Mobile Security
A scale-significant AI-app privacy disclosure with developer accountability implications: Wake Forest researchers found 282 of 444 iOS AI apps exposing usable LLM credentials in their own network traffic, and most stayed open months after notification.
Vulnerabilities
A critical remote monitoring and management vulnerability is under active exploitation to deliver an infostealer that hunts cloud and AI development credentials — and it is now on CISA's KEV list.
Vulnerabilities
Another Oracle product line under active exploitation — high-priority patch verification this week.
Data Breaches
Another scale-significant Japanese-sector disclosure: Aflac Life Insurance Japan says intruders sat in its policyholder portal for ten days and exfiltrated the personal data of roughly 4.38 million customers and agents.
Data Breaches
A high-profile Oracle PeopleSoft customer disclosure: Nissan says current and former employees' data was exposed via CVE-2026-35273, with sector-advisory implications for the broader Oracle exploitation cycle.
Threat Intelligence
Browser-extension enforcement action at scale from Microsoft. The company pulled 119 Edge add-ons that concealed payloads inside image and font files, with a combined install base reported at up to 2.6 million, and suspended the developer accounts behind them.
Vulnerabilities
A coding-AI-assistant flaw with cloud-credential implications — defender posture review for the week.
Artificial Intelligence (AI)
Another defender-positive AI model preview from OpenAI, this time gated to a small group of vetted partners at the US government's request and shipped with the company's most robust cyber-safety stack to date.
Cybercrime
A coordinated US law-enforcement push against a Russian-intelligence messaging-app campaign pairs a Rewards for Justice bounty with an FBI advisory on Signal backup-recovery-key theft.
Apple shipped an early, large patch cycle across iOS, macOS, and Safari — including four WebKit bugs surfaced by AI tools from OpenAI and Anthropic. For defenders, this is a device-verification week.
Fresh reporting around the Jaguar Land Rover cyber incident pegs the toll near $2.5 billion and points to Russian-linked actors — a scale-significant automotive-manufacturing disclosure whose figure source and attribution both warrant careful reading.
Another insurance-sector confirmation in the Oracle PeopleSoft vulnerability cycle: the body that supports US state insurance regulators says attackers reached its environment through CVE-2026-35273, exposing statutory financial and credit-rating data.
Identity-data exposures continue at scale. A cannabis-club membership platform reportedly left nearly a million passports and ID photos reachable on the open internet with no password — a consumer-notification story for the week.
Another JavaScript-ecosystem supply-chain disclosure puts developer-secret rotation and GitHub Actions auditing back at the top of the defender to-do list — this time as a fresh wave of the ongoing Miasma cluster.
Researchers detailed pedit COW, CVE-2026-46331, a Linux kernel privilege-escalation flaw in the act_pedit traffic-control action — a second Linux disclosure in the same weekend as DirtyClone, with distribution patch tracking continuing.
CISA's KEV addition raises the priority for PTC Windchill defenders, who now face an actively exploited remote code execution flaw, continuing web-shell activity, and a tight federal remediation deadline.
A Russian-intelligence campaign against messaging-app credentials, documented by Ukraine, uses fake support texts to coax Signal and WhatsApp users into surrendering the codes that unlock their accounts.
Another Linux kernel research disclosure — distribution patch tracking work for the week. JFrog published a working exploit for DirtyClone, a local privilege escalation to root in the kernel networking stack, fixed upstream in late May.
New FCC cybersecurity rules land for emergency systems and undersea-cable operators, mandating baseline cyber hygiene for alert equipment and a first-in-decades overhaul of submarine-cable licensing and security.
A high-profile prediction-market disclosure of user-fund theft: a compromised third-party vendor injected a malicious script into Polymarket's frontend, draining roughly $3.1 million from eleven user wallets, with the platform pledging full refunds.
Another Russia-linked backdoor lands on defenders' desks for review. Google Threat Intelligence Group and Mandiant have detailed STOCKSTAY, a .NET implant Turla has deployed against Ukrainian government and military networks since at least 2022.
