Anthropic Launches Claude Sonnet 5 as US Lifts Export Ban on Fable 5 and Mythos 5 AI Models
Anthropic closed out June with a one-two punch: the launch of Claude Sonnet 5 on June 30 and the simultaneous lifting of U.S. export restrictions on its most powerful models,…
Nissan Employee Data Breached via Oracle PeopleSoft Zero-Day — ShinyHunters Campaign Hits Hundreds of Organizations
Nissan has confirmed a data breach affecting current and former employees across the U.S., Canada, Mexico, and Brazil after attackers exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft, the enterprise…
Microsoft Warns Poisoned MCP Tool Descriptions Can Silently Hijack AI Agents for Data Exfiltration
Microsoft Incident Response and its Defender security research team have published a detailed advisory warning that attackers can hijack AI agents — including those integrated with Microsoft 365 Copilot, Copilot…
macOS XPC Flaw (CVE-2026-39118) Lets Standard Users Silently Kill CrowdStrike, Kandji, and Other Enterprise Security Agents
Security researchers at XM Cyber have publicly disclosed CVE-2026-39118, a macOS vulnerability that allows a standard (non-root) user to silently disable Endpoint Detection and Response (EDR) and Mobile Device Management…
Aflac Japan Breach Exposes 4.38 Million Customers — Sensitive Financial and Personal Data Exfiltrated Over 10-Day Window
Insurance giant Aflac has disclosed a major data breach impacting approximately 4.38 million customers and agents of its Japanese subsidiary. The intrusion, which ran undetected between June 15 and June…
EvilTokens — AI-Powered Phishing-as-a-Service Operation Drives 1,380% Surge in Microsoft 365 Device-Code Phishing
Summary Researchers have detailed “EvilTokens,” a sophisticated AI-powered phishing-as-a-service (PhaaS) operation that abuses Microsoft’s legitimate OAuth 2.0 device-code authentication flow to steal Microsoft 365 tokens at industrial scale. The operation…
Tata Electronics Hit by World Leaks — 630GB Allegedly Stolen from Apple and Tesla Supplier
Summary Indian electronics and semiconductor manufacturer Tata Electronics has confirmed a cyberattack and data breach, with the “World Leaks” threat group claiming to have exfiltrated 630GB of sensitive data. Tata…
SimpleHelp Auth Bypass Weaponized to Deploy Djinn Stealer — A Cross-Platform Infostealer Targeting Cloud and AI Credentials
Summary A critical authentication bypass vulnerability in SimpleHelp (CVE-2026-48558), a popular remote monitoring and management (RMM) platform, is being actively exploited to deploy “Djinn Stealer” — a previously undocumented cross-platform…
Critical Oracle E-Business Suite Flaw Exploited in the Wild — Unauthenticated Instance Takeover via Payments Component
Summary Attackers are actively exploiting CVE-2026-46817, a critical improper privilege management and authentication flaw in Oracle E-Business Suite’s Oracle Payments component. The vulnerability allows unauthenticated attackers with HTTP network access…
Agentjacking — New Attack Class Hijacks AI Coding Agents Through Sentry Error Injection with 85% Success Rate
Summary Security firm Tenet Security has disclosed “agentjacking,” a novel attack class that enables threat actors to hijack AI coding agents — including Anthropic’s Claude Code and Cursor — by…