Cybersecurity briefing — 2026-06-18

Here's the line for your standup: Salesforce data walked out the door, and nobody stole a Salesforce password.

• Trusted Plugin Updates Became the Payload
• Port Ransomware Reaches Through Cloud Identity
• OAuth Breach Turns One App Into Multi-Tenant Salesforce Theft
• Fake Reputation Now Sells Crypto Malware
• Federal Remediation Moves From Scores to Context
• FortiGate VPN Logins Exposed at Global Scale
• Mastra Packages Turn npm Install Into Malware Delivery
• JetBrains Plugins Turn AI Keys Into Loot
• Ransomware Affiliates Now Rent EDR Killers
• C2 Takedown Left the Intrusion Alive
• USB Shortcuts and Tor Hide a Wallet Clipper
• Sponsored Downloads Become the Infection Path
• Nearly 15,000 WordPress Sites Pulled From Evil Corp Chain
• Utility Data Breach May Expose OT Access Path
• Exposed Staging Server Shows Perimeter Breaches Spreading Inward
• AI Tools Lower the Cost of Cybercrime
• Maintainer Trust Becomes a Package Supply Chain