Cybersecurity briefing, 2026-06-09

• WinRAR patched, but Ukraine is still getting hit
• Storage appliance becomes stealth pivot into M365
• CISA ties fastest patches to compromise checks
• Romance lures turn Soldiers’ phones into spy gear
• Commodity local AI now powers self-replicating worms
• Repo cleanup may not have stuck
• WordPress form bug hands out admin access
• IT-helpdesk impersonation replaces ransomware noise
• PyPI attackers keep reworking the same secret stealer
• Default Gogs installs expose private repos to anyone
• Transitive protobuf.js pulls expand RCE exposure
• BitLocker trust break follows Defender Offline Scan
• Public GPS carried military key control
• Apple lets AI rewrite your passwords
• RADIUS reply integrity can flip switch access

Recent editions

• Monday, June 8, 2026: Instagram recovery became the takeover path · 12 stories
• Sunday, June 7, 2026: WordPress form bug hands out admin access · 7 stories
• Saturday, June 6, 2026: AI bug hunts are swamping human triage · 9 stories
• Friday, June 5, 2026: IT-helpdesk impersonation replaces ransomware noise · 15 stories
• Thursday, June 4, 2026: New Kirki release put admin accounts at risk · 17 stories
• Wednesday, June 3, 2026: Encrypted vault copies outlive the lockout · 18 stories
• Tuesday, June 2, 2026: AI shortens the EDR bypass loop · 6 stories