Stay updated with the latest cybersecurity developments! This daily roundup highlights critical vulnerabilities, active exploits, ransomware incidents, malware campaigns, and emerging threats to help you navigate the fast-evolving threat landscape.
1. CISA Warns of Actively Exploited Critical Lantronix EDS5000 Flaw (CVE-2025-67038)
Published: June 24, 2026
CISA has added a critical code injection vulnerability in Lantronix EDS5000 Series devices to its Known Exploited Vulnerabilities catalog. The flaw (CVSS 9.8) allows unauthenticated attackers to execute arbitrary commands with root privileges via unsanitized username input in the HTTP RPC module. Federal agencies must patch by June 26.
Read more (or search CISA KEV)
2. Cisco Catalyst SD-WAN Zero-Day (CVE-2026-20245) Exploited for Root Access
Published: June 25, 2026
Mandiant detailed how threat actors exploited a high-severity Cisco SD-WAN flaw as a zero-day months before disclosure, gaining root access through crafted files and anti-forensic techniques. Patches are available; organizations should review logs for rogue accounts.
3. 25-Year-Old cURL Vulnerability Patched, Affecting ~30 Billion Devices
Published: June 25, 2026
A long-standing critical flaw in cURL (widely used across devices and software) was finally addressed in a major security release. The vulnerability could enable remote code execution or other impacts in affected implementations.
4. Gaslight macOS Malware Uses Prompt Injection to Evade AI Analysis
Published: June 25, 2026
North Korea-linked actors deployed a Rust-based “Gaslight” implant that embeds prompt injections and fake errors to disrupt LLM-assisted malware analysis. It features Telegram C2 for interactive shells and data theft.
5. Amadey and StealC Malware Infrastructure Disrupted in Operation Endgame
Published: June 24, 2026
International law enforcement, with Microsoft, Bitdefender, and others, took down servers and domains powering Amadey and StealC loaders. Nearly 27 million stolen credentials were recovered as part of broader efforts against ransomware enablers.
6. Cordyceps CI/CD Flaws Expose 300+ GitHub Repos to Supply-Chain Attacks
Published: June 24, 2026
Researchers identified exploitable weaknesses in GitHub workflows allowing unauthenticated attackers to hijack repositories at major orgs (Microsoft, Google, etc.). Over 300 high-impact repos were found vulnerable.
7. Bajaj Auto Hit by Ransomware; Tata Electronics Confirms Cyber Incident
Published: Recent (June 2026)
India’s Bajaj Auto suffered a ransomware attack disrupting systems. Separately, Tata Electronics confirmed a breach with leaked data potentially linked to Apple/Tesla designs.
[Read more](https://www.reuters.com/ or cybersecuritynews.com)
8. New Mistic Backdoor Linked to KongTuke in ClickFix Campaigns
Published: June 25, 2026
A stealthy Mistic (MLTBackdoor) backdoor, tied to initial access broker KongTuke, deploys filelessly alongside ModeloRAT. It targets sectors like insurance and education with low-visibility persistence.
9. Malicious Browser Extensions and Phishing Kits Evolve (Bonus)
Published: June 24-25, 2026
Reports highlight Edge/Chrome extensions abusing Native Messaging for malware delivery, Bluekit phishing kit enhancements, and Shop app abuse for callback phishing.
Stay Vigilant
Cyber threats continue to accelerate with AI assistance, shrinking exploit windows, and sophisticated evasion techniques. Prioritize patching (especially CISA KEV items), monitor for anomalous activity, enforce least privilege, and train staff against social engineering. Consider multi-layered defenses including EDR, network segmentation, and regular backups.
Subscribe for daily/weekly updates, and implement tools for vulnerability management and threat intelligence. Stay safe!