TECHZONE™

Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag https://thehackernews.com/2026/06/microsoft-365-android-apps-let-any-app.html A development flag left switched on in production builds of several Microsoft 365 Android apps disabled the check that limits account-token sharing to trusted Microsoft apps. Any other app on the same phone could ask for the signed-in user's token and get it, then read email, open files, browse the calendar, and send messages as that user. No password, no login screen, no permission prompt.

Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479) https://thehackernews.com/2026/06/autonomous-ai-tool-finds-2-year-old-rce.html Redis has patched a use-after-free in its blocking-client code that lets an authenticated user run arbitrary OS commands on the machine hosting the database. The flaw was found by an autonomous AI tool built to hunt bugs in large codebases. Tracked as CVE-2026-23479, the flaw was introduced in Redis 7.2.0 and remained in every stable branch until the May 5 fixes, unnoticed for over two years.

One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens https://thehackernews.com/2026/06/one-click-github-dev-attack-lets.html Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code (VS Code) that makes it possible to steal a user's GitHub token. "Just by clicking a link, it's possible for an attacker to steal a GitHub token that can read and write to your repos, including private ones," security researcher Ammar Askar said. GitHub supports a feature called GitHub.dev that runs as

Shrinking the IAM Attack Surface through Identity Visibility and Intelligence Platforms (IVIP) https://thehackernews.com/2026/06/shrinking-iam-attack-surface-through.html The Fragmented State of Modern Enterprise Identity Enterprise IAM is approaching a breaking point. As organizations scale, identity becomes increasingly fragmented across thousands of applications, decentralized teams, machine identities, and autonomous systems. The result is Identity Dark Matter: identity activity that sits outside the visibility of centralized IAM and beyond the reach of

Beyond the Zero-Day: See Your Network Like an Attacker | Webinar with HD Moore https://thehackernews.com/2026/06/beyond-zero-day-see-your-network-like.html Assume the breach. Zero-days keep shipping, AI is writing exploits faster than anyone patches, and "patch everything in time" stopped working years ago. Stop betting the org on winning that race. You don't control which bug lands. You control what it can reach once it does. That is a question about the shape of your network, and most teams have the shape wrong. HD Moore, creator of Metasploit

Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes https://thehackernews.com/2026/06/unpatched-windows-search-uri.html Cybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a user's NTLMv2 hash to the attacker. Like in the case of CVE-2026-33829, which impacted the Windows Snipping Tool's ms-screensketch: URI handler, the newly flagged issue resides in the search: URI handler, per Huntress. CVE-2026-33829 refers to a spoofing vulnerability that could expose

New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare https://thehackernews.com/2026/06/new-http2-bomb-vulnerability-allows.html Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The vulnerability has been codenamed HTTP/2 Bomb by Calif. "The vulnerable behavior exists in each server's default HTTP/2 configuration," the company said, adding it was discovered by OpenAI Codex by chaining

Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content https://thehackernews.com/2026/06/weedhack-attacks-minecraft-users.html Cybersecurity researchers have flagged a new campaign targeting Minecraft players via YouTube to spread malware capable of gaining control of victims' systems. The Minecraft-focused malware-as-a-service (MaaS) campaign has been codenamed Weedhack by McAfee Labs, stating the activity has been active since January 2026 and impersonates Minecraft clients and mods to infect users. In all, 3820

Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited https://thehackernews.com/2026/06/google-june-2026-android-update-patches.html Google on Monday released patches for 124 security vulnerabilities impacting its Android operating system for the month of June 2026, including one high-severity flaw in the Framework component that has come under active exploitation. Tracked as CVE-2025-48595 (CVSS score: 8.4), the security flaw has been described as a case of privilege escalation without requiring any user interaction. The

Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine https://thehackernews.com/2026/06/gamaredon-exploits-winrar-to-deliver.html The Russian hacking group known as Gamaredon has been attributed to the continued exploitation of a WinRAR vulnerability to deliver multiple malware families aimed at data theft and propagation. Per Sekoia, the activity involves the weaponization of CVE-2025-8088, a path traversal flaw in WinRAR, to launch an HTML Application payload dubbed GammaPhish, which is then used to retrieve an

Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation https://thehackernews.com/2026/06/oracle-weblogic-cve-2024-21182-added-to.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The vulnerability, CVE-2024-21182 (CVSS score: 7.5), allows an unauthenticated attacker with network access to take control of susceptible servers. It was

AI-Driven Exploitation is Destroying Vulnerability Management. Here’s How to Handle It. https://thehackernews.com/2026/06/ai-driven-exploitation-is-destroying.html AI-driven exploitation timelines are rapidly shrinking, and they are not going to stop shrinking. Vulnerabilities are being discovered, reproduced, and weaponized faster than ever in the history of enterprise security. As a result, the window between a vulnerability being disclosed and indiscriminate exploitation observed across the internet is now measured in hours, not days. The industry's

How Leading Organizations Are Turning EDR Into Operational Resilience https://thehackernews.com/2026/06/how-leading-organizations-are-turning.html Most organizations now recognize that endpoint protection alone is no longer sufficient. That's why adoption of endpoint detection and response (EDR) has accelerated rapidly in recent years. Organizations understand that modern attacks move faster, evade traditional prevention controls, and require continuous visibility into suspicious activity across the environment. But owning EDR

Pakistan-Linked SideCopy Targets Afghanistan Finance Ministry with Xeno RAT https://thehackernews.com/2026/06/pakistan-linked-sidecopy-targets.html Cybersecurity researchers have disclosed details of a spear-phishing campaign likely undertaken by the Pakistan-aligned SideCopy group targeting Afghanistan's Ministry of Finance with an open-source remote access trojan called Xeno RAT. "The campaign opens with a spear phishing delivery - a ZIP archive containing a malicious LNK file bearing a carefully crafted Pashto-language filename,"

Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded https://thehackernews.com/2026/06/dashlane-discloses-brute-force-attack.html Password manager Dashlane has disclosed that "fewer than" 20 users on the personal subscription plan had their encrypted vaults downloaded following a brute-force attack launched by an unknown party. On May 31, 2026, the company said an "external" threat actor launched a brute-force attack against certain Dashlane user accounts with the aim of breaking two-factor authentication (2FA)

Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm https://thehackernews.com/2026/06/miasma-supply-chain-attack-compromises.html A new Mini Shai-Hulud supply chain attack campaign, codenamed Miasma, has compromised @redhat-cloud-services packages to steal credentials and secrets from developer machines and deliver a self-propagating worm. "This is effectively a Mini Shai-Hulud campaign: it uses the same core tactics of install-time execution, credential harvesting, CI/CD targeting, encrypted exfiltration, and potential

⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More https://thehackernews.com/2026/06/weekly-recap-new-linux-flaw-pan-os.html Monday hit like a cron job with anger issues. A busted auth path here, a repo-side faceplant there, some "patched-ish" thing already getting chewed on in the wild, and then the usual bonus round: poisoned dev tools, sketchy forum chatter, phishing kits pretending to be productivity, and AI lowering the bar for people who already thought 'curl | sh' had a personality. The vibe is simple: old

China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan https://thehackernews.com/2026/06/china-aligned-groups-ramp-up-attacks.html A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic and Taiwan to deliver an AdaptixC2 agent. According to Seqrite Labs, targets of the campaign include government, research, academic, technology, and financial services sectors. The activity entails distributing spear-phishing emails containing ZIP attachments

The Security Growth Platform: Why MSPs Are Moving Beyond vCISO Tools https://thehackernews.com/2026/06/the-security-growth-platform-why-msps.html Three years ago, the practical question for an MSP building a cybersecurity practice was which "vCISO platform" to buy. The term was good shorthand for the work at the time: assessments, advisory, reporting, maybe a compliance module bolted on the side. The work has since outgrown the descriptor. A Security Growth Platform is the more precise name for what MSPs and MSSPs need from the software

OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack https://thehackernews.com/2026/06/openai-codex-authentication-tokens.html Cybersecurity researchers have disclosed details of a new malicious supply chain campaign that's targeting developers using OpenAI Codex through a legitimate-looking remote web UI. The tool, named codexui-android, is advertised on GitHub and npm as a remote web UI for OpenAI Codex, attracting over 29,000 weekly downloads. The package is still available for download from the repository. What