Cybersecurity briefing, 2026-06-19

• Ransomware affiliates rent kernel-grade EDR killing
• Exposed staging server shows perimeter breaches spreading inward
• Trusted plugin updates became the payload
• USB worms now hide behind Tor
• Leaked Fortinet credentials turn edge access persistent
• Metasploit turns Paperclip AI into a live target
• North Korea attribution expands Mastra poisoning risk
• ISE-PIC patch paths now depend on version
• Apple’s relay domain becomes a shared failure point
• Sponsored downloads become the infection path
• Beats Buds stay vulnerable until they reconnect
• Splunk admin helper breaks out to host commands
• Legacy Azure AD recon finally leaves a trace

Recent editions

• Thursday, June 18, 2026: Trusted plugin updates became the payload · 17 stories
• Wednesday, June 17, 2026: Port ransomware reaches through cloud identity · 16 stories
• Tuesday, June 16, 2026: SprySOCKS gains a hidden Windows control channel · 19 stories
• Monday, June 15, 2026: Stolen CDN keys turn plugin scripts into backdoors · 8 stories
• Sunday, June 14, 2026: Splunk’s control plane is now the target · 2 stories
• Saturday, June 13, 2026: AUR builds become the payload path · 9 stories
• Friday, June 12, 2026: AI mass-produces phishing faster than defenses can block · 17 stories