Cybersecurity briefing — 2026-06-24

Patching your media server doesn't help if the same vulnerable decoder is bundled inside apps that never advertise it.

• Internet-Facing PeopleSoft Console Becomes Extortion Foothold
• Shared malware supply chain takes a hit
• FortiGate Compromise Becomes a Resale Pipeline
• Dify’s tenant boundary leaks chats and files
• Standard Mac Users Can Silence Endpoint Defenses
• Help Desks Became the New Identity Control Plane
• Cloud Seizure Hits Scam Laundering Backbone
• Klue Token Theft Spreads Beyond One Salesforce Tenant
• Embedded FFmpeg Decoder Exposes More Than Media Players
• Trusted CI Workflows Become the Supply-Chain Weak Point
• Microsoft 365 Collaboration Becomes the New Phishing Path
• PQC Deadlines Now Reach Vendor Contracts
• False Extreme Alerts Shatter Trust in Brazil
• Agentic Browsers Leak Secrets When Context Is Faked
• GitHub Checkout Starts Failing Unsafe PR Workflows
• Transitive npm Trust Becomes the Attack Surface
• AI Patching Shifts the Bottleneck to Review
• AI Skills Marketplace Becomes a Credential Channel
• AI Shrinks the Window for Exposed Assets