectors, including healthcare, finance, and manufacturing. Their operations involved sophisticated social engineering techniques, exploitation of known vulnerabilities, and partnerships with malware distributors like QakBot to gain initial access. In 2025, internal conflicts and law enforcement actions led to a decline in Black Basta's activities, culminating in the group's shutdown. ([techrepublic.com](https://www.techrepublic.com/article/black-basta-ransomware-attack/?utm_source=openai)) The Black Basta case underscores the evolving nature of ransomware threats, highlighting the importance of robust cybersecurity measures and proactive threat intelligence to defend against sophisticated cybercriminal operations. The group's rapid rise and eventual downfall illustrate the dynamic landscape of cyber threats and the necessity for organizations to remain vigilant and adaptable.
KDDI Data Breach Exposes 14.2 Million Email Logins Across Six ISPs
In June 2026, KDDI Corporation, a major Japanese telecommunications operator, disclosed a data breach affecting its email systems used by six internet service providers (ISPs). The breach, discovered on June 17, resulted from attackers exploiting a vulnerability in third-party software, potentially exposing up to 14.2 million email addresses and passwords. The affected ISPs include STNet, JCOM, Chubu Telecommunications, NIFTY, BIGLOBE, and KDDI Web Communications. KDDI promptly blocked the attacker and implemented defensive measures upon detection. This incident underscores the critical importance of securing third-party software components within shared infrastructure environments. As cyber threats continue to evolve, organizations must rigorously assess and monitor the security of all integrated software solutions to prevent similar breaches.
Urgent Alert: Oracle E-Business Suite Vulnerability Under Active Exploitation
In late June 2026, threat intelligence firm Defused reported active exploitation of a critical vulnerability (CVE-2026-46817) in Oracle E-Business Suite's Payments component. This flaw, present in versions 12.2.3 through 12.2.15, allows unauthenticated attackers with HTTP access to execute remote code, potentially leading to full system compromise. Oracle had addressed this issue in their May 2026 Critical Security Patch Update, urging immediate patching. Despite this, numerous unpatched systems remain exposed, with over 450 Oracle EBS instances accessible online, nearly 200 of which are in the United States and Europe. The active exploitation of CVE-2026-46817 underscores the critical importance of timely patch management. Organizations using Oracle E-Business Suite must prioritize applying the latest security updates to mitigate this severe risk. Additionally, this incident highlights the broader trend of attackers targeting unpatched enterprise applications, emphasizing the need for robust vulnerability management practices.
U.S. Offers $10 Million Reward for Information on Russian Hackers Targeting Encrypted Messaging Apps
In June 2026, the U.S. Department of State announced a reward of up to $10 million for information leading to the identification or location of members of the Russian-linked cyber groups UNC5792 and UNC4221. These groups have been implicated in extensive phishing campaigns targeting Signal and WhatsApp accounts of U.S. government officials, military leaders, and allied personnel. The attackers employed social engineering tactics, impersonating support agents to deceive users into revealing their backup recovery keys, thereby gaining access to their encrypted communications. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/us-offers-10-million-for-hackers-targeting-whatsapp-signal-users/?utm_source=openai)) This incident underscores the evolving nature of cyber threats, particularly the sophisticated use of social engineering to bypass encryption safeguards. It highlights the critical need for heightened vigilance and robust security protocols to protect sensitive communications, especially for individuals in positions of authority or influence.
Nissan Employee Data Breach Exposes Sensitive Information via Oracle PeopleSoft Exploit
In June 2026, Nissan disclosed a data breach affecting current and former employees across the United States, Canada, Mexico, and Brazil. The breach occurred between May 27 and June 9, 2026, when threat actors exploited a zero-day vulnerability (CVE-2026-35273) in Oracle's PeopleSoft software, which Nissan uses to manage employee information. The attackers, identified as the ShinyHunters extortion group, accessed sensitive personal data, including contact details, banking information, Social Security numbers, and tax information. Nissan promptly activated its incident response plan, engaged external cybersecurity experts, secured affected systems, and is collaborating with Oracle to address the issue. The company is offering free credit and dark web monitoring services to affected individuals and has implemented additional security measures to prevent further unauthorized access. This incident underscores the critical importance of promptly addressing software vulnerabilities and implementing robust security measures to protect sensitive employee data. The exploitation of a zero-day vulnerability by a known threat actor highlights the evolving tactics of cybercriminals and the necessity for organizations to remain vigilant and proactive in their cybersecurity efforts.
NAIC's 2026 Data Breach: A ShinyHunters Exploit of Oracle PeopleSoft
In June 2026, the National Association of Insurance Commissioners (NAIC) experienced a cyberattack by the ShinyHunters group, who exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft servers. The attackers claimed to have stolen 3.1 TB of data, including insurer regulatory filings and AWS infrastructure configurations. NAIC's investigation indicated that only publicly available data, outdated logs, and configuration files were accessed, with no evidence of personal or financial data exposure. The breach led to operational disruptions, such as temporary suspension of data feeds by credit rating agencies and a pause in NAIC's investment designation work. This incident underscores the critical importance of promptly addressing zero-day vulnerabilities and implementing robust security measures to protect sensitive data. Organizations must remain vigilant against sophisticated threat actors like ShinyHunters, who continue to exploit unpatched systems, emphasizing the need for proactive cybersecurity strategies and timely software updates.
Mustang Panda's Exploitation of Zoho WorkDrive in Indian Government Cyberattacks
In June 2026, the China-aligned cyber espionage group Mustang Panda launched two concurrent campaigns targeting Indian government entities and the hydropower sector. Utilizing spear-phishing emails with thematic lures, the attackers delivered ZIP archives containing SHARDLOADER, a malicious loader that deployed two new implants: MINIRECON and ZOHOMURK. Notably, ZOHOMURK exploited Zoho WorkDrive, a legitimate cloud storage service, for command-and-control operations, enabling data exfiltration and remote task execution while evading detection by blending with normal network traffic. This incident underscores the evolving tactics of state-sponsored threat actors who increasingly abuse trusted cloud services to conceal malicious activities. Organizations, especially those in critical infrastructure sectors, must enhance their security measures to detect and mitigate such sophisticated threats.
Malicious Perplexity Chrome Extension Compromises User Data
In June 2026, Microsoft identified a malicious Chrome extension named "Search for perplexity ai" that impersonated the AI search engine Perplexity. This extension intercepted users' search queries and address bar inputs, routing them through an attacker-controlled server before redirecting to legitimate search results. The extension set itself as the default search engine upon installation, capturing every character typed into the address bar and transmitting this data, along with browser headers, IP addresses, and user agents, to the attacker's server. Microsoft reported the extension to Google, leading to its removal from the Chrome Web Store. ([thehackernews.com](https://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.html?utm_source=openai)) This incident underscores a growing trend of malicious browser extensions exploiting the popularity of AI tools to harvest sensitive user data. Similar campaigns have targeted users by masquerading as AI assistants, leading to significant data breaches. Organizations must remain vigilant, implementing strict policies on browser extensions and educating users about the risks associated with unverified add-ons. ([techradar.com](https://www.techradar.com/pro/security/fake-chrome-ai-extensions-targeted-over-300-000-users-to-steal-emails-personal-data-and-more?utm_source=openai))