Latest CyberSec News by @thecyberpicker

REYKJAVIK, Iceland, June 16, 2026 — Varist today introduced its DICOM Detection Engine™, a specialized system designed to safeguard electronic health records (EHR) and picture archiving and communication systems (PACS) from all known malware, including the emerging threat of AI-powered malware. As attackers increasingly use artificial intelligence to automate, scale and customize their attacks, the engine

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has given U.S. government agencies three days to secure their servers against an actively exploited vulnerability (CVE-2026-54420) in the LiteSpeed cPanel user-end plugin.

209 patches + 388 advisories = welcome to summer 2026

DragonForce ransomware used a custom malware named 'Backdoor.Turn' to hide command-and-control traffic inside Microsoft Teams relay infrastructure.

ESET found two Windows SprySOCKS variants with 30+ commands, C2 over TCP, UDP, and WebSocket, and government targets in 4 countries.

Attackers are exploiting three Fortinet FortiSandbox flaws, including one patched last week, risking auth bypass and command execution.

North Korea-linked ScarCruft uses fake Microsoft Account alerts and ZIP files to deliver NarwhalRAT, a Python RAT built for data theft.

Windows variants for the SprySOCKS Linux malware have been used in attacks targeting government organizations in at least four countries.

The LiteLLM vulnerability chain lets low-privilege users take over AI gateway servers. CISA confirmed exploitation. Patch now and rotate all API keys.

Attackers are now exploiting several critical vulnerabilities in Fortinet's FortiSandbox cyber threat detection platform, according to threat intelligence company Defused.

U.S. CISA adds Cisco Catalyst and LiteSpeed cPanel plugin flaws to its Known Exploited Vulnerabilities catalog.

Six mois après avoir reconduit son contrat avec le géant américain Palantir, le renseignement intérieur français change de cap. Sébastien Lecornu en a fait l'annonce ce mardi 16 juin 2026, en parallèle d'un investissement massif dans l'IA souveraine. « Le temps de la généralisation commence. » C'est par cette formule

Since late 2025, malware has been spreading rapidly through the Steam Workshop. In most cases, we caught old, familiar threats such as DarkKomet, the Lumma and Vidar infostealers.

China's UNC6508 hid in North American medical research networks for 2 years, stealing credentials and forwarding emails to Gmail

Kyiv peut désormais activer l'assistance d'urgence européenne face aux cyberattaques de grande ampleur. Une décision symbolique autant que stratégique. Depuis ce lundi 15 juin 2026, l'Ukraine fait officiellement partie de la réserve de cybersécurité de l'Union européenne. Le Conseil de l'UE a approuvé son intégration

A concise guide for CISOs on MCP risks and governance, with steps to secure AI agents, controls, and testing.

CISA added CVE-2026-54420 to KEV, requiring federal agencies to patch LiteSpeed cPanel root escalation by June 18, 2026.

Cisco patched CVE-2026-20262 in Catalyst SD-WAN Manager after limited exploitation, with federal fixes due June 29.

Digital healthcare company iRhythm Holdings has disclosed a data breach after hackers stole patients' personal and health information stored on third-party-hosted business applications.

The U.S. Department of Justice announced Friday that it has seized the CFAKE.com and SOCFAKE.com websites, which allegedly hosted nonconsensual AI-generated nude images and videos of women, in what appears to be the first publicly announced domain seizure under the TAKE IT DOWN Act.

Google says UNC6508 used REDCap backdoors and Workspace rules to copy research and defense emails across U.S. and Canadian networks.

A vulnerability in the SimpleHelp remote management software allows unauthenticated attackers to create privileged technician accounts on servers using the OpenID Connect (OIDC) authentication protocol.

The revelation mirrors an alarming pattern of Chinese espionage groups dropping backdoors into critical infrastructure to intercept research and steal data with national security implications.

We found EtherRAT malware being distributed by a website with a strange homepage. Following the trail, we discovered a vast network of malicious infrastructures, distributing malware, malicious documents, remote desktop software, and phishing pages.

Proofpoint says UNK_DeadDrop sent 250+ phishing emails to nearly 100 firms, using GitHub and VS Code lures to steal credentials and wallet data.

Mackay Sugar, Australia's second-largest sugar producer, disclosed a cyberattack on June 10, potentially affecting key processing operations.

Maine closes data breach portal to the public after fake reports

WordPress plugins OptinMonster, TrustPulse, and PushEngage have been compromised in a supply-chain attack impacting Awesome Motive-s content distribution network (CDN).

Cisco has released security updates to address a vulnerability in the Catalyst SD-WAN Manager, tracked as CVE-2026-20262, that was exploited in attacks to escalate to root privileges.

Three LiteLLM flaws let low-privilege users gain admin access and run code, exposing AI keys, secrets, prompts, and responses.