Cybersecurity briefing, 2026-06-26

Malware evasion used to mean hiding from the sandbox.

• Bespoke backdoor marks CL-STA-1062’s next stage
• Repo opens became live cloud compromise
• Joomla plugin upload feature becomes server takeover path
• Trusted Salesforce access became the blast radius
• Criminal malware assembly lines are being torn down
• Malware now targets the analyst’s AI triage
• Recovery keys let messaging account theft persist
• Standard Mac users can silence endpoint defenses
• Residential IPs are becoming a shared crime layer
• Turla reuses KAZUAR to extend its espionage platform
• FCC expands cybersecurity rules to alerting and cable gates
• One breached maintainer reaches npm, Go, and Actions
• Public exploits now feed a custom Cobalt Strike loader
• Supplier breach turns Polymarket site into theft point
• Europe’s ransomware surge reaches suppliers
• CISA shifts visibility with SASE adoption
• Vendor cutoff failed to stop seized-device forensics

Recent editions

• Thursday, June 25, 2026: Internet-facing PeopleSoft console becomes extortion foothold · 17 stories
• Wednesday, June 24, 2026: Criminal malware assembly lines are being torn down · 19 stories
• Tuesday, June 23, 2026: Embedded FFmpeg decoder exposes more than media players · 20 stories
• Monday, June 22, 2026: Trusted plugin updates became the payload · 16 stories
• Sunday, June 21, 2026: Infected routers become a hidden scanning fabric · 4 stories
• Saturday, June 20, 2026: Gravity SMTP bug exposes mail-sending credentials · 11 stories
• Friday, June 19, 2026: Ransomware affiliates rent kernel-grade EDR killing · 13 stories