Security Bulletin

The vulnerability

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

The incident occurred early Saturday, June 20, when the Defesa Civil Nacional's dispatch platform was compromised.

A survey of over 7,800 individuals across eight countries revealed that between 40% and 50% of respondents still rely on browser-based password storage for convenience.

The phishing test email, sent during a period of intense work for healthcare professionals implementing the new CorCare software system, contained a button to claim an extra paid vacation day.

Researchers from Flare analyzed 470 underground forum posts between January 2025 and June 2026, revealing a service layer that bridges infostealer infections and account takeover activities.

The updated policy states that in certain circumstances, users may be asked to provide a scan of a government-issued passport or driver's license, along with a selfie and a facial geometry template.

Check Point Research has identified 6,843 new Amazon-themed domains registered between December and May, with nearly 10% flagged as malicious or suspicious.

The utility disclosed that names, addresses, email addresses, phone numbers, account and billing numbers, service addresses, pricing plans, contract start dates, and meter information may have been accessed.

Squidbleed allows an attacker to read beyond the boundary of a memory buffer within Squid's FTP parser.

Four vulnerabilities allow attackers to exploit Dify, a platform for AI application building and management, to silently access and exfiltrate sensitive data.

Attackers are bypassing MFA by targeting enrollment and trust workflows.