Top stories
Google's appeal against $4.7B EU antitrust fine dismissed by top court
The European Court of Justice upheld a €4.1 billion fine against Google for anti-competitive practices related to Android. This ruling confirms the EU's ongoing scrutiny of major tech firms and their market behaviors, impacting future regulatory actions.
FortiBleed Credential Theft Linked to Ransomware Operations
The FortiBleed campaign has been connected to INC and Lynx ransomware groups, revealing a significant breach affecting Fortinet devices. This connection indicates that stolen credentials from a large-scale operation facilitated numerous ransomware deployments, targeting sectors like manufacturing and technology globally.
CISA Adds Microsoft SharePoint RCE Vulnerability CVE-2026-45659 to KEV List
CISA added CVE-2026-45659, a high-severity remote code execution vulnerability in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog due to active exploitation. This flaw allows authenticated attackers to execute code without elevated privileges, impacting network security for federal agencies required to apply patches by July 4, 2026.
Blue Origin Probes New Glenn Rocket Explosion Amid Looming NASA Deadlines
The New Glenn rocket exploded on the launch pad at LC-36A in Florida, severely affecting Blue Origin's operations and plans. Investigations into the cause continue, with NASA relying on Blue Origin for critical Artemis Program missions. This incident has raised concerns about the timelines of upcoming NASA lunar missions.
Ongoing Azure CLI password spray attack compromises 78 Microsoft accounts
A password spray attack on Microsoft's Azure CLI has made over 81 million login attempts, compromising 78 accounts across 64 organizations. The attack utilizes a deprecated OAuth flow to bypass security policies, raising concerns over account protection measures.
FBI and CISA Warn of Russian Phishing Attacks on Signal and WhatsApp Accounts
The FBI and CISA have issued an updated warning about Russian intelligence phishing campaigns targeting Signal and WhatsApp accounts. Attackers are using Signal Backup Recovery Keys to hijack accounts, and the U.S. is offering a $10 million reward for information on the group responsible. The campaign has compromised thousands of accounts of high-profile targets, including government officials and journalists.
Amazon launches $1 billion AI-focused forward-deployed engineer organization
Amazon Web Services has established a new $1 billion internal organization for forward-deployed engineers (FDE) to assist companies in deploying AI solutions. This initiative aims to enhance customer self-sufficiency by embedding engineers within client companies for customized support during AI integration.
Apple Plans New iPad Pro and Entry-Level MacBook Pro Launches in 2024
Apple is reportedly preparing to release an entry-level MacBook Pro and new iPad Pro models in the first half of 2024. The MacBook Pro will align with upcoming touch screen models, while the iPad Pros will feature faster processors. As Apple transitions leadership and addresses supply chain issues, these updates focus on enhancing product capabilities.
Trump Administration Lifts Export Restrictions on Anthropic AI Models Mythos 5 and Fable 5
The US government lifted export restrictions on Anthropic's AI models, Mythos 5 and Fable 5, allowing global access. These restrictions were initially imposed due to security concerns after a jailbreak incident. The decision was influenced by Anthropic's collaboration with the government on safety measures, enhancing the AI models' cybersecurity protocol.
Sony to Halt Production of Physical PlayStation Game Discs by 2028
Sony announced it will cease production of physical PlayStation game discs by January 2028, transitioning to an all-digital gaming model. This decision reflects a growing consumer preference for digital purchases, as over 80% of PS4 and PS5 game sales are digital. However, the move raises concerns over game preservation and consumer rights.
Google DeepMind Launches Cost-Effective and Fast Image Model: Nano Banana 2 Lite
Google DeepMind has launched the Nano Banana 2 Lite, a cost-effective and speedy image-generation model under the Gemini 3.1 family. It generates images in about 4 seconds, with a production cost of $0.034 per 1,000 images, ideal for high-volume and rapid prototyping workflows. The Nano Banana 2 Lite offers nearly the same output quality as its non-Lite counterparts, though it struggles with small text and infographics.
Exploitation of Langflow RCE Vulnerability Targets AI Endpoints for Monero Mining and AI-Driven Ransomware Attacks
The Langflow remote code execution vulnerability (CVE-2026-33017) is actively exploited to deploy Monero miners and automate ransomware attacks using AI. The attacks highlight vulnerabilities in exposed AI applications and the evolving threat landscape, as AI agents can execute complex attacks independently.
New Android malware silently infects billions of devices via Google
A new Trojan horse malware disguised as 'Android Developer Verifier' has infected around 4 billion Android devices running version 8 or higher. It operates in the background with root privileges, preventing users from removing it and blocking access to software from unregistered developers.
Serious Flaw in Argo CD Repo-Server Allows Remote Code Execution
An unpatched flaw in Argo CD's repo-server allows unauthenticated attackers to execute code, potentially taking over Kubernetes clusters. Synacktiv, which discovered the issue, reports that the vulnerability remains unaddressed nearly 18 months after it was reported.
Google Announces AI Updates Including Gemma 4 12B and Android 17
In June 2026, Google unveiled significant AI advancements including the Gemma 4 12B model and Android 17. These developments aim to create a more integrated AI environment that enhances productivity across various fields by allowing AI assistance to function seamlessly on personal devices.
Cursor AI Code Editor Flaws Could Allow Command Execution via Prompt Injection
Two critical vulnerabilities in Cursor, tracked as CVE-2026-50548 and CVE-2026-50549, could enable command execution outside the editor's safety sandbox, affecting many Fortune 500 companies. The flaws, identified by Cato AI Labs and rated 9.8/10 in severity, can be exploited through prompt injection without user interaction, necessitating an immediate software update to the patched version 3.0.
Critical Vulnerability in Progress Kemp LoadMaster Enables Root Command Execution
A critical vulnerability (CVE-2026-8037) in Progress Kemp LoadMaster permits unauthenticated root command execution via API requests. Patches are released to mitigate the CVSS 9.8 flaw. Reports indicate active exploitation attempts, causing security concerns among users.
AI-Generated Ransomware Discovered Exploiting Chromium API on Windows and Android
A new ransomware artifact created by the AI model DeepSeek combines theoretical attacks with real browser functionality, enabling browser-based ransomware on Windows and Android. This marks the first identified practical attack chain of its kind, indicating a significant shift in the cybersecurity threat landscape.
Realta Fusion generates electricity from fusion reaction, marking industry milestone
Realta Fusion conducted an experiment demonstrating electricity generation directly from its fusion device, WHAM, which successfully powered a lightbulb. This marks the first time a private company has publicly achieved this, potentially advancing the profitability of fusion power through higher energy efficiency.
GuardFall Exploits Decades-Old Shell Injection Risks in AI Coding Agents
New research from Adversa AI reveals that the GuardFall vulnerability allows bypassing safety checks in AI coding agents. This poses risks of executing malicious shell commands with full account access across multiple popular open-source agents.
AirDrop and Quick Share Vulnerabilities Found, Affecting Millions of Devices
Researchers discovered six security flaws in Apple's AirDrop and Samsung's Quick Share, enabling attackers nearby to crash file-sharing services. Apple has already patched one of the identified vulnerabilities, but others remain under investigation, impacting potentially five billion devices globally.
Critical Flaw CVE-2026-46817 in Oracle E-Business Suite Exploited
A critical vulnerability in Oracle E-Business Suite, CVE-2026-46817, is now being actively exploited. Impacting versions 12.2.3 to 12.2.15, the flaw allows unauthenticated attackers to take control of Oracle Payments, necessitating immediate patching for affected instances.
South Korea invests $1T in memory chips and humanoid robots by 2028
South Korea plans to invest $1 trillion in memory chip production and humanoid robot deployment by 2028. This initiative aims to address global memory chip shortages and advance AI infrastructure amid rising demand.
Supreme Court Rules Government Requires Warrant for Geofence Warrants
The Supreme Court ruled that government access to a user’s location history requires a warrant. This ruling underscores the Fourth Amendment's protections for digital privacy, limiting law enforcement's ability to utilize geofence warrants without substantial proof of necessity.
Mustang Panda Exploits Zoho WorkDrive in Campaign Against Indian Government
The Mustang Panda group has launched campaigns targeting the Indian government, utilizing Zoho WorkDrive to transmit commands and steal data. This approach leverages legitimate service traffic to mask malicious activities and is part of broader espionage efforts aimed at India's hydropower initiatives and defense relations with Taiwan.
DirtyClone Vulnerability in Linux Kernel Allows Local Root Access Exploits
The DirtyClone vulnerability (CVE-2026-43503) affects the Linux kernel, allowing local users to gain root privileges using cloned network packets. This flaw poses significant security risks in environments like multi-tenant clouds and Kubernetes clusters. The patch was released, and users are advised to update their systems immediately.
Microsoft Removes 119 Malicious Edge Extensions Involved in Malware Operation
Microsoft has removed 119 Edge extensions from its Add-ons store that concealed malware within images and fonts, compromising user credentials and facilitating ad fraud. The extensions, installed by up to 2.6 million users, utilized steganography to hide malicious code, operating undetected for years.
Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw
A public proof-of-concept has been released for CVE-2026-55200, a critical flaw in libssh2 that may allow memory corruption and code execution for connected clients. This vulnerability affects all versions up to 1.11.1, posing significant risks as libssh2 is widely used in various applications and systems.
Hijacked npm and Go Packages Deploy Python Infostealer via VS Code Tasks
Cybersecurity researchers have identified hijacked npm and Go packages that deploy a Python-based infostealer on compromised systems. This method utilizes a concealed VS Code task to execute malware upon opening a project folder, facilitating data theft and persistent access.
China's LineShine crowned world's fastest supercomputer, surpassing El Capitan
China's supercomputer LineShine has become the fastest globally, reclaiming the title for the first time since 2018. This development is significant in light of ongoing US trade restrictions on high-powered computing components, highlighting China's ability to innovate despite challenges.
Tesla Settles FSD Crash Lawsuit Amid Ongoing Federal Investigation
Tesla has settled a lawsuit concerning a fatal crash involving its Full Self-Driving (FSD) system while federal investigations into the system's safety continue. The National Highway Traffic Safety Administration is examining if FSD can adequately handle low visibility conditions, after several incidents, potentially affecting future Tesla recalls or regulations.
Anonymous GitHub user releases unpublished zero-days for major software
An anonymous GitHub account has begun releasing previously undisclosed zero-day vulnerabilities in popular software, including Floci and FFmpeg. The account claims to utilize an AI-driven fuzzing workflow and intends to share serious vulnerabilities, impacting software security practices.
Russian hackers identified as responsible for $2.5B Jaguar Land Rover breach
A cyberattack on Jaguar Land Rover (JLR) last year has been traced to Russian hackers. The breach caused production delays and significant economic losses, prompting a £1.5 billion government bailout.
Linux pedit COW Exploit Allows Root Access via Cached Binary Poisoning
A critical flaw in the Linux kernel's traffic-control subsystem allows unprivileged users to gain root access on vulnerable systems. The exploit targets the memory cache of setuid binaries, enabling attackers to inject and execute malicious code while bypassing file integrity checks.
CISA Warns of Exploited Flaws in Lantronix EDS5000 and PTC Windchill
The CISA has issued alerts concerning the exploitation of critical vulnerabilities in Lantronix EDS5000 and PTC Windchill systems. The Lantronix flaw allows code execution with escalated privileges, while the Windchill vulnerability enables remote code execution. Both alerts urge immediate patching to mitigate risks posed by these active threats.
Miasma Malware Compromises npm Packages and GitHub Actions
Researchers identified a supply chain attack involving Miasma malware targeting multiple npm packages and GitHub Actions. The attack compromises developer credentials to propagate malware across various software ecosystems, posing significant security risks.
Anthropic accuses Alibaba of major cloning attack on Claude model
Anthropic has accused Alibaba of conducting the largest attack to clone its AI model, Claude, by illicitly generating over 28.8 million exchanges. This incident highlights increasing concerns about Chinese firms attempting to evade US AI development costs and the potential impact on US national security.
Popular Chrome Ad Blocker Can Execute Arbitrary JavaScript Code
The Chrome ad blocker 'Adblock for YouTube,' with over 10 million installs, has been found to contain functionality for executing arbitrary JavaScript code remotely. This could potentially allow for significant privacy risks, including data theft, although no malicious activity has been reported to date.
New Mistic Backdoor Discovered Linked to KongTuke in Cyber Attack Campaigns
A new backdoor named Mistic has emerged in attacks directed at various sectors, linked to the KongTuke group. The stealthy malware is designed for long-term access, employing sophisticated evasion techniques such as memory-based execution and DLL side-loading, marking a significant threat to targeted organizations.
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited for Root Access
A zero-day vulnerability in Cisco Catalyst SD-WAN, tracked as CVE-2026-20245, has been exploited to gain root access by an unknown threat actor. This flaw, identified by Mandiant, allows an authenticated attacker to execute commands by manipulating user input, raising serious security concerns for affected systems.