The Cisco Unified CM flaw CVE-2026-20230 lets unauthenticated attackers use the WebDialer service to write files and gain root access. Active attacks confirmed on June 24, 2026. Patch to version 14SU6 or disable WebDialer immediately.

The curl flaw CVE-2026-8932 hid in libcurl connection reuse logic for more than 25 years. Patched in curl 8.21.0, the issue involves incomplete mTLS configuration matching and can cause unsafe connection reuse. Organizations should update libcurl, rebuild bundled applications, and verify software supply chain exposure.

A critical python.org vulnerability in the release management API allowed forged admin-level requests using a valid admin username and arbitrary API key. Python patched the flaw quickly, found no evidence of exploitation, and added URL validation, HTTPS enforcement, negative authentication tests, and longer log retention.

Russia-linked Turla uses compromised infrastructure to deliver STOCKSTAY, a .NET backdoor targeting Ukrainian government and military organizations and entities linked to Italian foreign policy interests. The campaign uses malicious RDP files, archive exploits, modular malware, WordPress staging, and encrypted WebSocket communication.

Multiple wolfSSL vulnerabilities expose billions of devices to certificate validation risk. The most serious flaw, CVE-2026-5194, affects hash digest and OID checks in wolfSSL certificate verification. Update to wolfSSL 5.9.1 now.

Windows drivers kill AV and EDR through BYOVD attacks before ransomware hits. Attackers load signed vulnerable drivers, terminate security processes from kernel mode, and deploy ransomware into a blind environment. Defenders need driver blocklists, HVCI, WDAC, and network-layer detection.

JADEPUFFER agentic ransomware used an LLM agent to breach Langflow, harvest credentials, and destroy Nacos data in minutes. Full attack chain and defense guide.

TeamPCP hackers are hijacking developer tools and CI/CD pipelines to steal cloud tokens, SSH keys, Kubernetes secrets, and package credentials. The FBI TeamPCP alert confirms the group’s TTPs and IOCs, while public research shows repeated compromise across Trivy, KICS, LiteLLM, Bitwarden CLI, and related developer tooling.

A Microsoft Edge flaw chain involving CVE-2026-45492, CVE-2026-45494, and CVE-2026-45495 creates remote code execution risk through crafted web content.

Chrome update fixes 27 security flaws, including five Critical vulnerabilities across Core, DigitalCredentials, Accessibility, GPU, and WebMIDI.

Cavern Manticore targets Israeli IT and government sectors with a modular .NET C2 framework and trusted provider supply chain access.

An AI PowerShell script mapped Active Directory in a real June 2026 attack using RDP access, stolen credentials, and custom enumeration logic.