1. Executive summary Kaspersky researchers identified a previously undocumented malware family, "SharkLoader," deployed by a threat cluster tracked as "StrikeShark" to deliver
1. Executive summary Threat actors are actively exploiting CVE-2026-20230, a high-severity server-side request forgery (SSRF) flaw in Cisco Unified Communications Manager (Unified
1. Executive summary A vulnerability in the flask_security.utils.validate_redirect_url() function allows an attacker to bypass redirect URL validation when subdomain matching is
1. Executive summary OpenClaw's ClawHub marketplace has been found hosting five malicious "skills" (agent plugins) that bypassed both VirusTotal and OpenClaw'
1. Executive summary SentinelLABS has disclosed a Rust-written macOS implant and infostealer, tracked as macOS.Gaslight, that combines conventional macOS tradecraft with a novel analyst-
1. Executive summary Market intelligence platform Klue disclosed on 19 June 2026 that an attacker obtained OAuth tokens used to connect Klue to customer Salesforce environments,
1. Executive summary A financially motivated, Russian-speaking initial access broker (IAB) — operating under the handle SantaAd per Palo Alto Networks Unit 42 — has been conducting
1. Executive summary A 29-year-old heap overread vulnerability in the Squid open-source caching proxy, tracked as CVE-2026-47729 and dubbed "Squidbleed,
1. Executive summary A new macOS ClickFix campaign uses fake CAPTCHA pages to trick users into pasting a Terminal command that silently downloads, mounts, and launches
1. Executive summary Law enforcement action against the SocGholish malware-as-a-service operation has been reported, drawing attention to the continued use of Traffic Distribution
1. Executive summary On 12 June 2026, LastPass was notified that market-intelligence platform Klue had suffered a security incident in which an attacker obtained OAuth
1. Executive summary A financially motivated, Russian-speaking initial access broker (IAB) has been conducting a large-scale credential-harvesting campaign — dubbed FortiBleed — against internet-exposed