Intelligence · Updated daily

Security Intelligence

AI-analysed threats, vulnerabilities and campaigns. Not just what happened — what it means, who's affected, and what to do about it.

RSS feedCVE index906 entries

Vulnerabilities Malware Campaigns Supply Chain Policy Tools

Page 8 of 37

176–200 of 906

highMalwareContained

Perplexity Impersonation Attack Exploited Chrome Web Store Trust to Intercept Search Queries

A malicious Chrome extension masquerading as the Perplexity AI search engine intercepted all user searches and address bar input, routing them through an attacker-controlled server before delivering results. Google removed the extension after Microsoft's responsible disclosure, but the attack demonstrates how supply chain compromises in browser extension marketplaces can enable large-scale data harvesting.

30 June 2026Google Chrome, Chrome Web Store, Perplexity (brand/reputation)

informationalPolicyResolved

U.S. Supreme Court mandates warrant requirement for geofence data, reshaping law enforcement digital surveillance

The U.S. Supreme Court ruled that police must obtain a warrant before accessing geofence location data from cellphones, extending Fourth Amendment protections to digital tracking. This represents a significant legal victory for privacy advocates and establishes new constraints on law enforcement digital surveillance practices.

30 June 2026Law enforcement agencies, Technology companies storing location data, Mobile carriers

highVulnerabilityActive

Oracle PeopleSoft zero-day exploitation at Nissan reveals enterprise HR system risk in supply-chain targeting

Nissan disclosed a data breach of current and former employee records following exploitation of an Oracle PeopleSoft zero-day vulnerability. The attack links to ShinyHunters, an extortion group known for targeting enterprise systems at scale.

30 June 2026Oracle PeopleSoft, Nissan

informationalToolResolved

YARA-X 1.18.0 and 1.19.0 Releases: Routine Maintenance Updates

YARA-X released versions 1.18.0 and 1.19.0 with three improvements and two bug fixes. This is standard maintenance on the widely-used open-source malware detection and classification tool.

29 June 2026YARA-X

highSupply ChainActive

KDDI Email Platform Compromise Cascades to Five ISP Partners, Exposing 14.2 Million Credentials

KDDI Corporation's compromised email system, shared infrastructure with five other Japanese ISPs, exposed up to 14.2 million email login credentials. The supply-chain nature of the breach amplifies risk across multiple telecommunications providers simultaneously.

29 June 2026KDDI Corporation, Five Japanese ISPs (unnamed in source)

informationalPolicyEmerging

OpenAI GPT-5.6 Tiered Release Strategy Reflects Shift Toward Regulated AI Deployment

OpenAI released three variants of GPT-5.6 (Sol, Terra, Luna) in limited preview to select companies under U.S. government coordination, signalling a controlled rollout approach for advanced AI models rather than broad public access.

28 June 2026OpenAI GPT-5.6

highSupply ChainActive

Systemic Vendor Risk in Education: Third-Party Breaches Expose Gaps in Supply Chain Defence

Educational institutions are experiencing recurring breaches via compromised third-party vendors, exposing student data to ransomware and other attacks. The sector lacks mature vendor risk management practices, creating a persistent attack surface that threat actors actively exploit.

28 June 2026Educational institutions globally

highCampaignActive

Legitimate DCloud Uni-App Toolkit Weaponised at Scale for Investment Fraud Infrastructure

Threat actors are repurposing DCloud's legitimate Uni-App cross-platform development toolkit to rapidly generate and deploy investment scam sites, with an estimated 200,000 instances already in operation. This represents a significant shift towards abusing benign developer tools for financial crime at scale.

28 June 2026DCloud Uni-App

criticalCampaignActive

Russian Intelligence Deploys Fake Support Messages to Harvest Ukrainian Official Credentials at Scale

Russian intelligence services conducted a sustained phishing campaign using fabricated support messages to compromise messaging accounts of Ukrainian government officials, military personnel, politicians, and activists across Europe and the US. The operation highlights a persistent state-level threat to high-value targets using social engineering rather than zero-days.

28 June 2026Messaging platforms (specific platforms not specified in source), Ukrainian government officials, Ukrainian military personnel +2

highSupply ChainEmerging

AI Coding Agents Tricked into Executing Malware via Obfuscated Repository Setup

Attackers can craft innocent-looking GitHub repositories that execute malicious payloads when cloned and set up by AI coding agents, evading detection by security scanners, AI analysis, and human review. This exploits the implicit trust placed in repository setup workflows.

28 June 2026GitHub, AI coding agents (Anthropic Claude, OpenAI, GitHub Copilot, others)

criticalVulnerabilityActive

MCP-Pinot Default Insecure Configuration Enables Unauthenticated Remote Tool Invocation

mcp-pinot shipped with OAuth disabled by default and bound to 0.0.0.0, allowing unauthenticated network attackers to invoke MCP tools and execute queries against downstream Pinot clusters using server credentials. This is a critical authentication bypass with CVSS 10.0.

CVE-2026-49257

27 June 2026startreedata/mcp-pinot

criticalVulnerabilityActive

Nezha WebSocket Stream Hijacking – Cross-Tenant RCE via Missing Ownership Validation

Nezha v1.14.13–v1.14.14 and v2.0.0–v2.0.9 fail to validate stream ownership on WebSocket endpoints, allowing any authenticated user to hijack terminal and file-manager sessions by guessing or obtaining a valid stream UUID, resulting in cross-tenant remote code execution.

27 June 2026nezhahq/nezha v1.14.13–v1.14.14, nezhahq/nezha v2.0.0–v2.0.9

informationalPolicyActive

SMB cyber readiness gap: disproportionate attack surface requires foundational resilience strategy

ESET highlights that small and medium-sized businesses face expansive attack surfaces despite their size, arguing that cyber readiness and resilience planning are foundational defensive requirements for this segment.

27 June 2026Small and medium-sized businesses

highVulnerabilityResolved

Amazon Q Credential Exfiltration via Repository Poisoning: AI Assistant Supply Chain Risk

Amazon Q contained a flaw allowing attackers to steal AWS credentials by poisoning code repositories that the AI assistant indexes and processes. The vulnerability has been patched, but highlights risks in AI-assisted development workflows where models ingest untrusted code.

27 June 2026Amazon Q

highMalwareActive

SharkLoader malware family targets diplomatic and government networks across Indo-Pacific region

A previously undocumented loader malware called SharkLoader has been observed in a campaign tracked as StrikeShark, delivering Cobalt Strike Beacon to diplomatic organisations in Indonesia and government networks in Taiwan. The campaign represents a targeted operation against sensitive government infrastructure using commodity post-exploitation tools.

27 June 2026Indonesian diplomatic organisations, Taiwan government organisations

informationalPolicyActive

Apple's removal of Russian VK services signals platform gatekeeping in geopolitical disputes

Apple removed VKontakte and related VK services from the App Store, likely in response to sanctions or content policy violations related to the Ukraine conflict. This exemplifies how platform providers enforce geopolitical positioning through app distribution controls.

27 June 2026Apple App Store, VKontakte, VK Music +4

highCampaignActive

Russian Intelligence Phishing Escalates: Signal Backup Keys Now Prime Target

Russian state-sponsored actors have evolved their Signal phishing campaign to exfiltrate Backup Recovery Keys, granting persistent access to message history and account takeover. The persistent validity of these keys creates an indefinite attack window.

27 June 2026Signal (encrypted messaging platform)

highVulnerabilityActive

Go SSH Known Hosts CA Revocation Bypass - Authentication Authentication Enforcement Gap

The golang.org/x/crypto SSH known_hosts library fails to validate revocation status of Certificate Authority signature keys, allowing attackers to authenticate using revoked CA credentials. Defenders must patch immediately as this bypasses a critical authentication control.

CVE-2026-42508

26 June 2026golang.org/x/crypto/ssh/knownhosts

highVulnerabilityActive

Go SSH Library Authorization Bypass via Callback Type Confusion

A regression in golang.org/x/crypto/ssh allows attackers to bypass source-address validation by invoking non-public-key callbacks, circumventing the CVE-2024-45337 fix. This enables unauthorized SSH access in misconfigured servers.

CVE-2026-46595

26 June 2026golang.org/x/crypto/ssh

informationalToolEmerging

Cisco Talos examines AI integration in threat intelligence for enhanced queryability

Cisco Talos explores how AI can transform threat intelligence operations by converting unstructured intelligence reports into easily queryable datasets, potentially improving detection speed and analyst efficiency.

26 June 2026

informationalPolicyResolved

Uber appoints security veteran Philip Martin as CISO following elevated threat landscape focus

Uber has appointed Philip Martin, a security leader with experience at Coinbase, Palantir, Amazon, and the U.S. Army, as Chief Information Security Officer. This leadership change signals Uber's commitment to strengthening its cybersecurity posture amid ongoing industry pressures.

26 June 2026Uber

highSupply ChainEmerging

Dormant Code Injection Flaw in YouTube Ad Blocker Extension Reveals Supply Chain Risk in Chrome Web Store

Adblock for YouTube, a Chrome extension with 10M+ installs and featured status on the Chrome Web Store, contains dormant arbitrary JavaScript execution capability. The presence of this injection mechanism raises questions about extension vetting processes and potential for malicious activation.

26 June 2026Google Chrome, Chrome Web Store, Adblock for YouTube (ID: cmedhionkhpnakcndndgjdbohmhepckk)

informationalPolicyEmerging

CISA Leadership Transition Signals Staffing Expansion Plans Amid Cybersecurity Workforce Pressures

The Department of Homeland Security has indicated the White House is progressing toward nominating a new CISA director, with plans to hire 600 additional staff once leadership is in place. This reflects organisational capacity constraints in federal cybersecurity operations.

26 June 2026

informationalToolEmerging

Anthropic Extends Claude Cowork to Mobile: Implications for Distributed AI Task Management

Anthropic is testing mobile support for Claude Cowork, enabling users to manage long-running AI tasks from smartphones. This represents a shift in how conversational AI assistants are deployed across device ecosystems.

26 June 2026Anthropic Claude Cowork

highVulnerabilityActive

OpenAM WebAuthn Deserialization RCE – Configuration-Dependent Pre-Auth Bypass

OpenAM's WebAuthn module deserializes untrusted Java objects from user-writable storage attributes, enabling pre-auth RCE if the storage backend becomes attacker-controllable. Defenders must audit attribute permissions and enforce server-managed storage isolation.

CVE-2026-45051

25 June 2026ForgeRock/OpenAM Community Edition ≤16.0.6