Progress Software has told ShareFile customers to immediately shut down the on-premises Windows servers running Storage Zone Controllers, citing a "credible external security threat" against its enterprise file-sharing platform. The company has temporarily disabled access to affected accounts and says it has no sign of unauthorized access yet, but it has not disclosed what the threat is or whether a vulnerability is involved. Ordering a full shutdown rather than a patch strongly suggests there is no fix available. Only self-hosted Storage Zone Controllers, which typically sit internet-facing at the network edge, are affected, not cloud-only ShareFile. Progress also makes MOVEit, whose 2023 zero-day was mass-exploited by the Clop group.
Researchers at Binarly found six flaws in U-Boot, the open-source bootloader inside routers, IoT devices, industrial systems, and the management chips of data-center servers. All six are triggered while U-Boot is still reading an untrusted firmware image, before it verifies the signature, so an attacker who supplies a malicious image can act before the trust check runs. Two of the flaws can lead to arbitrary code execution at boot, undermining the whole chain of trust, while the other four crash the device. The vulnerable code dates back to 2013, affecting many releases and vendor forks. Exploiting them does not always need physical access: a compromised management interface could push a malicious image.
Zimbra is urging customers to update after fixing a critical stored cross-site scripting flaw in the Classic Web Client of its widely used email and collaboration platform. A specially crafted email can run malicious scripts when it is simply opened, potentially exposing mailbox contents, session data, and account settings, and enabling session hijacking or credential theft. The flaw, reported by Google's Threat Analysis Group, has no CVE assigned yet and is not confirmed as exploited, but the group often surfaces bugs used by state-backed actors. Zimbra's web client has been a repeated target: Russian-linked groups have exploited similar cross-site scripting flaws against government and military organizations. Updating to version 10.1.19 fixes it.
Researchers at Socket uncovered a network of 222 GitHub repositories, tracked as Operation Muck and Load, built to spread Windows malware through a fake Go module posing as a DNS and subdomain scanner. Running the module quietly launches PowerShell that pulls an encrypted payload from attacker infrastructure and deploys infostealers, remote access trojans, and cryptominers. To look trustworthy, the operators used an automated workflow that force-pushes fake commits every minute, making repositories appear actively maintained and generating hundreds of package versions. More than 700 of the module's 1,200-plus versions were malicious. The lures cluster around crypto wallets, Telegram bots, and game cheats, aimed at people likely to run untrusted code.
A cybercrime group left its own server exposed on the internet for weeks, revealing a mass website-hacking operation that researchers at SOCRadar now track as WP-SHELLSTORM. The crew breaks into sites at scale, plants hidden backdoors, and resells the access to other criminals. Rather than using zero-days, it automated attacks against 27 known vulnerabilities in outdated WordPress and Joomla plugins; a single flaw in the Breeze caching plugin accounted for over 17,000 backdoored sites. Target lists named more than 1.4 million domains, with roughly 25,000 confirmed compromised. The same server also revealed an earlier campaign that stole cloud credentials and database passwords from exposed configuration servers.
Researchers at Wiz disclosed GhostApproval, a technique that abuses symbolic links to make AI coding assistants write to sensitive files outside the project. A malicious repository includes a symlink named like an innocent file, such as project_settings.json, that actually points to the developer's SSH authorized_keys or shell startup file. When the developer asks the agent to set up the workspace, it follows the link and writes attacker content, such as an SSH key granting passwordless access. The deeper problem is that the approval prompt shows only the harmless filename, not the real target, so the human approves a change they cannot see. Wiz tested six assistants including Claude Code and Cursor.
US auto insurer AssuranceAmerica has confirmed a breach affecting nearly 6.9 million people, the largest known exposure of Americans' driver's license data this year. The company detected the intrusion on March 17 after attackers compromised a single employee's credentials the day before and copied data files, but a lengthy review of the files was not finished until June 15, delaying notifications until now. The stolen data includes names, contact details, driver's license numbers, auto insurance policy and claims information, and, for some people, Social Security numbers. AssuranceAmerica has not detailed how the employee's credentials were taken, though such incidents are often tied to phishing or credential-stealing malware.
Attackers compromised a legitimate maintainer's GitHub account for the Injective blockchain SDK and used it to push a malicious version of the widely used @injectivelabs/sdk-ts npm package, which has around 50,000 weekly downloads. The tainted code, disguised as usage telemetry, hooked the SDK's wallet key-generation functions to capture private keys and seed phrases, then sent them to a server made to look like legitimate Injective infrastructure. Trusted-publishing automation spread the malicious release across 18 packages within minutes, though it was live under an hour before being pulled. Because the theft can reach apps that used the SDK only indirectly, any wallet keys handled by affected versions should be treated as compromised.
A new phishing-as-a-service platform called Forg365 is built to steal Microsoft 365 accounts, combining adversary-in-the-middle and device-code phishing with AI-generated lures created directly in its control panel. Researchers at ZeroBEC found the panel lets operators build campaigns, configure malicious OAuth apps, generate and refine phishing emails with AI, and monitor compromised mailboxes for keywords, all in one place. It also ships a browser extension that silently refreshes session cookies through an OAuth flow, giving attackers ongoing access without re-authenticating. The operators deliver lures posing as business documents, using legitimate email-sending infrastructure to slip past filters. The researchers note AI is lowering the cost of both writing phishing content and building phishing platforms.
Symantec detailed GodDamn, a ransomware operation that disables endpoint defenses using PoisonX, a malicious kernel driver its developers managed to get signed by Microsoft, an unusual escalation over the more common tactic of abusing a legitimate vulnerable driver. In an early-June attack, the operators used AnyDesk for remote access and a credential-harvesting toolkit that pulls passwords from browsers, Windows Credential Manager, cached domain credentials, email clients, and network traffic, before deploying the ransomware. Alongside the signed driver, they ran a user-mode tool disguised as a Symantec product to blind security software. Symantec links GodDamn to a developer it tracks as Hyadina and says the group is actively improving its defense-evasion capabilities.
TrustStrike Labs