Cybersecurity briefing — 2026-06-15

Rotating credentials does nothing when the attacker already owns the code that decides who gets to log in.

• Stolen CDN Keys Turn Plugin Scripts Into Backdoors
• Payroll Leak Puts People, Not Systems, at Risk
• Login Software Became Velvet Ant’s Persistence Layer
• Copilot Search Becomes a One-Click Exfiltration Path
• Developer Tools Now Deliver Cross-Platform Malware
• Manual Recovery Leaves Sugar Supply Frozen
• AUR Recipe Hijack Bypasses Package Trust
• Port Ransomware Reaches Through Cloud Identity