Cybersecurity briefing, 2026-06-18

Here's the line for your standup: Salesforce data walked out the door, and nobody stole a Salesforce password.

• Trusted plugin updates became the payload
• Port ransomware reaches through cloud identity
• Trusted Salesforce access became the blast radius
• Fake reputation now sells crypto malware
• Frontier AI meets broken basics
• FortiBleed becomes a credential-resale problem
• North Korea attribution expands Mastra poisoning risk
• JetBrains plugins turn AI keys into loot
• Ransomware affiliates rent kernel-grade EDR killing
• C2 takedown left the intrusion alive
• USB worms now hide behind Tor
• Sponsored downloads become the infection path
• SocGholish takedown leaves reinfectable CMS estates
• Utility data breach may expose OT access path
• Exposed staging server shows perimeter breaches spreading inward
• AI tools lower the cost of cybercrime
• Maintainer trust becomes a package supply chain

Recent editions

• Wednesday, June 17, 2026: Port ransomware reaches through cloud identity · 16 stories
• Tuesday, June 16, 2026: SprySOCKS gains a hidden Windows control channel · 19 stories
• Monday, June 15, 2026: Stolen CDN keys turn plugin scripts into backdoors · 8 stories
• Sunday, June 14, 2026: Splunk’s control plane is now the target · 2 stories
• Saturday, June 13, 2026: AUR builds become the payload path · 9 stories
• Friday, June 12, 2026: AI mass-produces phishing faster than defenses can block · 17 stories
• Thursday, June 11, 2026: Netlogon exploit puts Active Directory at risk · 13 stories