en
CVE-2026-20230: Cisco Unified CM SSRF → Root — Tor-Routed Webshell Drops Confirmed, Patch Now
Technical root cause of the Cisco Unified CM SSRF vulnerability exploited in the wild to drop Tor-routed root webshells.
News
en
Klue OAuth Breach: Icarus Steals Salesforce CRM Data from Huntress, Tanium, Recorded Future and Hundreds More
How threat group Icarus weaponized Klue OAuth app tokens to silently extract Salesforce data across hundreds of security vendors.
en
Tata Electronics Breach: 630 GB of Apple and Tesla Trade Secrets Leaked by World Leaks
How extortion group World Leaks breached Tata Electronics and leaked 630 GB of proprietary Apple and Tesla engineering assets.
en
Security Roundup: Cisco SD-WAN Zero-Day, DragonForce Teams Relay Backdoor, JetBrains AI Key Theft, Mastra npm RAT, FortiBleed — Week of June 19, 2026
A week defined by a novel ransomware C2 technique abusing Microsoft's own relay infrastructure, the sixth Cisco SD-WAN zero-day of the year, a coordinated campaign stealing AI API keys from 70,000 developer IDE installs, a supply chain attack backdooring 144 npm packages via a stale contributor account,
en
Mastra npm Supply Chain: easy-day-js Typosquat Delivers Cross-Platform RAT to 144 Packages
How typosquatted npm packages targeting the Mastra AI agent framework infected 144 downstream enterprise packages with a cross-platform RAT.
en
FortiBleed: 73,932 Fortinet Firewalls Compromised — Credential Extraction Campaign Analysis
Global telemetry analysis of FortiBleed: mass unauthenticated credential extraction targeting 73,932 Fortinet appliances.
en
JetBrains Marketplace AI Key Theft — 15 Malicious Plugins, 70K Installs, TLS Bypass
Security breakdown of 15 malicious JetBrains IDE plugins stealing OpenAI, Anthropic, and AWS API keys from 70,000 developers.
en
DragonForce Backdoor.Turn — Microsoft Teams TURN Relay C2: Attack Chain & Detection
How DragonForce ransomware operators abused Microsoft Teams TURN server relays to bypass firewall egress filtering for C2 traffic.
en
CVE-2026-20262: Cisco SD-WAN Manager Zero-Day — Path Traversal to Root + CISA KEV
Technical root cause and remediation for the actively exploited Cisco SD-WAN Manager path traversal flaw.
en
Security Roundup: Oracle PeopleSoft Zero-Day, June Patch Tuesday, Chrome V8 Exploit, TanStack Supply Chain — Week of June 12, 2026
Weekly briefing: Oracle PeopleSoft zero-day exploited by ShinyHunters, Chrome V8 in-browser RCE, and TanStack Mini Shai-Hulud worm.
en
CVE-2026-25089: FortiSandbox Unauthenticated RCE + CISA KEV June 9 Additions (Arista, Cisco SD-WAN)
Technical root cause for the unauthenticated OS command injection vulnerability in Fortinet FortiSandbox appliances.
en
TanStack npm "Mini Shai-Hulud" Supply Chain Worm — TeamPCP Attack Chain, IOCs & Full Remediation
How threat actor TeamPCP deployed the Mini Shai-Hulud worm to poison TanStack packages and compromise developer build environments.