Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, ransomware activity, and significant incidents to help you stay informed and proactive in the fast-evolving threat landscape.
1. Gentlemen Ransomware Deploys Sophisticated GentleKiller EDR Framework
Published: June 18-21, 2026
The Gentlemen RaaS operation equips affiliates with an advanced in-house EDR-killing toolkit called GentleKiller. This framework includes at least eight variants that abuse vulnerable or malicious drivers (BYOVD technique) to terminate over 400 processes across 48 security products, including CrowdStrike, SentinelOne, Microsoft Defender, and others. An internal data leak has provided deeper insights into the group’s operations.
2. Critical Unauthenticated RCE in Splunk Enterprise Under Active Exploitation
Published: June 10-19, 2026
Splunk disclosed CVE-2026-20253 (CVSS 9.8), a critical flaw in the PostgreSQL sidecar service endpoint allowing unauthenticated attackers to create or truncate arbitrary files, potentially leading to remote code execution. The vulnerability affects versions below 10.2.4 and 10.0.7 and is actively exploited. Organizations using Splunk for security operations should patch immediately.
3. INC Ransomware Emerges as a Major RaaS Threat with 830+ Victims
Published: June 18, 2026
INC (Incransom) has rapidly evolved into one of the most prolific ransomware groups in 2026, claiming over 830 victims since 2023. It ranked among the top groups in Q1 2026 and continues aggressive campaigns, often targeting sectors like healthcare and legal services with double-extortion tactics.
4. Klue SaaS Supply Chain Breach Leads to Salesforce Data Theft
Published: June 19, 2026
A breach at sales intelligence platform Klue resulted in the theft of Salesforce data. The incident highlights ongoing risks in SaaS supply chains and third-party integrations, with Huntress also reported as affected in related developments.
5. DragonForce Ransomware Abuses Microsoft Teams Relays for C2 Evasion
Published: June 18, 2026
Threat actors linked to DragonForce ransomware are using a custom Go-based RAT called Backdoor.Turn to hide command-and-control traffic within legitimate Microsoft Teams relay infrastructure. This technique complicates detection by blending malicious activity with trusted services.
6. Ongoing Exploitation of Oracle WebLogic and Other Enterprise Vulnerabilities
Published: Early June 2026 (ongoing)
A two-year-old patch for Oracle WebLogic is now actively exploited, exposing enterprise middleware. This fits into broader trends of vulnerability exploitation in widely used software platforms.
7. AI-Powered Tools and Phishing Kits Target Microsoft 365
Published: Mid-June 2026
Threat actors continue leveraging AI-built ransomware toolkits for EDR evasion and Active Directory discovery. Additionally, the Kali365 Phishing-as-a-Service kit is actively used to hijack Microsoft 365 sessions via device code phishing.
8. Rising Focus on Supply Chain and Third-Party Risks in 2026 Reports
Published: Ongoing analysis into June 2026
Global reports emphasize supply chain vulnerabilities and third-party risks as top concerns, with organizations accelerating post-quantum cryptography efforts and addressing AI-related security challenges amid increasing geopolitical tensions.
Stay Vigilant
Cyber threats continue to evolve with sophisticated evasion techniques, supply chain attacks, and rapid ransomware proliferation. Patch promptly, monitor third-party integrations, enforce least-privilege access, and maintain robust EDR solutions. Subscribe to our newsletter for daily/weekly updates, and consider implementing advanced threat hunting and zero-trust strategies to strengthen your defenses. Stay safe online!