International

Cybersecurity researchers have warned of a “massive, ongoing, automated password spray attack” aimed at Microsoft’s Azure command-line interface (CLI), compromising dozens of accounts in the process. According to Huntress, the activity comes from an IPv6 address range (2a0a:d683::/32) managed by the internet provider LSHIY LLC (AS32167). “Between June 12 and …

The Linux Foundation said on Thursday that they are starting a new project to fix flaws in open source software (OSS) more effectively. Akrites sets up a shared Security Incident Response Team (SIRT) to work together on finding, fixing, and sharing OSS security problems. If it sounds familiar, it should. Less …

Anthropic said that Claude Mythos 5, its strongest AI security model, will be sent back to some U.S. orgs that manage and protect important systems. This comes after a government review that started on June 12, 2026. The model showed a unique skill to find software problems on its own, …

A complex phishing attack targets AWS console users by misusing Cloudflare-hosted websites to steal login details. Each domain had a nearly identical copy of the AWS login page. It used a server-driven process that switched to email, SMS, or authenticator-app MFA challenges, allowing for real-time collection of second factors. The phishing …

WhatsApp is rolling a new security warning on Android and iOS. It shows up before users open a chat with an unknown number. WABetaInfo said this feature shows the country of the phone number, if it’s saved in contacts, and if any groups are shared. This helps users think twice …

Test before going live is important for AI developers. But there’s a problem: testing usually uses fake scenarios that often do not reflect how AI models or agents act in real life. A new paper from OpenAI says that about 99% of the time, its models realized they were being …

Brazil’s government suspects a hacking attack triggered an unauthorized ‌alert sent to cell phones across parts of the country early on Saturday. In a statement, the National ⁠Protection and Civil Defense Secretariat said the country’s citizens’ notification system was taken offline at around 1:30 a.m. local time (0430 GMT) after …

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) asked Fortinet users with FortiGate devices on Thursday to act to protect against harmful attacks on many internet-connected devices. The large campaign, thought to be done by Russian-speaking hackers, is called FortiBleed. There are 86,644 targeted devices as of June 19, 2026. …

A new Android banking trojan called Rokarolla is hitting 217 banking and cryptocurrency apps with a wide range of 137 commands. The harmful software spreads through bad websites pretending to offer the Google Chrome or TikTok app and can gain full control over a hacked device. Its abilities include stealing …

A serious pre-authentication remote code execution (RCE) flaw in Splunk Enterprise has been revealed, earning a very high CVSS score of 9.8. Tracked as CVE-2026-20253, Splunk shared the flaw on June 10, 2026. It impacts the PostgreSQL Sidecar Service that came with Splunk version 10. The root cause of CVE-2026-20253 lies …