A novel iPhone BootROM vulnerability has been discovered by researchers that gives attackers with physical access a route to compromise the boot chain on Apple A12, S4/S5 and Apple A13 systems-on-chips (SoCs). Paradigm Shift’s new analysis shared how the bug, which… Read More "Unpatchable BootROM Flaw Impacts Apple A12, A13 Chips"
Security researchers at Calif.io have disclosed a memory leak vulnerability in Squid Proxy that has existed in the software since 1997. Squid is a widely used open source web proxy that can reduce bandwidth and improve response times via caching.… Read More "Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data"
Ravie LakshmananJun 22, 2026Malvertising / Endpoint Security Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported malware loader dubbed OXLOADER. According to Elastic Security Labs, the campaign leverages malicious Google Ads… Read More "New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer"
The UK’s information commissioner, John Edwards, has resigned following an HR investigation into complaints made about him in the workplace. The Information Commissioner’s Office (ICO) confirmed the departure of New Zealand-born Edwards on June 19. It revealed that the investigation… Read More "Information Commissioner Resigns After Workplace Investigation"
Threat actors are exploiting a medium-severity vulnerability in the Gravity SMTP WordPress plugin to steal complete system details, Defiant warns. Gravity SMTP for WordPress is an email deliverability plugin that integrates with multiple SMTP providers and API-based services to allow… Read More "Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data"
Earlier this month, I spoke at the Gartner Security & Risk Management Summit about a blind spot most security programs are still not accounting for – how attackers are circumventing AI security programs by using legacy infrastructure to hijack AI… Read More "Stop Your Legacy Infrastructure from Hijacking Your AI Agents"
A supply chain attack which targeted Mastra, an open-source typescript for building AI-powered applications and agents, was the work of North Korean hackers, cybersecurity researchers have said. The attribution was made on June 19 by Microsoft Defender Security Research Team… Read More "Microsoft Attributes Mastra AI Supply Chain Attack to North Korea"
The North Korean state-sponsored threat actor Sapphire Sleet is behind the Mastra supply chain attack that hit over 140 NPM packages last week, Microsoft reports. Mastra is an open source TypeScript framework for building AI agents, workflows, and RAG pipelines.… Read More "North Korean Hackers Blamed for Mastra NPM Supply Chain Attack"
Canada’s spy service got a judge’s permission to reach into infected servers, home routers, and IoT gear sitting on Canadian soil and neutralize two foreign-run botnets. The Federal Court released a public version of the ruling on June 15. It is… Read More "Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices"
Several companies have disclosed that they were affected by a breach of business intelligence provider Klue, including at least five cybersecurity firms. Huntress, ReliaQuest, Recorded Future, Jamf and Tanium have all acknowledged using Klue’s intelligence services and confirmed that the… Read More "Klue Breach Enables Hackers to Compromise Cybersecurity Firms"
