Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, data breaches, arrests, and patches to help you navigate the rapidly evolving digital threat landscape.
1. FBI Warns Russian Intelligence Hackers Targeting Signal Backup Recovery Keys
Published: June 26, 2026
Russian intelligence-linked actors (including UNC5792 and UNC4221) have evolved phishing campaigns against Signal users, now tricking targets into sharing backup recovery keys. This allows full account takeover, access to message history, and persistent access even after new account creation. The FBI and CISA recommend generating a new key immediately to invalidate stolen ones.
2. New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Campaign
Published: June 26, 2026
Kaspersky identified a new loader malware, SharkLoader, used in the StrikeShark campaign targeting diplomatic, government, and software development entities across Indonesia, Taiwan, Hong Kong, and other regions. It deploys Cobalt Strike Beacon alongside open-source tools like FScan. The campaign shows broad geographic reach without clear ties to known groups.
3. Chinese-Speaking APT Deploys TinyRCT Backdoor in Southeast Asia
Published: June 26, 2026
Unit 42 linked CL-STA-1062 (overlaps with UAT-7237) to attacks on government and energy sector entities in Southeast Asia using the custom TinyRCT backdoor. The group employs hybrid toolkits including open-source tools and has been active since at least 2022.
4. Critical Linux Kernel Vulnerabilities: pedit COW and DirtyClone Enable Root Access
Published: June 26, 2026
Two new Linux flaws emerged: CVE-2026-46331 (pedit COW) allows out-of-bounds writes to poison cached setuid binaries for root access. CVE-2026-43503 (DirtyClone) enables similar privilege escalation via cloned network packets. Public exploits are available—update kernels immediately.
5. Amazon Q Developer Flaw (CVE-2026-12957) Allows Malicious Repo Code Execution
Published: June 26, 2026
A high-severity vulnerability in Amazon Q Developer (CVSS 8.5) lets malicious repositories execute commands and steal AWS credentials via MCP config files. Patched by Amazon; developers should review workspace trust settings.
6. CISA Adds Exploited PTC Windchill RCE to KEV Catalog
Published: June 26, 2026
CISA flagged CVE-2026-12569 (CVSS 9.3), an RCE in PTC Windchill PDM/PLM software, as actively exploited. Patches were issued, but web shell attacks continue. Federal agencies and users must prioritize remediation.
7. Polymarket Supply-Chain Attack Results in $3M Customer Losses
Published: June 26, 2026
Hackers injected a malicious script into Polymarket’s frontend via a third-party vendor breach, leading to approximately $3 million in losses. The platform plans full customer reimbursement.
8. CISA Issues Urgent Deadline for Actively Exploited Cisco Flaw
Published: June 26, 2026
CISA directed federal agencies to patch a critical Cisco Unified Communications Manager Server vulnerability by Sunday due to active exploitation. Additional reports highlight ongoing zero-day activity in Cisco SD-WAN.
Stay Vigilant
Cyber threats, especially AI-assisted attacks, supply chain compromises, and state-sponsored espionage, continue to accelerate. Patch promptly, enable multi-factor authentication (especially for messaging apps), monitor for anomalous activity, and review third-party vendor security. Subscribe to our newsletter for daily/weekly updates, and consider implementing robust tools for vulnerability management and threat detection. Stay safe online!