Major events like the FIFA World Cup and the US sesquicentennial celebration face complex security challenges that begin long before attendees arrive at venues. Threat actors start preparing months in advance by registering fake domains, collecting exposed credentials, and monitoring public schedules across social media and dark web forums, creating digital footprints that can signal physical threats. According to ZeroFox security expert Olga Polishchuk, the most effective event security strategies integrate threat intelligence and digital monitoring early in the planning process, extending protection beyond venue perimeters to hotels, transportation hubs, and other gathering points where high-profile individuals and attendees are vulnerable.

A critical authentication bypass vulnerability in SimpleHelp remote management software, scoring a perfect 10 out of 10 on the severity scale, has been actively exploited to deliver malware onto managed systems. The flaw, which fails to verify cryptographic signatures when OpenID Connect authentication is configured, allowed attackers to deploy TaskWeaver loader and Djinn Stealer, which specifically targets developer credentials including cloud keys, SSH access, and even AI development tool credentials. The vulnerability was patched in late May, and CISA has now added it to its catalog of actively exploited vulnerabilities, giving federal agencies just three days to update their systems.

Nissan has confirmed a data breach affecting current and former employees across North and South America after hackers exploited a zero-day vulnerability in Oracle PeopleSoft software. The breach, believed to be orchestrated by the ShinyHunters extortion group, may have exposed sensitive employee data including social security numbers, banking information, and tax records. The attack was part of a wider campaign targeting over 100 organizations, with the education sector being hit particularly hard.

As cybersecurity vendors race to embed AI into their platforms, they're shifting from predictable software licensing to volatile, consumption-based pricing that could catch security leaders off guard. The problem lies in how agentic AI works: unlike traditional machine learning, these autonomous systems can burn through millions of tokens in a single complex investigation, potentially costing an entire quarter's cybersecurity budget during a major incident. This shift is forcing security teams to make dangerous compromises, like throttling investigations mid-incident or disabling automated workflows to preserve monthly token credits, creating the same kind of blind spots that once plagued the SIEM industry.

Threat actors have begun actively exploiting a critical vulnerability in Oracle E-Business Suite's Payments component that carries a severity score of 9.8 out of 10. The flaw, which Oracle patched in late May, allows unauthenticated attackers to completely take over the Payments system via HTTP, and security firm Defused detected the first exploitation attempts over the weekend through its honeypots. Organizations are strongly urged to apply Oracle's patches immediately, as the company's enterprise products have a history of being targeted in major attack campaigns, including recent breaches by ransomware groups affecting hundreds of companies.

The Supreme Court ruled 6-3 that constitutional privacy protections extend to cellphone location data, even when users voluntarily opt into services like Google's location history. Justice Kagan wrote that people shouldn't be viewed as giving up privacy rights "just by doing the ordinary things cellphone users do." The case involved a bank robber identified through a geofence warrant that captured location data from all phones near the crime scene, with the court sending it back to lower courts to determine if that specific search violated Fourth Amendment protections against unreasonable searches.

Chris Thompson went from hacking video games as a teenager to founding IBM's first dedicated red team and leading X-Force Red, before recently launching RemoteThreat to use AI against malicious actors. His unconventional path included convincing major companies like EA to hire him at eighteen for security work, and he built his career on proving skills rather than academic credentials — a philosophy he maintains when hiring, seeking domain expertise and collaboration over college degrees. Thompson, who has ADHD, believes neurodivergence is common among elite hackers and serves as a "superpower" in the field, contributing to the deep focus and different thinking style that makes great security researchers.

Aflac Life Insurance Japan has disclosed a major data breach affecting 4.38 million customers after hackers accessed their systems between June 15th and 25th. The stolen information includes names, addresses, phone numbers, dates of birth, and insurance account details, with banking information for about 230,000 people also compromised, though credit card data remained secure. The incident has disrupted at least five company services, with no estimated timeline for restoration, and only affects Aflac's Japan operations, not its US business.

Adversa AI has discovered a major vulnerability in open source AI coding agents, dubbed GuardFall, that exploits decades-old Bash shell tricks to bypass security guards and execute malicious commands. Of eleven popular agents tested, only one—Continue—was able to block all the attack techniques, which use methods like quote removal and spacing manipulation to disguise destructive commands that the AI agent then executes with the developer's full authority. This creates a significant supply chain risk, especially in CI pipelines where auto-approval modes are common, potentially allowing attackers to exfiltrate credentials or wipe development environments through poisoned files in malicious repositories.

The cybersecurity agency CISA has confirmed that the BlueHammer vulnerability in Microsoft Defender is now being actively exploited in ransomware attacks. The flaw, tracked as CVE-2026-33825, was publicly disclosed by a disgruntled researcher in April before Microsoft had released patches, and was initially exploited as a zero-day for privilege escalation. While CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, the specific ransomware group using the exploit remains unknown, and the agency's update has raised questions about how useful these notifications are for security defenders.