Three FortiSandbox CVEs Are Live, And The Exploit Was Vibecoded
Three live FortiSandbox CVEs, a Vertex AI bucket-squat, and an Android trojan that kills Play Protect all share one weakness. See what to patch first.
June 2026
The Disk Image That Skated Past Your Scanner
A VHDX file mounted itself and dropped Remcos. Here's why your cybersecurity stack missed it, and what to change this week.
One Click On microsoft.com. Your Inbox Walked.
SearchLeak proved one click on microsoft.com can drain a Copilot tenant. Here's how to lock down the AI surface your cybersecurity team just bought.
The Fake Sentry Error That Ran Your Code
Agentjacking turns Sentry error reports into prompt injection payloads that hijack AI coding agents. Here's the cybersecurity fix that actually scales.
Court Orders Apparently Aren’t A Security Control
NSO defied a court order, North Korea pads its GDP with hacking, and TikTok ships infostealers. Time to rewrite your cybersecurity assumptions.
China Built A Faster Shodan From Home Routers
China's JDY botnet is mapping your attack surface from 1,500 home routers, and Langflow shows where the intel lands. Audit your edge before they do.
Ransomware Affiliates Now Take 90 Percent. Infostealers Feed The Pipeline.
The Gentlemen pay affiliates 90 percent. Infostealers harvest your users' logins. See the cybersecurity moves that actually cut the pipeline.
UNC3753 Called Your Help Desk. Then It Walked In.
UNC3753 paired vishing with physical office intrusions to extort dozens of US firms. Here's what your cybersecurity playbook is missing this week.
Your Smart TV Is Now A Proxy Node
A Bright Data SDK turns smart TVs into proxy exit nodes and the 2026 DBIR puts attacks in the browser. Time to rethink your cybersecurity signals.
Worms Are Back, And They Brought Their Own LLM
An AI worm prototype, two npm worm campaigns, and a Claude Code GitHub Action flaw rewrite the cybersecurity worm playbook. Here's what to fix this week.