Security Feed

1. Executive summary On 2026-06-24, Microsoft's Digital Crimes Unit (DCU), Europol, and industry partners (ESET, BitSight, MBSD, IBM X-Force,

1. Executive summary CrowdStrike has published analysis identifying a structural identity-management weakness in enterprise AI agent deployments: OAuth access tokens conforming to RFC

1. Executive summary On 2026-06-24, Microsoft's Digital Crimes Unit (DCU), Europol, and industry partners (Bitdefender, Bitsight, ESET, IBM X-Force,

1. Executive summary LastPass has disclosed that attackers exfiltrated customer personal information and customer support case records from its Salesforce environment after OAuth tokens

1. Executive summary On 2026-06-24, Microsoft's Digital Crimes Unit (DCU), working with Europol and industry partners, announced a coordinated disruption

1. Executive summary Kaspersky researchers identified a previously undocumented malware family, "SharkLoader," deployed by a threat cluster tracked as "StrikeShark"

1. Executive summary Threat actors are actively exploiting CVE-2026-20230, a high-severity server-side request forgery (SSRF) flaw in Cisco Unified Communications

1. Executive summary A vulnerability in the flask_security.utils.validate_redirect_url() function allows an attacker to bypass redirect URL validation when subdomain

1. Executive summary OpenClaw's ClawHub marketplace has been found hosting five malicious "skills" (agent plugins) that bypassed both VirusTotal and

1. Executive summary SentinelLABS has disclosed a Rust-written macOS implant and infostealer, tracked as macOS.Gaslight, that combines conventional macOS tradecraft with a

1. Executive summary Market intelligence platform Klue disclosed on 19 June 2026 that an attacker obtained OAuth tokens used to connect Klue to customer

1. Executive summary A financially motivated, Russian-speaking initial access broker (IAB) — operating under the handle SantaAd per Palo Alto Networks Unit 42 — has