Cybersecurity briefing, 2026-06-08

A malicious Python package can now steal your CI secrets at install time, before a single import ever runs.

• Storage appliance becomes stealth pivot into M365
• Instagram recovery became the takeover path
• WordPress form bug hands out admin access
• Package installs now trigger cross-ecosystem theft
• Transitive protobuf.js pulls expand RCE exposure
• IT-helpdesk impersonation replaces ransomware noise
• World Cup fraud is already parked and ready
• Support channels become the access point for extortion
• Botnet swaps payloads across IoT hardware
• Ceasefire leaves PLC footholds inside critical infrastructure
• Default Gogs installs expose private repos to anyone
• AI brand lures turn search trust into credential theft

Recent editions

• Sunday, June 7, 2026: WordPress form bug hands out admin access · 7 stories
• Saturday, June 6, 2026: AI bug hunts are swamping human triage · 9 stories
• Friday, June 5, 2026: IT-helpdesk impersonation replaces ransomware noise · 15 stories
• Thursday, June 4, 2026: New Kirki release put admin accounts at risk · 17 stories
• Wednesday, June 3, 2026: Encrypted vault copies outlive the lockout · 18 stories
• Tuesday, June 2, 2026: AI shortens the EDR bypass loop · 6 stories
• Monday, June 1, 2026: Support access becomes a WordPress admin backdoor · 4 stories