Cybersecurity briefing, 2026-06-15

Rotating credentials does nothing when the attacker already owns the code that decides who gets to log in.

• Stolen CDN keys turn plugin scripts into backdoors
• Payroll leak puts people, not systems, at risk
• Login software became Velvet Ant’s persistence layer
• Trusted Microsoft links can smuggle Copilot prompts
• Developer tools now deliver cross-platform malware
• Sugar outage shifts to leak and extortion risk
• AUR builds become the payload path
• Port ransomware reaches through cloud identity

Recent editions

• Sunday, June 14, 2026: Splunk’s control plane is now the target · 2 stories
• Saturday, June 13, 2026: AUR builds become the payload path · 9 stories
• Friday, June 12, 2026: AI mass-produces phishing faster than defenses can block · 17 stories
• Thursday, June 11, 2026: Netlogon exploit puts Active Directory at risk · 13 stories
• Wednesday, June 10, 2026: WinRAR patched, but Ukraine is still getting hit · 13 stories
• Tuesday, June 9, 2026: Storage appliance becomes stealth pivot into M365 · 15 stories
• Monday, June 8, 2026: Instagram recovery became the takeover path · 12 stories