TECHZONE™

Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues https://thehackernews.com/2026/06/microsoft-restores-some-github-repos.html Microsoft on Monday confirmed that it temporarily removed some GitHub repositories in response to a recent security incident that led to 73 of its open-source projects being compromised to inject an information stealer into the code. "Our priority is to protect customers and the broader ecosystem," a Microsoft spokesperson told The Hacker News via email. "We temporarily removed some

Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer https://thehackernews.com/2026/06/hades-pypi-attack-19-packages-poisoned.html The Miasma supply chain campaign has sparked a fresh attack wave called Hades, this time involving 37 malicious wheel artifacts across 19 packages in the Python Package Index (PyPI) registry, as the Mini Shai-Hulud-style attacks continue to be refined and splintered to target specific ecosystems. "The compromised releases shipped a *-setup.pth file that attempts to execute automatically

LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-42271 (CVSS score: 8.7), is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on the

One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public https://thehackernews.com/2026/06/one-character-linux-kernel-flaw-enables.html Security researchers have published a detailed, working exploit for a Linux kernel use-after-free that lets an unprivileged local user escalate to root and break out of a container. The flaw, CVE-2026-23111, sits in the kernel's nf_tables packet-filtering code and was patched upstream on February 5, 2026. Exodus Intelligence released its full technical walkthrough on June 8, and it is not even

Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order https://thehackernews.com/2026/06/meta-blocks-nso-groups-new-whatsapp.html Meta on Monday said it detected and blocked spear-phishing attempts linked to Israeli spyware vendor NSO Group. In addition, the tech giant said it's filing a federal court contempt order against the company for violating a permanent injunction that barred it from targeting WhatsApp and its users. "They tried to trick people into clicking on malicious links to drive them to external websites

Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups https://thehackernews.com/2026/06/critical-check-point-vpn-flaw-exploited.html Check Point has warned of active exploitation of a critical vulnerability impacting Remote Access VPN and Mobile Access deployments that are configured to use the deprecated IKEv1 key exchange protocol. The vulnerability, tracked as CVE-2026-50751 (CVSS score: 9.3), is a case of a logic flow weakness in certificate validation that allows an unauthenticated remote attacker to bypass user

AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload https://thehackernews.com/2026/06/ai-phishing-is-crushing-socs-with-alert.html Phishing has always been a numbers game. AI has turned it into a volume machine. Attackers can now create convincing emails, fake login pages, and tailored lures in minutes. Every polished message adds another case for Tier 1 to review, another link to inspect, and another alert that cannot be dismissed at a glance. As the queue grows, a credential theft attempt or malware delivery can easily

⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More https://thehackernews.com/2026/06/weekly-recap-instagram-account-hacks.html Monday again. The weekend was meant to be quiet. It wasn't. Last week had poisoned packages, a broken AI helper, and a worm tearing through repos. The ugly part: basic tricks still worked. A chatbot got fooled. A bot token got leaked inside the malware. The same old mistakes showed up again. And while everyone chased the loud stuff, quieter attackers sat in inboxes for months, reading mail and

The Hardest Fork https://thehackernews.com/2026/06/the-hardest-fork.html Mythos is real. I know a big chunk of the industry thinks it's a marketing stunt, and I get why. I get it. But I've seen the findings, and they're bad. These aren't "whoops, this line right here is wrong, and that's RCE." They're novel combinations of a few dozen issues out of thousands of things every SAST scanner already finds, chained together into something much worse. It's real creativity,

VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances https://thehackernews.com/2026/06/verdantbamboo-deploys-bsd-variant-of.html A China-nexus cyber espionage group has been observed deploying a BSD variant of a known backdoor called BRICKSTORM, as well as two other malware families codenamed PLENET (aka GRIMBOLT) and AGENTPSD to target Linux systems. The activity has been attributed by Volexity to a threat cluster it tracks as VerdantBamboo, which it said overlaps with hacking groups known as Clay Typhoon (Microsoft),

UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign https://thehackernews.com/2026/06/unc3753-used-vishing-and-physical.html Cybersecurity researchers have disclosed details of a financially motivated data theft extortion campaign that has targeted dozens of organizations across professional, legal, and financial services in the U.S. between January and May 2026. The activity has been attributed by Google Mandiant and Google Threat Intelligence Group (GTIG) to a threat actor dubbed UNC3753, which is also known as

VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks https://thehackernews.com/2026/06/vs-code-adds-2-hour-extension-auto.html Microsoft has announced that Visual Studio Code (VS Code) will apply a two-hour delay before extensions for the integrated development environment (IDE) are updated automatically to a newer version in an attempt to tackle software supply chain threats. "When automatic updates are enabled, new versions are auto-updated two hours after they are published, adding an extra layer of protection

New ChatGPT Lockdown Mode Limits Tools That Could Enable Data Exfiltration https://thehackernews.com/2026/06/new-chatgpt-lockdown-mode-limits-tools.html OpenAI has begun rolling out a new Lockdown Mode to ChatGPT for eligible personal accounts to reduce the risk of data exfiltration arising from prompt injection attacks. The feature is primarily designed for people and organizations that handle sensitive data and require stricter protection guarantees. Lockdown Mode is available to logged-in users across Free, Go, Plus, and Pro, and

Free Apps Are Quietly Turning Smart TVs Into Web-Scraping Proxies for AI https://thehackernews.com/2026/06/free-apps-are-quietly-turning-smart-tvs.html A researcher has reverse-engineered the iOS SDK that Bright Data embeds in consumer apps and documented how it turns devices, including always-on smart TVs, into exit nodes that relay web-scraping traffic for a data business Bright Data markets heavily to the AI industry. The company, the successor to Luminati, operates what it calls the largest residential proxy network in the world,

CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog https://thehackernews.com/2026/06/cisa-adds-actively-exploited-solarwinds.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity security flaw impacting SolarWinds Serv-U multi-protocol file server software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-28318 (CVSS score: 7.5), is a denial-of-service (DoS) bug that causes the service to crash

AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs https://thehackernews.com/2026/06/ai-agent-uncovers-21-zero-days-in.html Two things landed within days of each other this week. A security startup reported 21 previously unknown vulnerabilities in FFmpeg, the media library inside almost everything that touches video, all of them found by an autonomous AI agent. The same week, Google shipped Chrome 149 with patches for 429 security bugs, the most ever in a single release. Only the FFmpeg bugs were found by AI.

Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack https://thehackernews.com/2026/06/miasma-worm-hits-73-microsoft-github.html Microsoft's GitHub repositories have become the latest to fall victim to the ongoing Miasma self-replicating supply chain attack campaign. The incident impacted 73 Microsoft repositories across four of its GitHub organizations, including Azure, Azure-Samples, Microsoft, and MicrosoftDocs, per OpenSourceMalware. The development has GitHub to disable access to those repositories. "Access to this

Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available https://thehackernews.com/2026/06/cisco-catalyst-sd-wan-manager-cve-2026.html Cisco has warned that a high-severity security flaw impacting Catalyst SD-WAN Manager has come under active exploitation. The vulnerability, tracked as CVE-2026-20245, carries a CVSS score of 7.8 out of a maximum of 10.0. It affects the following deployment types - On-Prem Deployment Cisco SD-WAN Cloud-Pro Cisco SD-WAN Cloud (Cisco Managed) Cisco SD-WAN for Government (FedRAMP) "A

IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks https://thehackernews.com/2026/06/ironworm-and-new-miasma-worm-variant.html Multiple software supply chain attacks have hit the npm ecosystem, with threat actors using both malicious and poisoned versions of over 50 legitimate packages to distribute a Rust-based information stealer and a self-spreading worm, respectively. According to JFrog, the information stealer "scrapes every secret it can find on a developer's machine, hides behind an eBPF kernel rootkit, and

Android Spyware Asin Targets Arabic Users via Fake News, PDF and War Map Apps https://thehackernews.com/2026/06/android-spyware-asin-targets-arabic.html Arabic-speaking users have emerged as the target of a new Android spyware codenamed Asin, according to findings from ESET. The Slovakian cybersecurity company said it first detected the malware spread via multiple campaigns in early 2025, with each attack wave making use of distinct websites mimicking utilities, war-related updates, and a government news source: govlens[.]net, which