Cybersecurity briefing, 2026-06-16

A trusted cloud destination stops meaning safe the moment an attacker rides the relay itself.

• Port ransomware reaches through cloud identity
• SprySOCKS gains a hidden Windows control channel
• Default Vertex AI buckets can cross tenant boundaries
• Stolen CDN keys turn plugin scripts into backdoors
• OIDC trust flaw lets SimpleHelp create admins
• Rokarolla now silences bank alerts too
• Teams traffic became ransomware cover
• Repo token theft opens pharma research haul
• Salesforce breach exposes school staff data
• Sugar outage shifts to leak and extortion risk
• Login software became Velvet Ant’s persistence layer
• Couriers turn bank friction into cash exfiltration
• Utility data breach may expose OT access path
• Rockwell adapter flaws can drop live I/O
• Trusted Steam wallpapers can steal accounts
• Recursive NTFS loops can stall endpoint scans
• VHDX containers help malware slip past first-line defenses
• Plain HTTP turns Quick.CMS admin traffic dangerous
• Developer tools now deliver cross-platform malware

Recent editions

• Monday, June 15, 2026: Stolen CDN keys turn plugin scripts into backdoors · 8 stories
• Sunday, June 14, 2026: Splunk’s control plane is now the target · 2 stories
• Saturday, June 13, 2026: AUR builds become the payload path · 9 stories
• Friday, June 12, 2026: AI mass-produces phishing faster than defenses can block · 17 stories
• Thursday, June 11, 2026: Netlogon exploit puts Active Directory at risk · 13 stories
• Wednesday, June 10, 2026: WinRAR patched, but Ukraine is still getting hit · 13 stories
• Tuesday, June 9, 2026: Storage appliance becomes stealth pivot into M365 · 15 stories