Security Bulletin

The Sandworm group, linked to Russia's GRU, is employing the social engineering technique called ClickFix.

Mandiant has observed an increase in public-facing serverless applications lacking authentication, often due to business needs.

Mozilla's investigation revealed that Stardust shared user data, linked to a unique identifier instead of a name, with RudderStack.

Hunt.io researchers discovered the intrusion campaign in June 2026, identifying 13 Hong Kong-based servers containing victim source code, exploit scripts, and operator logs.

The kernel-mode rootkit, Daxin, first documented in March 2022, was found operating on a compromised host in Taiwan in 2026.

Partnered Health confirmed that a cyberattack on June 23 compromised data from 21 clinics located in New South Wales, Victoria, Queensland, Western Australia, and the ACT.

A researcher, known as tokay0, detailed how a flawed policy attached to a certificate on Shark RV2320EDUS robot vacuums enables attackers to execute root commands on other Shark vacuums.

TELEPUZ is a lightweight and modular malware, likely developed by a small team and potentially offered as a malware-as-a-service.

The breach, which occurred between April and September 2023, was the result of credential-stuffing attacks that compromised the data of 6.9 million customers, including sensitive genetic ancestry information.

Cisco Networking Academy’s 2026 LATAM Partner Conference in Santiago spotlighted how partners, educators, and Cisco are scaling inclusive digital skilling to expand opportunity and economic mobility across the region.

The controversy began when researchers reported that Grok Build's command-line interface uploaded complete source code repositories, including Git commit history, to Google Cloud Storage.

Forget about attackers. Agentic artificial intelligence is creating enough risks for organizations and demands a security reframe.