Vulnerabilities
A macOS endpoint-protection bypass with defender posture-review implications. XM Cyber researchers showed that a standard, non-admin user can silently unload EDR and MDM agents on macOS, abusing legitimate XPC behavior rather than a single patchable bug.
Threat Intelligence
Meta's contempt filing tests whether court-ordered restrictions are effectively binding on a commercial spyware vendor.
Artificial Intelligence (AI)
SafeBreach researchers found that a single poisoned notification — from WhatsApp, Slack or SMS — could hijack Google Gemini's voice assistant on Android with no malicious app installed, reaching smart-home controls and poisoning the assistant's long-term memory. Google has patched it.
Vulnerabilities
Google's June 2026 Android update fixes CVE-2025-48595, an Android Framework integer overflow that Google says may be under limited, targeted exploitation. Because the Framework is the API layer every app touches, the flaw can hand an attacker complete control of an unpatched device.
Mobile Security
A single debug setting left enabled in Microsoft's Android Office apps — Word, Excel, PowerPoint, OneNote, Loop and Microsoft 365 Copilot — let any other app on the same device read Microsoft account tokens, per a SecurityWeek exclusive. Microsoft has patched the flaws.
Social Engineering
A phishing wave is impersonating Signal Support to ask users for their secret recovery key — the key that decrypts online backups containing past messages. The defender utility is simple: Signal will never ask for it, ever.
Threat Actors
Wiz disclosed JINX-0164, a previously unreported actor running LinkedIn recruiter lures, custom macOS malware, and CI/CD hijacking against cryptocurrency developers. The playbook mirrors documented North Korean tradecraft, but Wiz preserves the attribution hedge.
Security Research
Apple published the post-quantum cryptography implementations in corecrypto — the library behind iOS, iPadOS, and macOS — alongside formal proofs and verification tools. It does not change today's encryption posture, but it lets outside experts audit the math that will protect tomorrow's.
Data Breaches
Trump Mobile confirmed customer names, email and mailing addresses, phone numbers, and order identifiers were exposed to the open internet via a third-party platform provider, and said it is still evaluating whether it must notify affected customers.
Threat Intelligence
CTM360 names FEMITBOT — a shared backend running crypto scams, fake AI tools, and Android malware impersonating Apple, NVIDIA, Disney, and the BBC, all inside Telegram.
Spyware
Italian-linked surveillance firm IPS Intelligence is tied to a new Android spyware, “Morpheus,” that tricks targets into installing a fake “update” app and then hijacks WhatsApp accounts using biometric-spoofing overlays. The case highlights how commercial spyware vendors are turning to mobile-phishing tactics to deploy powerful snooping tools.
Cyber Attacks
A “mobile SMS blaster” deployed from vehicles in Toronto mimicked cell towers, hijacked tens of thousands of phones, and caused 13 million network disruptions—temporarily blocking 911 access while sending massive volumes of fraudulent texts under Project Lighthouse. TORONTO, ONTARIO — In a first-of-its-kind cybercrime investigation in Canada,