Roundup

A roundup of 283 items curated from across the security community. News BLS Presents BBOT at DEF CON Recon Village. Black Lantern Security is presenting at DEF CON 34’s Recon Village this week, covering BBOT’s evolution and the new 3.0 architecture with Rust-powered DNS and HTTP engines. The Hacker Who Humiliated Spyware Makers and Was Never Caught by scriptjunkie (Matt). TechCrunch deep dive into Phineas Fisher, the hacktivist behind spectacular breaches of FinFisher and Hacking Team who has never been identified or caught. ...

A roundup of 448 items curated from across the security community. News CVE-2026-12118: IBM webMethods Integration Server Vulnerability. Black Lantern Security discovered and reported this vulnerability in IBM webMethods Integration Server. Full technical writeup with reproduction steps. LG Bans Residential Proxy Apps from Smart TVs. Krebs reports LG will suspend smart TV apps that turn televisions into residential proxy nodes. Over 42 percent of webOS store apps were found routing third-party traffic through users’ devices. ...

A roundup of 312 items curated from across the security community. News EU Exposes FSB Centre 16 as Controller of TURLA Operations by thaddeus e. grugq. The EU formally attributes TURLA and related cyber operations to the FSB’s 16th Centre, alongside its broadest cyber sanctions package yet targeting Russian-linked actors. Microsoft July Patch Tuesday: Record 570 Flaws, 3 Zero-Days by BleepingComputer. The largest Patch Tuesday ever. 570 fixes including 3 zero-days (2 actively exploited) and 141 RCE flaws. Microsoft attributes the surge to AI-assisted vulnerability discovery. ...

A roundup of 265 items curated from across the security community. BBOT 3.0: Rust-Powered Recon with 15x Faster DNS The biggest BBOT release ever. Core DNS and HTTP engines rewritten from scratch in Rust, delivering 15x faster DNS resolution and FFUF-class directory brute-forcing without leaving the BBOT process. New modules, native SIEM outputs, ASN targeting via the BBOT.IO API Hub, and reworked scoping. Free and open source. Read more News KDDI Breach Exposes Data of 12 Million Japanese Customers by BleepingComputer. Japanese telecom giant KDDI confirms a data breach affecting 12 million customer records, one of the largest telecommunications breaches in recent years. ...

A roundup of 160 items curated from across the security community. News FBI PSA: TeamPCP Data Extortion Group Behind Longest Supply-Chain Hack Streak. FBI releases a PSA on TeamPCP, a data extortion group responsible for the longest running streak of software supply-chain hacks on record, including compromises of Trivy, CheckMarx, LiteLLM, and at least 3,800 GitHub repositories. Iranian Hacker Arrested for IRGC-Backed University IP Theft Campaign by Kim Zetter. An Iranian hacker arrested in Montenegro for hacking over 100 US universities on behalf of the IRGC highlights Iran’s shift toward economic espionage and intellectual property theft. ...

A roundup of 277 items curated from across the security community. News Scattered Spider Hackers Plead Guilty on Day 1 of Trial https://krebsonsecurity.com/2026/06/scattered-spider-hackers-plead-guilty-on-day-1-of-trial/ by Nicolas Krassas. Multiple Scattered Spider members plead guilty on the first day of their federal trial. TanStack npm Supply Chain Attack Bypasses SLSA Provenance Verification. 42 TanStack packages published with valid SLSA provenance by stealing OIDC tokens from GitHub Actions runner memory. Provenance verification alone no longer guarantees integrity. ...

A roundup of 126 items curated from across the security community. News Mastra-AI npm Supply Chain Attack Hits 80+ Packages by Dave Kennedy. An attacker hijacked npm accounts to inject a phantom dependency into 80+ Mastra-AI packages. The malicious payload arrived via a “dayjs” typosquat that ran a post-install script to download and execute a remote binary. Operation Endgame Dismantles SocGholish Infrastructure by SwitHak (). International law enforcement took down 100 servers and domains, remediating nearly 15,000 websites. SocGholish’s “FakeUpdates” web inject framework has been a persistent ransomware delivery vector since 2018. ...

A roundup of 292 items curated from across the security community. News Microsoft Packages Laced with Credential Stealer for Second Time in Weeks by Nicolas Krassas. For the second time in weeks, official Microsoft packages were found laced with credential-stealing malware, raising serious questions about supply chain integrity in the Microsoft ecosystem. AI Misidentification Leads to Wrongful Arrest, Months in Prison by Kim Zetter. AI facial recognition identified Jalil Richardson with only 85% accuracy. Police never checked his alibi. He spent months in prison and lost his job, home, and child custody before police admitted the AI was wrong. ...

A roundup of 44 items curated from across the security community. News UN food agency breach exposes 600,000 Gaza households by Nicolas Krassas. The UN World Food Programme discloses a data breach affecting 600,000 households in Gaza. UNC3753 targets US law firms with vishing and physical intrusion by scriptjunkie (Matt). Mandiant details UNC3753 using vishing and RMM tools for data extortion against US law firms, with some operators attempting in-person theft. CISA: SolarWinds Serv-U flaw now actively exploited by BleepingComputer. CISA adds an actively exploited SolarWinds Serv-U vulnerability to the KEV catalog. ...

A roundup of 89 items curated from across the security community. News Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts by BrianKrebs. Pro-Iran hackers hijacked high-profile Instagram accounts, including the Obama White House, by tricking Meta’s AI support bot into resetting passwords with a spoofed hometown IP. Dutch police dismantle a 17-million-device botnet. Dutch police and the NCSC dismantled a 17-million-device botnet operating on 200 servers seized from a local hosting provider. ...