![Cybersecurity News | Daily Recap [20 Jun 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [20 Jun 2026]")
Daily Recap, Police and international partners disrupted a malware network tied to Russia’s Evil Corp, while Operation Endgame took down SocGholish servers and cleaned 14,971 compromised WordPress sites. Security teams also warned that The Gentlemen ransomware uses the GentleKiller EDR-killer framework to target 400 security processes before encryption. #EvilCorp #OperationEndgame #SocGholish #WordPress #TheGentlemen #GentleKiller #Texas #FortiBleed #Fortinet #Klue #Icarus #GravitySMTP #usbliter8 #SecureROM #AppleA12 #AppleA13 #AutoJack #Beats #Continuum
Threat Disruptions
- Police and international partners disrupted a malware network linked to Russia’s Evil Corp, while Operation Endgame also took down SocGholish servers and cleaned 14,971 compromised WordPress sites – Evil Corp Raid, Operation Endgame
- Security teams said The Gentlemen ransomware is using the GentleKiller EDR-killer framework to target 400 security processes, showing a push to disable defenses before encryption – GentleKiller
Data Breaches
- The Texas government breach exposed more than 3 million driver’s licenses, adding to a growing wave of sensitive identity-data leaks – Texas Breach
- FortiBleed reportedly compromised 86,000 Fortinet device credentials, raising concerns about large-scale exposure of enterprise access data – FortiBleed
- Klue said its OAuth breach victim list grew after the Icarus hackers claimed responsibility, indicating the incident may be broader than first reported – Klue Breach
Exploits & Vulnerabilities
- Attackers are exploiting an information disclosure flaw in the Gravity SMTP WordPress plugin, continuing the abuse of plugin bugs for site compromise – Gravity SMTP
- Researchers unveiled usbliter8, an unpatchable DFU-mode USB exploit that enables code execution in the SecureROM boot chain of Apple A12/A13 devices, affecting models like the iPhone XS, iPhone 11, Apple Watch Series 4/5, and HomePod mini – usbliter8 Exploit
- AutoJack showed how a single web page can hijack an AI agent and trigger host code execution, highlighting new risks in agentic browsing and automation – AutoJack
Policy & Oversight
- UK information commissioner resigned over alleged “inappropriate humour,” while Bulgaria was reported to have allowed a surveillance-tech firm to sell to repressive regimes, raising governance and ethics concerns – UK Commissioner, Bulgaria Surveillance
- In other news, Apple patched a Beats eavesdropping flaw, the DOT closed its Delta-CrowdStrike probe, and AWS highlighted Continuum developments – Security Roundup