Roundup

A roundup of 429 items curated from across the security community. News Hackers Arrested Over 30M Euro Bank Fraud by BleepingComputer. Hackers arrested for exploiting a service provider flaw to steal over 30 million euros through bank fraud. LiveOverflow Reacts to OpenAI Black Hat Agent Talk by LiveOverflow. LiveOverflow’s reaction to the OpenAI Black Hat talk on AI agents finding vulnerabilities and moving laterally. Explores the implications for defenders. Binance Gave Russia Crypto Account Data Leading to Arrest by thaddeus e. grugq. Russian authorities arrested an IT specialist over crypto donations to Ukraine. Binance provided extensive account data including IDs, transactions, logins, and device info to Russia’s Investigative Committee. ...

A roundup of 611 items curated from across the security community. News Zapscape: KVM Guest-to-Host Escape via Shadow MMU (CVE-2026-64561) by HD Moore. Guest-to-host escape on KVM/x86 exploiting a use-after-free in the shadow MMU’s recursive ZAP path. Affects x86 public clouds exposing nested virtualization. Separate from Januscape. Pass-the-Passkey: Replaying YubiKey Auth from Event Logs by Logan Goins. CVE-2026-34348 exploitation demo from Black Hat. WebAuthn assertions from recent YubiKey authentication extracted from Windows Event Logs and replayed against Microsoft Entra ID. Whitepaper and Passkey Injector tool released. ...

A roundup of 283 items curated from across the security community. News BLS Presents BBOT at DEF CON Recon Village. Black Lantern Security is presenting at DEF CON 34’s Recon Village this week, covering BBOT’s evolution and the new 3.0 architecture with Rust-powered DNS and HTTP engines. Medical Billing Firm MCBS Breach Affects 1.26 Million People by BleepingComputer. Medical billing firm MCBS discloses a data breach affecting 1.26 million patients across healthcare organizations it services. ...

A roundup of 448 items curated from across the security community. News CVE-2026-12118: IBM webMethods Integration Server Vulnerability. Black Lantern Security discovered and reported this vulnerability in IBM webMethods Integration Server. Full technical writeup with reproduction steps. Pwn2Own Ireland 2026: $300K for iPhone 17 Remote by h0mbre. Pwn2Own Ireland 2026 announces new targets and categories, including a $300K bounty for a remote iPhone 17 exploit. Registration process has changed. LG Bans Residential Proxy Apps from Smart TVs. Krebs reports LG will suspend smart TV apps that turn televisions into residential proxy nodes. Over 42 percent of webOS store apps were found routing third-party traffic through users’ devices. ...

A roundup of 312 items curated from across the security community. News xAI Grok Build CLI Silently Uploaded Entire Git Repos by thaddeus e. grugq. Wire-level analysis revealed xAI’s Grok Build CLI was uploading entire git repos, including secrets, to a GCS bucket. On a 12 GB test repo, 5.1 GB was exfiltrated while the task needed 192 KB. Still no advisory from xAI. EU Exposes FSB Centre 16 as Controller of TURLA Operations by thaddeus e. grugq. The EU formally attributes TURLA and related cyber operations to the FSB’s 16th Centre, alongside its broadest cyber sanctions package yet targeting Russian-linked actors. ...

A roundup of 265 items curated from across the security community. BBOT 3.0: Rust-Powered Recon with 15x Faster DNS The biggest BBOT release ever. Core DNS and HTTP engines rewritten from scratch in Rust, delivering 15x faster DNS resolution and FFUF-class directory brute-forcing without leaving the BBOT process. New modules, native SIEM outputs, ASN targeting via the BBOT.IO API Hub, and reworked scoping. Free and open source. Read more News KDDI Breach Exposes Data of 12 Million Japanese Customers by BleepingComputer. Japanese telecom giant KDDI confirms a data breach affecting 12 million customer records, one of the largest telecommunications breaches in recent years. ...

A roundup of 160 items curated from across the security community. News Iranian Hacker Arrested for IRGC-Backed University IP Theft Campaign by Kim Zetter. An Iranian hacker arrested in Montenegro for hacking over 100 US universities on behalf of the IRGC highlights Iran’s shift toward economic espionage and intellectual property theft. Scattered Spider Member Arrested in Finland, Extradited to US by Florian Roth. DOJ announces the arrest of an alleged Scattered Spider member in Finland. Court documents reveal Microsoft’s GDID telemetry was used to track the suspect across VPNs and reimages. ...

A roundup of 277 items curated from across the security community. News USBLiter8: Unpatchable Apple A12 and A13 Bootloader Exploit by Simone Margaritelli. USB controller implementation flaw on Apple A12 and A13 devices allows bootloader compromise. Exploit code published; no software patch possible. Scattered Spider Hackers Plead Guilty on Day 1 of Trial https://krebsonsecurity.com/2026/06/scattered-spider-hackers-plead-guilty-on-day-1-of-trial/ by Nicolas Krassas. Multiple Scattered Spider members plead guilty on the first day of their federal trial. TanStack npm Supply Chain Attack Bypasses SLSA Provenance Verification. 42 TanStack packages published with valid SLSA provenance by stealing OIDC tokens from GitHub Actions runner memory. Provenance verification alone no longer guarantees integrity. ...

A roundup of 126 items curated from across the security community. News Mastra-AI npm Supply Chain Attack Hits 80+ Packages by Dave Kennedy. An attacker hijacked npm accounts to inject a phantom dependency into 80+ Mastra-AI packages. The malicious payload arrived via a “dayjs” typosquat that ran a post-install script to download and execute a remote binary. Operation Endgame Dismantles SocGholish Infrastructure by SwitHak (). International law enforcement took down 100 servers and domains, remediating nearly 15,000 websites. SocGholish’s “FakeUpdates” web inject framework has been a persistent ransomware delivery vector since 2018. ...

A roundup of 292 items curated from across the security community. News AI Misidentification Leads to Wrongful Arrest, Months in Prison by Kim Zetter. AI facial recognition identified Jalil Richardson with only 85% accuracy. Police never checked his alibi. He spent months in prison and lost his job, home, and child custody before police admitted the AI was wrong. Unpatched Firefox Focus Universal XSS 0-Day by Simone Margaritelli. An unpatched universal XSS vulnerability in Firefox Focus allows any website to execute arbitrary JavaScript in the context of another origin. No fix is currently available. ...