EPIC FAILS in Application Development Security practice processes, training, implementation, and incident response
Massive breach spills credentials for thousands of sensitive networks
Firewalls have long been a favorite network entry point for hackers. These devices accept connections from the outside Internet, sit at the perimeter of a network, and have access to valuable resources deep inside.
A massive breach of Fortinet firewalls that has given Russian-speaking attackers near-unrestricted access to some of the world’s largest and most powerful organizations, including Oracle, Chevron, Lenovo, Federal Express, a NATO defense contractor, and Fortinet itself. Nearly 74,000 Fortinet devices from more than 21,000 IP addresses in 194 countries have been compromised and their plaintext credentials exposed online.
The threat actor started by mass-scanning the Internet for FortiGate remote login endpoints. They then used a custom binary with 25,000 threads to spray hundreds of thousands of those endpoints with thousands of login and password combinations.
The attackers went on to actively intercept SSL VPN authentication hashes and crack them using a massive, dedicated 45-GPU cluster managed via Hashtopolis. From there, they used the GPU cluster to crack the hashes. These passwords allowed the threat actors to move laterally to compromise Active Directory environments and other centralized authentication systems.
Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks
Market intelligence platform Klue suffered a OAuth breach that enabled the "Icarus" threat actors to steal Salesforce CRM data from multiple organizations in an ongoing extortion campaign.
Attackers gained access to Klue Battlecards integration service accounts and used OAuth tokens associated with customer Salesforce instances to carry out data theft.
Researchers observed the threat actors generating OAuth tokens and then using automated Python scripts to query Salesforce's REST API for nearly 24 hours.
Activity began with reconnaissance of an organization's Salesforce instances through the '/services/data/v59.0/sobjects' endpoint before exfiltrating data using the '/services/data/v59.0/query'. Attackers slowly mapped out their Salesforce objects to identify valuable objects and then rapidly stole data once they knew what they wanted.
The attacker then hit the same endpoint, sending almost a thousand queries in a 15-minute window in at least one environment
The attackers reportedly used a dormant but still active credential created by Klue for a prototype integration. After gaining access to Klue's environment, they stole customer OAuth tokens and used them to query connected Salesforce environments directly.
Critical Copilot vulnerability allowed hackers to steal 2FA code from users
SearchLeak targets the Enterprise tier of Microsoft, the blast radius isn’t limited to personal data; it’s able to surface anything the user has access to inside the organization including emails, meeting invites and notes. SharePoint documents, OneDrive files, and other indexed business content. Depending on how M365 is connected to the environment, the blast radius could extend even wider.
Security firm Varonis devised an exploit chain that was able to catapult over the guardrails. The first element was what the researchers call a Parameter-to-Prompt Injection. The parameter in this case is the q in a URL, which is used to flag a query that has been included.
AI bots are unable to distinguish between instructions provided by users and those snuck into third-party content the models are summarizing, drafting responses to, or using to perform other actions on behalf of the user. With no way to secure this crucial boundary, Microsoft and its peers are left to erect complicated and ad hoc guardrails designed to rein in the consequences of this incurable gullibility.
Microsoft patched the vulnerabilities that SearchLeak exploited. With no known way to fix the underlying cause of such SNAFUs, however, attackers will inevitably find new ways to circumvent the newly constructed guardrails, and the process will repeat all over again.
Cisco SD-WAN make-me-root bug under attack
The vulnerability, CVE-2026-20262, is in the web UI of Cisco Catalyst SD-WAN Manager, and exists because the software is not properly validating user-supplied input during a file upload process.
[rG: AppSec fundamental best practice is to always treat all application inputs as suspicious: using filtering and malware scanning both on receipt and further read events.]
Microsoft site throwing warnings after someone forgot to renew cert
The connectivity[.]office[.]com domain is used by IT pros to test their network's connectivity to Microsoft 365 and ensure their firewalls aren't blocking anything that could affect an organization's access to Microsoft servers. An SSL server report showed that the certificate expired on June 14.
Certificate renewals are often automated in this day and age, but in organizations still relying on manual processes, those responsible for renewals would almost certainly have received multiple alerts warning of the impending expiration. It suggests that something, or someone, involved in the certificate-renewal process at Microsoft has messed up.
As of March 26, new SSL/TLS certs will have a maximum lifespan of 200 days. This is set to decrease to 100 days by March 15, 2027, and then to 47 days two years later.
Microsoft Working on Patch for ‘RoguePlanet’ Zero-Day
CVE-2026-50656 (CVSS score of 7.8) targets a race condition in Microsoft Defender and allows attackers to gain System privileges.
New unpatchable exploit targets Apple devices with A12 and A13 chips
The attack requires physical USB access and DFU mode, but can let an attacker run code before iOS loads, bypass signature checks, and boot modified software.
The researcher released a proof-of-concept (PoC) exploit that demonstrates local privilege escalation (LPE) on Windows 11 and Windows 10 systems with the June 2026 patches installed.
CISA: Splunk Enterprise flaw actively exploited, patch now
Tracked as CVE-2026-20253, this security flaw affects Splunk Enterprise (versions 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6) and allows remote attackers without privileges to create or truncate arbitrary files on vulnerable devices via a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.
On June 12, days after Splunk released security patches, WatchTowr published a technical write-up, shared proof-of-concept exploit code, and warned that the flaw can be abused for remote code execution attacks.
On June 18, Splunk updated its advisory, urging customers to patch their systems as soon as possible due to evidence of in-the-wild exploitation.
CISA confirmed that threat actors are now actively abusing the CVE-2026-20253 vulnerability in attacks and ordered Federal Civilian Executive Branch (FCEB) agencies to patch their Splunk instances by June 21, as mandated by Binding Operational Directive (BOD) 26-04.
HACKING
Malicious JetBrains Marketplace plugins steal AI API keys from developers
At least 15 malicious plugins found on the JetBrains Marketplace that act as AI coding assistants, code-review tools, and Git utilities powered by popular AI services such as OpenAI, DeepSeek, and SiliconFlow.
Python dev saved from disaster by intuition... and AI
A person claiming to be a recruiter from a small crypto startup got in touch through LinkedIn, looking for help with what she described as proof-of-concept code that didn't work.
The adversary didn't rely on the target executing a suspicious binary; they relied on the target running a routine command: npm install. The repo's package.json file contained a "prepare" post-installation hook designed to run the script following the installation process. By burying the execution logic inside the prepare lifecycle hook within package.json, the malicious payload triggers automatically during dependency resolution.
This isn't a novel technique, but it remains highly effective precisely because developers run npm install on autopilot. The string fragmentation used to assemble the malicious URL, piecing together a domain from small constants, was deliberate obfuscation designed to defeat static analysis tools that scan for hardcoded indicators of compromise.
When the supposed author was contacted, the dev said he had been impersonated on GitHub more than once and didn't write that code.
Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline
A French-speaking attacker broke into a small French automotive business, planted a keylogger, and stole banking and email credentials. Ordinary stuff, until one move near the end.
Before his command-and-control server went dark, he installed OpenSSH and Tailscale on a victim's machine, building a way back in that did not run through the C2 at all. When the Havoc server went offline the next day, his access did not. Eighteen days later, the C2 came back, his agents reconnected on their own, and he carried on.
Take away: When you find a C2, assume it is not the only way in, and go hunting for the quiet persistence layer behind it.
India's Telegram ban hit the UAE too. Here's how to get around it
India has banned Telegram until June 22 after the platform was used to sell access to leaked exam materials. Telegram accuses Indian telecom Reliance of using BGP hijacking to enforce the block, disrupting access for users as far away as the UAE.
The trigger is the National Eligibility-cum-Entrance Test (NEET), India's largest medical entrance exam, taken by millions of students. Question papers were allegedly leaked before the May 3 exam through a paid WhatsApp group and coaching-centre networks in Rajasthan, with reports of a pre-circulated guess paper overlapping heavily with the real test. The exam was cancelled on May 12 and a re-test scheduled for June 21.
The NTA says cheating networks used Telegram channels, groups and bots to sell access to exam material and spread misinformation, and that channel administrators abused the edit feature to backdate posts and pass off altered timestamps as proof of a prior leak. That is the stated reason for the editing restriction running to June 30. The agency described the ban as a "last resort" after channel-by-channel takedowns failed to stop the fraud.
Telegram has built-in support for exactly this scenario. The app ships with a proxy feature, MTProto (also called MTProxy), designed to route traffic around network-level censorship.
It works by obfuscating Telegram traffic and forwarding it through an intermediary node before it reaches Telegram's servers, so an ISP blocking known Telegram IP ranges no longer sees a direct connection.
The traffic stays end-to-end encrypted throughout, and the proxy operator cannot read messages or identify the account, though they can see the connecting IP address.
Anyone affected by the India or UAE disruption can point their app at a working MTProto proxy and restore access without a full VPN.
FBI issues urgent Kali365 security warning for Teams, Outlook, OneDrive users
The agency warned that the hacking platform Kali365 seeks out OAuth device codes, allowing scammers to sneak past multifactor authentication codes, and without the need for a password, to access Microsoft accounts.
The platform is sold to scammers with a $250 per month subscription.
The agency advised users to report phishing emails, suspicious logins and any unauthorized devices or active sessions added to the account to the Internet Crime Complaint Center.
“Dangerous” AI models are coming no matter what
It’s not one model; it’s the general trend of technology. It’s myopic in the extreme to think that no other competitors to Anthropic will develop similar capabilities to Mythos or even that they have not already done so.
Even before this model version, existing AI offerings could be used for advanced vulnerability-hunting and exploit development with a refined harness.
Smaller, cheaper, open-source models, sometimes by themselves and sometimes in concert with each other, can match Mythos/Fable’s performance with more sophisticated prompting.
[rG The real issue isn’t that AI Agents are able to discover and exploit vulnerabilities, but rather unaddressed security risks caused by software development has disregarded ensuring security hardened design and pre-production security vulnerability testing and remediation based on hope of not being targeted and suffering material financial consequences.]
APPSEC, DEVSECOPS, DEV
Why “human in the loop” alone is not a governance strategy
If an organization has chosen a probabilistic system for a high-stakes workflow, the oversight burden is higher; and that must be reflected in how those roles are staffed, trained and supported.
When performance metrics reward speed and governance frameworks nominally reward scrutiny, speed wins. T
The human reviewer brings something no model replicates: a deep understanding of other human beings. The ability to read circumstances, not just data.
When we hold AI to the same standards of trustworthiness we expect from a respected colleague - and invest in the conditions that let human judgment do its job, including the judgment of people whose expertise is human beings and not machines - we stop laundering liability and start building governance. That is the difference between a human in the loop and a human who is accountable. Right now, most organizations are designing for the former. The opportunity is to design for the latter.
Why Amazon hates 'human-in-the-loop' AI governance
But when you actually get down to it, humans are not terribly consistent. Humans, like AI agents and systems, are non-deterministic. Neither can be guaranteed to produce the same output given the same input twice. Both will make mistakes and even make stuff up.
If you put a human inside of this tight loop, and ask them to make approval decisions for agentic tools repeatedly, time after time, they'll do a good job. And then they'll do an okay job. And pretty quickly they'll be doing a poor job.
It’s a gradual process that happens when people in an organization take shortcuts, or don’t follow the established procedures or standards, and sometimes it occurs over years. As long as nothing catastrophic happens, this deviant behavior becomes the norm.
So, as we track agentic activity across our systems, it does not show up in the logs as: ‘Eric did this.’ It shows up as: ‘this agent did this on behalf of Eric.’
It’s to make people pause and think: is this the right way to use this technology? Is this how I should be deploying this? We still have the humans involved, we still have the humans making decisions, but we're trying to play to the strengths of the humans rather than placing them in this unfair, repeated decision making, human-in-the-loop position.
[rG: Just because something can be done doesn’t mean it should.
When reliable, repeatable processing is required, deterministic automation should be used; vs slapping an “AI on it” as a “tech flex”, assuming someone else will provide lifetime monitoring and maintenance, and hoping any negative consequence will be someone else’s problem.]
Smelly config files will make your agents waste tokens, researchers warn
Risky or poorly structured code patterns are known as "code smells," and it turns out coding agent directives can be similarly redolent, leading to wasted tokens and worse output.
Coding agents rely on configuration files that summarize expected agent behavior. These context-enhancing files are commonly written in Markdown and named either CLAUDE[.]md for those using Anthropic models or AGENTS[.]md for pretty much everyone else.
Lint Leakage was the most common smell, affecting 62% of files, followed by Context Bloat (42%) and Skill Leakage (35%)."
Lint Leakage refers to agent instructions that repeat rules already enforced by linters, format checkers, and static analysis tools. Duplicative rules waste tokens by burdening the underlying model with guidance for a task already handled reliably by programmatic tools.
Context Bloat describes the tendency of developers to overspecify code agent behavior. Bloated configuration files increase token consumption, raise costs, and reduce the visibility of important instructions. Anthropic recommends of no more than 200 lines of text.
Skill Leakage occurs when rarely used tools or practices get added to the AGENTS[.]md file, which gets loaded in every agent session. Better is a separate skills file (e.g. SKILLs[.]md) that gets loaded only when needed. Skill leakage also expands the agent's context unnecessarily and potentially distracts agents from other things.
Other agentic odors include:
Blind References, which happens when configuration files reference external documents (e.g. via URLs) without explaining when that resource becomes relevant;
Init Fossilization, configuration details set up upon a project's initialization that are no longer relevant; and
Conflicting Instructions, which occur when agent directives contradict each other.
The Anthropic leader who built Claude Code says he ditched prompting — now he just writes loops
Loop engineering, the practice of designing automated agent workflows instead of prompting manually, is reshaping how developers use Claude Code and OpenAI Codex.
Loop engineering is “replacing yourself as the person who prompts the agent.” It is an orchestration pattern that combines scheduled execution, isolated workspaces, verifier agents, and persistent memory to transform a coding agent into an autonomous software worker.
VENDORS & PLATFORMS
Coding agents have questions, too; so Stack Overflow built them a home
Stack Overflow for Agents is an API-first platform that extends its knowledge-sharing model to AI coding agents.
The platform is organized around three post types, each capturing a distinct kind of knowledge.
Questions document unsolved problems and what’s already been tried.
TILs, “Today I Learned” posts, record debugging traces and undocumented behaviors discovered during live work; Stack Overflow considers these the highest-signal contributions, since they capture precisely what’s absent from a model’s training data.
Blueprints are reusable design patterns intended to hold across many similar builds and to set the highest quality bar as a result.
Whether agents will generate the kind of durable, peer-tested knowledge that made Stack Overflow indispensable to human developers remains to be seen. But the underlying problem, millions of agents solving the same things independently, with nothing to show for it, is real enough that several serious efforts are now pointed at it.
AWS hypes continuous agentic DevOps, puts Kiro in your pocket
AWS Continuum currently includes two products.
Continuum for code vulnerabilities performs vulnerability scans of an AWS environment and is claimed to prioritize findings that are actually reachable in a production path, with exploits demonstrated in a sandbox. The tool will also generate suggested fixes such as network changes or patches for the code. The existing AWS Security Agent will be renamed "Continuum pen testing" and "Continuum code scanning".
The AWS DevOps agent is billed as an AI tool that can resolve and prevent application outages and optimize application reliability and performance. DevOps Agent is gaining release management capabilities, which assess code readiness and run software in an AWS-managed isolated environment to verify the builds.
Users cry foul after AMD stripped memory crypto from its consumer CPUs
A decade ago, AMD added a protection to its high-end CPUs to protect them against cold boot attacks and other types of physical exploits that siphon sensitive data out of the connected memory chips. Short for Transparent Secure Memory Encryption, TSME encrypts the entire contents stored in memory, making the data useless to physical attackers.
Recently and without warning or notice, this lower-end line of AMD chips suddenly dropped the protection.
Consumer versions of Ryzen running on MSI and Gigabyte motherboards had TSME enabled when an older firmware version, available exclusively through the AMD Generic Encapsulated Software Architecture (AGESA), described here, was used during the boot process. When the firmware in a newer AGESA, specifically version 1.2.7.0, ran instead, TSME showed as “not supported.” Pro versions of the Ryzen CPU supported TSME across both motherboards and AGESA versions.
Windows and Linux users: The deadline to update Secure Boot keys is near
Beginning June 24, three certificates that cryptographically verify that each piece of firmware and software that loads during system boot will expire. The Microsoft-signed certificates are the linchpins of Secure Boot, a Microsoft-designed chain of trust. Secure Boot checks the digital signatures of all firmware that loads during system startup to ensure it originates from a trusted provider, such as the manufacturer of the motherboard the system runs on.
Salesforce reels in customer support AI specialist Fin for $3.6B
Fin, formerly known as Intercom, is an AI customer service agent designed to handle support requests across platforms including live chat, email, WhatsApp, SMS, Slack, and phone. Fin says that the system is powered by its proprietary Apex model, built specifically for customer support workloads.
SpaceX to acquire AI coding platform Cursor for $60 billion
xAI-turned-SpaceX’s Grok chatbot has been riddled with controversies, but its lack of a competitive coding model or harness has also been a strategic weakness. The tool has largely been stuck in an older, chatbot-centric paradigm, compared to offerings from Anthropic, Google, and OpenAI.
Cursor had good talent and a strong product, but it couldn’t compete with larger companies on compute. SpaceX had the capacity but lacked the product and models to be competitive.
Midjourney pivots from AI image generation to body scanning medical spa where patients bathe in 'golden light'
Midjourney announced the establishment of Midjourney Medical. To promote the tech, it claims to be opening a spa in San Francisco where guests will be able to step “into a shallow pool of golden light,” before being lowered into a tank where ultrasound sensors bombard their bodies in order to take a scan that AI pieces together into MRI-like images.
The Midjourney Scanner, as the company has named it, can capture tissue details up to half a millimeter, which is on par with standard clinical MRIs.
[rG: Hmmm, another biometric identity factor - full body identification hash?]
LEGAL & REGULATORY
Defense contractor settles cybersecurity False Claims Act allegations
LOGZONE, an Alabama-based logistics services provider who received more than $682,000 under the contracts, has agreed to pay more than $507,000 to resolve allegations that it misrepresented its compliance with Pentagon cybersecurity requirements while doing work with the Navy.
The Justice Department alleged that LOGZONE failed to fully implement required security controls under NIST Special Publication 800-171 despite its contract mandating compliance. While not an explicit violation of the Cybersecurity Maturity Model Certification (CMMC) program, the suit highlights the Defense Department’s increasing scrutiny of the defense industry not implementing required cybersecurity measures for sensitive information.
NIST SP 800-171 establishes cybersecurity requirements for defense contractors that handle controlled unclassified information (CUI) on non-federal systems. The framework includes 110 security controls covering areas such as access management, incident response, system monitoring, and risk management against which vendors must self-assess compliance.
UK to require ID or face scan before you can make social media accounts
The UK government will ban under-16s from social media, with regulations due before Christmas and the rules taking effect in spring 2027.
To enforce it, platforms must age-check their users. In practice that means anyone opening a new account will likely have to prove they're over 16 by uploading an ID or passing a facial age scan, the same checks that adult sites serving UK visitors have implemented since July 2025 under the Online Safety Act.
Long-standing accounts are largely exempt, but signing up fresh now triggers verification, effectively ending anonymous account creation in the UK.
The ban is modelled on Australia's, which took effect in December 2025 and was the first of its kind.
The well-documented weakness is that a VPN defeats all of it. The Online Safety Act targets sites, not users, so connecting through a server outside the UK sidesteps the check.
Estonia intends to recognize AI agents with digital IDs
Estonia plans to allow AI agents to have their own digital identities so they can act on behalf of people in a way that can be verified and audited.
OWASP proposed the Agent Name Service for agent discovery and interoperability. DNS for AI Discovery is another such project. But these have more to do with platform plumbing while Estonia, known for its embrace of technology, is more focused on permission and punishment.
In a pre-print paper last year titled "AI Agents and the Law," Georgia Institute of Technology professors observe that once AI agents have the ability to act in a way that changes the state of the world – e-commerce transactions as opposed to output that requires human interaction for effect – concerns about harm become more pressing. They note that while the law is well equipped to deal with conflicts arising from human agents, it's not well-suited to the possibilities of software agents.
France to stop certifying products without quantum-safe encryption
The threat could emerge by the mid-2030s and the Elliptic Curve Digital Signature Algorithm, or ECDSA, a standard used in blockchain, could be among the first systems broken.
The industry faces a dual compliance burden: auditing products and securing all the data to meet ANSSI, the EU Commission and U.S. NIST requirements.
