Security Feed

1. Executive summary CISA added CVE-2025-67038 (CVSS 9.8 CRITICAL, CWE-94 Code Injection) to its Known Exploited Vulnerabilities (KEV) catalog on

1. Executive summary DarkReading reports a strategic shift by ransomware operators toward European targets, specifically EU organisations and their supply-chain suppliers, following a

1. Executive summary A new stealthy backdoor dubbed Mistic (also tracked as MLTBackdoor) has been deployed in financially motivated attacks against organisations in the

1. Executive summary On 2026-06-24, an attacker published malicious versions of 20 npm packages in the Leo Platform ecosystem in a coordinated

1. Executive summary Mandiant has published detailed attack-chain analysis of CVE-2026-20245 (CVSS 7.8 HIGH, CWE-116), a now-patched privilege-

1. Executive summary On 2026-06-24, Microsoft's Digital Crimes Unit (DCU), Europol, and industry partners (ESET, BitSight, MBSD, IBM X-Force,

1. Executive summary CrowdStrike has published analysis identifying a structural identity-management weakness in enterprise AI agent deployments: OAuth access tokens conforming to RFC

1. Executive summary On 2026-06-24, Microsoft's Digital Crimes Unit (DCU), Europol, and industry partners (Bitdefender, Bitsight, ESET, IBM X-Force,

1. Executive summary LastPass has disclosed that attackers exfiltrated customer personal information and customer support case records from its Salesforce environment after OAuth tokens

1. Executive summary On 2026-06-24, Microsoft's Digital Crimes Unit (DCU), working with Europol and industry partners, announced a coordinated disruption

1. Executive summary Kaspersky researchers identified a previously undocumented malware family, "SharkLoader," deployed by a threat cluster tracked as "StrikeShark"

1. Executive summary Threat actors are actively exploiting CVE-2026-20230, a high-severity server-side request forgery (SSRF) flaw in Cisco Unified Communications