Cybersecurity briefing, 2026-06-26

Malware evasion used to mean hiding from the sandbox.

• Bespoke Backdoor Marks CL-STA-1062’s Next Stage
• Repo Opens Became Live Cloud Compromise
• Joomla Plugin Upload Feature Becomes Server Takeover Path
• Trusted Salesforce Access Became the Blast Radius
• Criminal Malware Assembly Lines Are Being Torn Down
• Malware Now Targets the Analyst’s AI Triage
• Recovery Keys Let Messaging Account Theft Persist
• Standard Mac Users Can Silence Endpoint Defenses
• Residential IPs Are Becoming a Shared Crime Layer
• Turla Reuses KAZUAR to Extend Its Espionage Platform
• FCC Expands Cybersecurity Rules to Alerting and Cable Gates
• One Breached Maintainer Reaches npm, Go, and Actions
• Public Exploits Now Feed a Custom Cobalt Strike Loader
• Supplier Breach Turns Polymarket Site Into Theft Point
• Europe’s Ransomware Surge Reaches Suppliers
• CISA Shifts Visibility With SASE Adoption
• Vendor Cutoff Failed to Stop Seized-Device Forensics

Recent editions

• Thursday, June 25, 2026: Internet-Facing PeopleSoft Console Becomes Extortion Foothold · 17 stories
• Wednesday, June 24, 2026: Internet-Facing PeopleSoft Console Becomes Extortion Foothold · 19 stories
• Tuesday, June 23, 2026: Embedded FFmpeg Decoder Exposes More Than Media Players · 20 stories
• Monday, June 22, 2026: Trusted Plugin Updates Became the Payload · 16 stories
• Sunday, June 21, 2026: Infected Routers Become a Hidden Scanning Fabric · 4 stories
• Saturday, June 20, 2026: Gravity SMTP Bug Exposes Mail-Sending Credentials · 11 stories
• Friday, June 19, 2026: Ransomware Affiliates Rent Kernel-Grade EDR Killing · 13 stories