Israeli cybersecurity startup Dream has raised 260 million dollars at a 3 billion dollar valuation, bringing its total funding to over 410 million dollars since its founding in 2023. The company, founded by controversial former NSO Group CEO Shalev Hulio along with former Austrian Prime Minister Sebastian Kurz and cybersecurity expert Gil Dolev, offers three platforms focused on sovereign AI and national cyber defense, including systems that defend against nation-state threats, hunt for vulnerabilities, and help governments analyze and structure national data. Dream plans to use the funding to expand its platform across Europe, the Middle East, Asia, and the Americas.

Atlassian and Splunk have released patches for critical security vulnerabilities in their products. Splunk fixed a critical flaw in its AI Toolkit that could allow authenticated administrators to execute arbitrary operating system commands, while Atlassian published 100 security bulletins addressing vulnerabilities in third-party dependencies used across products like Jira, Confluence, and Bitbucket. Users are urged to update immediately, and Splunk recommends uninstalling the AI Toolkit if upgrading isn't possible.

A veteran security researcher argues that while software vulnerabilities and exploits get a lot of attention, they only account for 32% of initial cyberattacks, with the remaining two-thirds succeeding simply because of the fundamental design of modern networking. The internet's universal connectivity and interoperability, which make it so useful, also make it incredibly difficult to defend, as networks are essentially built to bypass security barriers and connect everything to everything else. Rather than focusing solely on patching vulnerabilities, organizations need to address these deeper networking challenges, including shadow IT and the constant bridging of supposedly separate systems.

Accenture announced a massive 4.1 billion dollar investment in operational technology cybersecurity, acquiring a majority stake in Dragos while fully purchasing runZero and NetRise. The deal brings together three specialized companies: Dragos for industrial threat detection, NetRise for firmware analysis, and runZero, founded by Metasploit creator HD Moore, for asset discovery and attack surface intelligence. The move appears to be Accenture's competitive response to ServiceNow's recent 7.75 billion dollar Armis acquisition, positioning both companies to dominate the critical infrastructure security market with comprehensive platforms spanning IT, OT, and IoT environments.

The Payment Card Industry Data Security Standard has updated its requirements to explicitly address security risks from third-party scripts running on checkout pages. Organizations that accept credit card payments must now take responsibility for all scripts loading on their payment pages, as malicious or compromised JavaScript code could potentially capture customer payment data. This change reflects growing concerns about supply chain attacks where hackers compromise legitimate third-party services to inject data-stealing code into e-commerce sites.

A growing security concern is emerging around orphaned AI agents – artificial intelligence systems that may have been deployed within corporate networks but lack proper oversight or access controls. Security experts are warning that these forgotten or poorly managed AI agents could create hidden vulnerabilities, giving them unauthorized access to sensitive data or systems without proper authentication or monitoring. Organizations are being advised to audit their networks for these orphaned agents and implement proper governance frameworks before they become entry points for security breaches.

The DragonForce hacker group has been discovered using Microsoft Teams relay servers to conceal command and control traffic for the Backdoor.Turn malware. By routing their malicious communications through legitimate Microsoft infrastructure, the attackers can effectively hide their activities from traditional security monitoring tools, making the backdoor operations much harder to detect. This technique represents a sophisticated evolution in how threat actors abuse trusted enterprise communication platforms to maintain persistent access to compromised networks.

European researchers are already developing security measures for 6G networks, expected to roll out globally around 2030, through an EU-funded project called Shield-6G. The initiative brings together 19 organizations to create a cyber threat intelligence platform that will use AI-driven detection, digital twins, honeypots, and federated learning to protect the vastly expanded attack surface created by 6G's increased connectivity and AI integration. The project emphasizes explainable AI systems and maintaining privacy while handling security across fragmented network operators managing everything from smart devices to critical infrastructure.

Security teams face a critical challenge with 82% of organizations carrying security debt — vulnerabilities that have been open for more than a year. According to Veracode's Chief Security Evangelist Chris Wysopal, the key isn't fixing every vulnerability but reducing exposure time for the most dangerous ones by focusing on critical applications and flaws that combine high severity with high exploitability. The biggest issue isn't the size of the backlog but how long critical vulnerabilities remain accessible to attackers, with third-party code proving especially problematic as it takes an average of 358 days to remediate.

Cybersecurity officials are warning about active exploitation of critical vulnerabilities in Joomla and LiteSpeed's cPanel plugin. The Joomla flaw allows unauthenticated attackers to upload malicious files and execute code on servers, while the LiteSpeed vulnerability enables privilege escalation to root access on shared hosting servers. The US Cybersecurity and Infrastructure Security Agency has added both flaws to its Known Exploited Vulnerabilities catalog, giving federal agencies until mid-June to patch their systems, with automated attacks already underway.