TECHZONE™

CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation https://thehackernews.com/2026/06/cisa-flags-litespeed-cpanel-plugin-flaw.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw impacting LiteSpeed cPanel Plugin to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by June 18, 2026. The vulnerability in question is CVE-2026-54420 (CVSS score: 8.5), which has been described as a case of privilege

Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails https://thehackernews.com/2026/06/chinese-hackers-abused-google-workspace.html A China-linked espionage group hid inside North American medical, academic, and military research networks for more than a year, quietly stealing sensitive research and defense email. The way in was a backdoor on their REDCap research servers that stole login credentials. The exfiltration was the unusual part: the attackers rewired the victims' own Google Workspace rules to copy any message

North Korean Hackers Are Turning Developer Tools Into Malware Delivery Channels https://thehackernews.com/2026/06/north-korean-hackers-are-turning.html Cybersecurity researchers have flagged two malicious cyber campaigns that exhibit similarities with a persistent North Korean threat cluster known as Contagious Interview (aka Famous Chollima, HexagonalRodent, and Void Dokkaebi). According to a report published by Proofpoint, the threat actor has been found orchestrating phishing campaigns using developer role recruitment or code review themes

LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers https://thehackernews.com/2026/06/litellm-vulnerability-chain-lets-low.html A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, researchers at Obsidian Security disclosed LiteLLM is a widely deployed open-source AI gateway that brokers calls to more than 100 model providers behind one OpenAI-compatible interface. A server takeover exposes every provider key it holds, the secrets that

One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes https://thehackernews.com/2026/06/one-click-microsoft-365-copilot-flaw.html A single click on a trusted Microsoft link could have let an attacker pull emails, calendar details, and indexed files out of Microsoft 365 Copilot Enterprise Search. Researchers at Varonis Threat Labs chained three bugs into a one-click exfiltration path they call SearchLeak. Because the link pointed to a real microsoft.com domain, traditional anti-phishing and URL filtering tools were

⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More https://thehackernews.com/2026/06/weekly-recap-chrome-0-day-unifi.html Stuff broke again. Not in a movie way. An old tool was left exposed. An abandoned package was abused. A deprecated feature was still running in prod. This week is the same lesson in a new form: phishing kits are easier to rent, AI names are useful bait, old login paths still fail, and forgotten software keeps becoming someone else's entry point. Scroll through the full Monday Cybersecurity

The Onboarding Password Mistake That Creates Unnecessary Risk https://thehackernews.com/2026/06/the-onboarding-password-mistake-that.html Employee onboarding is a busy time for IT teams. New starters need devices, accounts, access permissions, and passwords, all delivered within a tight timeframe. That usually means sharing a temporary "first-day" password so employees can access systems for the first time. The issue is that these passwords don't always stay temporary. They may be sent over email or SMS, reused across accounts,

152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic https://thehackernews.com/2026/06/152-chrome-wallpaper-extensions-with.html Cybersecurity researchers have discovered a network of 152 Google Chrome extensions that act as new tab live wallpaper add-ons to distribute a potentially unwanted program (PUP) family. The cluster spans 38 separate Chrome Web Store publisher accounts and three brand backends: tabplugins[.]com, yowgames[.]com, and chromewallpaper[.]com. They have been collectively installed 105,000 times. The

Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors on Sites https://thehackernews.com/2026/06/popular-wordpress-plugin-scripts.html An attacker tampered with trusted JavaScript files used by WordPress sites running PushEngage, OptinMonster, and TrustPulse, turning those files into a way to break into the sites. When a site administrator was logged in as the file loaded, the code created an admin account under the attacker's control and installed a hidden plugin that opened a way back in. Ordinary visitors did not trigger it

Sniper Dz Scams Target MENA Users via Fake Facebook Offers and Browser Alerts https://thehackernews.com/2026/06/sniper-dz-scams-target-mena-users-via.html Cybersecurity researchers have disclosed details of fraudulent activity targeting users across the Middle East and North Africa by employing various fraudulent Facebook accounts impersonating politicians, public figures, and trusted organizations. "These accounts promoted fake offers, including free mobile internet packages, financial compensation, and government subsidy programs," Group-IB

Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw https://thehackernews.com/2026/06/palo-alto-warns-of-active-exploitation.html Palo Alto Networks has revealed that it has observed "active exploitation" of a recently disclosed PAN-OS vulnerability by an unknown threat actor to obtain unauthorized access to GlobalProtect portals. The vulnerability in question is CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway components of PAN-OS software that could be exploited by bad

Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication https://thehackernews.com/2026/06/critical-splunk-enterprise-flaw-lets.html Splunk has released security updates to address a critical security flaw in Splunk Enterprise that could be exploited to conduct unauthenticated file operations and even remote code execution. The vulnerability, tracked as CVE-2026-20253, is rated 9.8 on the CVSS scoring system. "In Splunk Enterprise versions below 10.2.4 and 10.0.7, an unauthenticated user could create or truncate arbitrary

U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals https://thehackernews.com/2026/06/us-orders-anthropic-to-suspend-fable-5.html Anthropic said on Friday it will "abruptly disable" its most advanced artificial intelligence (AI) models, Claude Fable 5 and Mythos 5, for all users after the U.S. government ordered it to suspend access to the models for foreign nationals, whether inside or outside the U.S., citing national security concerns. The AI company said it received an order at 5:21 p.m. ET, instructing it to suspend

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit https://thehackernews.com/2026/06/over-400-arch-linux-aur-packages.html Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide itself. The AUR is Arch Linux's community package collection, and it is separate

Google Sues Chinese Smishing Network Accused of Using Gemini AI in Phishing https://thehackernews.com/2026/06/google-sues-chinese-smishing-network.html Google on Friday said it's pursuing legal action against a Chinese cybercrime network, accusing it of using its Gemini artificial intelligence (AI) agent to send phishing text messages targeting Americans. The network is said to be behind the development and management of a phishing-as-a-service (PhaaS) software kit called Outsider, per the tech giant. "The operation weaponized Gemini to help

China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade https://thehackernews.com/2026/06/china-linked-hackers-backdoored-linux.html Instead of hiding on the laptops and servers defenders watch most closely, a China-nexus group spent close to a decade hidden inside the Linux login system itself. Sygnia, which tracks the group as Velvet Ant, says it backdoored the PAM and OpenSSH components that decide who is allowed to sign in, planting its access where ordinary cleanup could not reach it. The network it targeted had no

Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code https://thehackernews.com/2026/06/agentjacking-attack-tricks-ai-coding.html Cybersecurity researchers have described what they say is a new class of attack that can trick artificial intelligence (AI) coding agents into running arbitrary code on developer machines. Called Agentjacking by Tenet Security, the attack can be triggered by means of a fake error report crafted using Sentry, an open-source error-tracking and performance-monitoring platform. "The attack

Rethinking MDR as Attackers and Defenders Embrace AI https://thehackernews.com/2026/06/rethinking-mdr-as-attackers-and.html For most of the past decade, managed detection and response was the answer to a real problem. Security teams couldn't staff around the clock, couldn't hire enough analysts, and needed someone else to handle the alert queue. MDR stepped in. It worked well enough. Until now. The threat landscape has changed faster than the MDR model can adapt. Attackers are using AI to move faster, generate more

LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution https://thehackernews.com/2026/06/langgraph-flaw-chain-exposes-self.html Cybersecurity researchers have disclosed details of three now-patched security flaws impacting LangGraph, including a critical vulnerability chain that could result in remote code execution. LangGraph is an open-source framework created by LangChain to build complex, stateful, and multi-agent artificial intelligence (AI) agentic applications. "An SQL injection in LangGraph's function could

INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator https://thehackernews.com/2026/06/interpol-takes-down-sniper-dz-phishing.html An INTERPOL-led operation last month resulted in the disruption of Sniper Dz, a decade-long phishing-as-a-service (PhaaS) platform, Group-IB said Thursday. The effort, codenamed Operation Ramz, took place between October 2025 and February 2026, and saw authorities from 13 countries in the Middle East and North Africa (MENA) region making 201 arrests. Included among them was Guedz, the primary