Cybersecurity briefing, 2026-06-16

A trusted cloud destination stops meaning safe the moment an attacker rides the relay itself.

• Port Ransomware Reaches Through Cloud Identity
• SprySOCKS Gains a Hidden Windows Control Channel
• Default Vertex AI Buckets Can Cross Tenant Boundaries
• Stolen CDN Keys Turn Plugin Scripts Into Backdoors
• OIDC Trust Flaw Lets SimpleHelp Create Admins
• Rokarolla Now Silences Bank Alerts Too
• Teams Traffic Became Ransomware Cover
• Repo Token Theft Opens Pharma Research Haul
• Salesforce Breach Exposes School Staff Data
• Sugar Outage Shifts to Leak and Extortion Risk
• Login Software Became Velvet Ant’s Persistence Layer
• Couriers Turn Bank Friction Into Cash Exfiltration
• Utility Data Breach May Expose OT Access Path
• Rockwell Adapter Flaws Can Drop Live I/O
• Trusted Steam Wallpapers Can Steal Accounts
• Recursive NTFS Loops Can Stall Endpoint Scans
• VHDX Containers Help Malware Slip Past First-Line Defenses
• Plain HTTP Turns Quick.CMS Admin Traffic Dangerous
• Developer Tools Now Deliver Cross-Platform Malware

Recent editions

• Monday, June 15, 2026: Stolen CDN Keys Turn Plugin Scripts Into Backdoors · 8 stories
• Sunday, June 14, 2026: Splunk’s Control Plane Is Now the Target · 2 stories
• Saturday, June 13, 2026: Splunk’s Control Plane Is Now the Target · 9 stories
• Friday, June 12, 2026: AI Mass-Produces Phishing Faster Than Defenses Can Block · 17 stories
• Thursday, June 11, 2026: Netlogon Exploit Puts Active Directory at Risk · 13 stories
• Wednesday, June 10, 2026: Netlogon Exploit Puts Active Directory at Risk · 13 stories
• Tuesday, June 9, 2026: WinRAR Patched, But Ukraine Is Still Getting Hit · 15 stories