Latest CyberSec News by @thecyberpicker

A newly discovered data leak dubbed "FortiBleed" has exposed what appears to be a collection of Fortinet and FortiGate VPN credentials for 73,932 firewall URLs at organizations worldwide.

Explore five AI governance practices to build trust, reduce risk, and advance ISO 42001-certified AI programs.

Account takeovers are rising as attackers bypass traditional defenses through phishing, session hijacking, and MFA fatigue. Specops Software explores how device trust and continuous verification help reduce account takeover risk.

India has banned Telegram until June 22 after the app was used to circulate leaked exam papers. CEO Pavel Durov accuses telecom Reliance of BGP hijacking that disrupted the app as far away as the UAE. Here's what happened, and how to get around the block with an MTProto proxy.

This week in cybersecurity from the editors at Cybercrime Magazine

London, United Kingdom, 17th June 2026, CyberNewswire

Intruder analyzed 3,000 attack surfaces and found 60% exposed HTTP panels, 49% risky ports, and 42% internet-facing databases.

Adversarial Exposure Validation helps security teams confirm exploitable risks and prioritize remediation beyond raw vulnerability findings.

Amid discussions about how artificial intelligence can facilitate cybercrime, some threat actors remain skeptical

Rokarolla Android malware targets 217 banking and crypto apps, steals credentials, blocks bank calls, intercepts SMS, disables Play Protect

Sansec found a critical template injection flaw in JTL Shop, one of the leading German ecommerce platforms, that lets an anonymous attacker steal database cr...

Microsoft is investigating a new issue preventing third-party applications from launching Microsoft Office applications or opening documents on up-to-date Windows systems.

Researchers found an exposed collection of 24 billion stolen records, including usernames, passwords, and other sensitive account data.

On 14 April, the Trump administration quietly acknowledged the widespread use of AI to automate government processes. The office of management and budget (OMB) disclosed a staggering 3,611 active or planned use cases for AI across the federal government. The list has ballooned by 70% from the one published in the final year of the Biden administration, and includes many disturbing-seeming plans to hand over sensitive governmental functions to AI. Scanning this list, many readers may find many causes for alarm. It represents a transfer of decision processes from human to machine on a massive scale over matters of individual freedom, public health and well-being, nuclear reactor safety and more...

Introducing Session Switcher. Swap Burp Sessions with One Click!

FulcrumSec leaked data stolen from Novo Nordisk, claiming to have exfiltrated 1.3TB, including clinical records and AI research assets.

EdTech firms face rising cyberattacks as ShinyHunters and FulcrumSec target schools, exposing sensitive data and disrupting services.

Malwarebytes got top marks in independent tests against malware, phishing, and other online threats.

Splunk CVE-2026-20253 is a CVSS 9.8 pre-auth flaw letting attackers write files and reach RCE. A public PoC exists.

Researchers found 15 malicious JetBrains plugins posing as AI coding tools that exfiltrate OpenAI, DeepSeek, and SiliconFlow API keys.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity flaw in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited in the wild.

China-linked FishMonger used two SprySOCKS Windows variants that leveraged kernel drivers and the Print Spooler to target governments.

Dans une série de messages publiés sur les réseaux sociaux, Arthur Mensch, PDG de Mistral AI, a profité de l’attention accrue portée à l’entreprise ces jours-ci pour esquisser la suite de sa stratégie et renforcer son positionnement dans l'intelligence artificielle. Depuis plusieurs jours, Mistral se retrouve sous

Microsoft confirmed that it's working on a security patch for a Defender zero-day vulnerability named "RoguePlanet," disclosed one week ago.

Kodak has confirmed that it's working with external cybersecurity experts to investigate a security breach after hackers gained access to some of the company's data.

144 Mastra npm packages added easy-day-js malware, exposing developer systems and CI runners to infostealer risks.

CISA added CVE-2026-48907 in Joomla JCE to its KEV catalog after active exploitation; fixes are due by June 19.

At least 15 malicious plugins found on the JetBrains Marketplace were designed to steal AI API keys from developers.