Microsoft disclosed AutoJack, a chain of vulnerabilities in AutoGen Studio that could let a malicious webpage trick an AI agent into executing arbitrary commands on the host machine. The issue was fixed before any PyPI release, but developers who built AutoGen Studio from the main GitHub branch during a short window were exposed. #AutoJack #AutoGenStudio #Microsoft #MCP
Category: Cyber Security News
The Five Eyes intelligence alliance warns that advanced AI models with powerful cyber capabilities are only months away from broad public availability, accelerating both offensive and defensive threats. They urge governments and businesses to strengthen basic security practices now, or risk falling behind as models like Anthropic’s Fable 5, Mythos 5, and OpenAI’s Daybreak evolve rapidly. #FiveEyes #Anthropic #Fable5 #Mythos5 #OpenAI #Daybreak
Researchers uncovered REF8372, a campaign that uses malicious Google Ads and a fake Node.js site to distribute CastleStealer through the previously unreported loader OXLOADER. The operation appears financially motivated and likely Russian-speaking, while using obfuscation, anti-sandbox checks, and legitimate services like Storj to evade detection. #CastleStealer #OXLOADER #REF8372 #Storj #GoogleAds…
A heap over-read in Squid, dubbed Squidbleed (CVE-2026-47729), can leak another user’s cleartext HTTP requests, including credentials or session tokens, to any trusted client already allowed to use the same proxy. The issue traces back to a 1997 FTP-parsing change, affects Squid’s default configuration, and is fixed by a small parser…
Security researchers at Calif.io disclosed Squidbleed, a memory leak vulnerability in Squid Proxy tracked as CVE-2026-47729 that has existed since 1997. The flaw can expose uncleared HTTP request data, including credentials and session tokens, in shared proxy environments, and has been patched in Squid 8 and Squid 7.6. #SquidProxy #Squidbleed #CVE-2026-47729…
Microsoft says Sapphire Sleet, a North Korean state-sponsored group also known as BlueNoroff, is behind the Mastra supply chain attack that compromised 141 NPM packages and exposed users during a 45-minute publishing window on June 17. The attack used a typosquatted easy-day-js dependency and a malicious postinstall dropper to target Windows,…
Defiant warns that attackers are exploiting CVE-2026-4020 in the Gravity SMTP WordPress plugin to access full system reports from vulnerable sites. The exposed data can include server details, WordPress configuration, and sensitive API keys and tokens, so admins should update to Gravity SMTP 2.1.5 and rotate any exposed credentials. #GravitySMTP #CVE-2026-4020…
Ukraine has been granted access to the EU Cybersecurity Reserve, enabling it to request EU-approved experts for support during major cyberattacks and recovery operations. The move deepens Ukraine’s cyber defense cooperation with the EU amid ongoing Russian cyber threats and strengthens its path toward closer integration with the bloc. #Ukraine #EUCybersecurityReserve…
INTERPOL reports a dramatic rise in cybercrime across Asia and the South Pacific, driven by phishing, ransomware, AI-enabled scams, and organized criminal networks exploiting uneven cybersecurity maturity. The report highlights major losses from scam centers, deepfake-enabled fraud, and widespread attacks on sectors such as real estate, manufacturing, and financial services. #INTERPOL…
The Texas Parks and Wildlife Department disclosed a data breach tied to a third-party vendor that may have exposed information on more than 3 million hunting and fishing license customers. The stolen data may include email and physical addresses, phone numbers, driver’s license details, and passport numbers, while Social Security numbers,…
![Cybersecurity News | Daily Recap [20 Jun 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [20 Jun 2026]")
Daily Recap, Police and international partners disrupted a malware network tied to Russia’s Evil Corp, while Operation Endgame took down SocGholish servers and cleaned 14,971 compromised WordPress sites. Security teams also warned that The Gentlemen ransomware uses the GentleKiller EDR-killer framework to target 400 security processes before encryption. #EvilCorp #OperationEndgame #SocGholish #WordPress #TheGentlemen #GentleKiller #Texas #FortiBleed #Fortinet #Klue #Icarus #GravitySMTP #usbliter8 #SecureROM #AppleA12 #AppleA13 #AutoJack #Beats #Continuum
AryStinger is a previously undocumented botnet that has compromised more than 4,000 outdated routers, turning them into proxies for malicious traffic and distributed scanning. It targets older D-Link routers and some NAS systems, with infections concentrated in South Korea and China, while researchers have not yet linked it to a known threat actor. #AryStinger #DLinkDIR850L #DLinkDIR818LW #AVrecon #XLab
FortiBleed exposed 75,000 compromised Fortinet firewalls and showed how attackers rented Vast.ai GPU clusters to crack passwords at industrial scale using Hashtopolis and Telegram-managed infrastructure. The campaign highlights how compromised edge devices, infostealer logs, and cracked credentials can enable lateral movement into vendors, MSPs, and internal networks. #FortiBleed #Fortinet #VastAI #Hashtopolis #Cursor #Telegram #SantaAd #Infostealer
Daily Recap, Security teams are being urged to treat every AI agent as a distinct identity and to keep pace with fast-moving threat patterns, including AI-generated deepfakes scrutiny and related harassment charges involving AI-made nude images. On the vulnerability and incident front, CISA warned of an actively exploited Splunk Enterprise flaw, enforcement disrupted the SocGholish botnet by cleaning nearly 15,000 WordPress sites tied to Evil Corp, and Fortinet users were advised to secure devices after the FortiBleed leak.
#AI #AI agent #No FAKES Act #Deepfakes #Splunk Enterprise #CISA #NGINX #REDCap #Recycle Bin #SocGholish #Evil Corp #WordPress #Gentlemen #CryptoBandits #NastyC2 #Claude #NIM #FortiBleed #Fortinet #WideField Security #Splunk #Nintendo #WebMD #Microsoft 365 #MFA #M365 Backup
Threat actors are actively exploiting CVE-2026-4020 in Gravity SMTP, a WordPress plugin used on about 100,000 sites, to steal sensitive configuration data, API keys, secrets, and OAuth tokens. Wordfence has blocked over 17 million attempts, and site owners should update to version 2.1.5 and rotate exposed credentials immediately. #GravitySMTP #CVE-2026-4020 #Wordfence…