Krebs on Security

Microsoft released a record 200 security patches in June 2026's Patch Tuesday, with 30 critical vulnerabilities and public exploits for three flaws. AI tools are increasingly used to discover bugs, and researcher Nightmare Eclipse disclosed multiple zero-day exploits, including CVE-2026-49160 and CVE-2026-50507, sparking controversy over Microsoft's legal stance on researchers.

Hackers exploited Meta’s AI support bot to reset passwords and briefly deface high-profile Instagram accounts, including the Obama White House and the U.S. Space Force’s Chief Master Sergeant. The method involved using a Telegram video to demonstrate tricking the AI into linking accounts to new emails, enabling unauthorized access. Meta issued an emergency patch to address the vulnerability.

The Netherlands seized 800 servers and arrested two individuals for operating IT infrastructure used by Russia to conduct cyberattacks and disinformation campaigns in the EU. The arrested men, Andrey Nesterenko and Youssef Zinad, were linked to Stark Industries Solutions, a sanctioned provider of cyberattack tools, and their Dutch-based hosting companies MIRhosting and WorkTitans BV.

A CISA contractor intentionally published AWS GovCloud keys and sensitive agency credentials on a public GitHub account, prompting Congressional lawmakers to demand answers. The breach exposed plaintext credentials to dozens of internal CISA systems and occurred amid significant staff losses at the agency following Trump administration-ordered retirements and resignations.

Canadian authorities arrested 23-year-old Jacob Butler, also known as 'Dort', for operating the Kimwolf botnet that infected millions of IoT devices and launched massive DDoS attacks exceeding 30 Terabits per second. Butler faces criminal charges in both Canada and the United States, with the botnet's infrastructure seized in March alongside three other competing DDoS botnets. The arrest followed Butler's harassment campaigns against security researchers and victims whose financial losses exceeded one million dollars.

A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) exposed credentials to AWS GovCloud accounts and internal CISA systems on a public GitHub repository. The leak included files detailing how CISA builds, tests, and deploys software internally. The exposed credentials represent a significant government data leak.

Microsoft released software updates to address at least 118 security vulnerabilities in its various Windows operating systems and other products on Patch Tuesday. This is the first Patch Tuesday in nearly two years that Microsoft is not shipping any fixes to deal with emergency zero-day flaws. The patches include critical vulnerabilities such as CVE-2026-41089 and CVE-2026-41096.

A cybercrime group called ShinyHunters has breached the education technology platform Canvas, disrupting classes and coursework at schools and universities across the US, and is demanding a ransom to prevent the publication of stolen data. The breach affects nearly 9,000 educational institutions and millions of students and faculty. Canvas parent firm Instructure has disabled the platform in response.

A Brazilian DDoS protection firm, Huge Networks, was found enabling a botnet that launched massive DDoS attacks against Brazilian ISPs. The CEO claims the attacks resulted from a security breach by a competitor aiming to damage the company's reputation.

Tyler Robert Buchanan, a senior member of the cybercrime group Scattered Spider, pleaded guilty to wire fraud conspiracy and aggravated identity theft for his role in 2022 SMS phishing attacks that compromised major tech companies and stole $8 million in cryptocurrency. He faces over 20 years in prison and was linked to phishing domains registered under his UK-based IP address.

Microsoft released critical security patches addressing 167 vulnerabilities, including zero-day flaws in SharePoint Server and Windows Defender. Other vendors like Google and Adobe also issued updates for active exploits, with experts highlighting the significance of these vulnerabilities and the surge in reported bugs.

Russian military intelligence units, known as Forest Blizzard or APT28, used DNS hijacking to steal Microsoft Office authentication tokens from over 18,000 routers, primarily targeting government agencies.

German authorities have identified Daniil Maksimovich Shchukin, known as UNKN, as the head of ransomware groups GandCrab and REvil, responsible for over $2 million in extortions.

A financially motivated data theft and extortion group known as TeamPCP is using a worm called CanisterWorm to wipe data on infected systems that use Iran’s time zone or have Farsi set as the default language.

The U.S., Canada, and Germany dismantled four IoT botnets named Aisuru, Kimwolf, JackSkid, and Mossad, which were responsible for numerous DDoS attacks on IoT devices.

Iran-backed hacktivist group Handala claimed responsibility for a data-wiping attack on Stryker, a global medical technology company, in retaliation for a U.S.-attributed missile strike that killed many children.

Microsoft released security updates for Windows and other software to fix 77 vulnerabilities, including critical remote code execution flaws in Microsoft Office.

AI assistants like OpenClaw are becoming more popular among developers and IT workers but pose significant security risks due to their autonomous capabilities.

The article discusses the identity and activities of 'Dort', the botmaster behind Kimwolf, the world's largest and most disruptive botnet.

Starkiller is a new phishing service that dynamically loads real login pages and forwards user credentials to attackers, offering real-time session monitoring and account takeover capabilities.