The National Association of Insurance Commissioners has confirmed it was hit in the recent Oracle PeopleSoft zero-day attack campaign orchestrated by the ShinyHunters cybercrime group. The breach compromised publicly available financial reporting data and technical information, though NAIC says no personal or payment information was stolen, and state insurance department systems were not affected. ShinyHunters initially claimed to have stolen over 3 terabytes of data from NAIC but later revised its claims, blaming an "AI-generated misinterpretation" for the inflated figures.

Cybersecurity researchers at Infoblox have discovered over 200,000 scam websites built using templates powered by Uni-App, a legitimate Chinese open-source development framework. The fraudulent sites range from fake cryptocurrency exchanges to phishing operations and so-called pig-butchering scams, including the notorious RainbowEx platform that defrauded thousands in Argentina. While the framework's maker DCloud isn't involved in the fraud, threat actors have been selling scam templates since 2022, with activity surging to 15,000 new sites monthly after the RainbowEx scandal gained media attention in late 2024.

OpenAI has unveiled a preview of GPT-5.6 Sol, a new model that will feature restricted access and enhanced cybersecurity protections. The limited rollout suggests OpenAI is taking a cautious approach with this latest iteration, prioritizing security safeguards before a wider release. The announcement comes as AI companies face increasing pressure to address potential security vulnerabilities in their models.

The Model Context Protocol, introduced by Anthropic in 2024, is transitioning to an enterprise-ready version on July 28, 2026, giving companies a 12-month window to prepare. While the new stateless protocol eliminates some vulnerabilities like session hijacking, security firm Akamai warns it introduces new attack surfaces including workflow hijacking risks, potential data leakage through HTTP headers, and denial-of-service vectors from long-running tasks. The shift fundamentally moves security responsibilities from the protocol layer to individual developers and platform operators, requiring in-house teams to carefully implement and secure their MCP servers over the next year.

Cybersecurity officials have confirmed the first-ever exploitation of PTC Windchill, a widely-used product lifecycle management platform, in real-world attacks. The vulnerability, tracked as CVE-2026-12569, allows remote attackers to execute arbitrary code without authentication, and hackers have been using it to deploy webshells for remote command execution and data exfiltration. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by June 28, with particular concern for industrial and manufacturing sectors including aerospace, defense, and automotive companies that rely heavily on Windchill.

The Russian state-sponsored hacking group Turla, linked to Russia's Federal Security Service, has been deploying a new backdoor called StockStay against Ukrainian government and military targets since 2022. The espionage tool, which masquerades as legitimate software like PDF viewers or calculators, supports extensive capabilities including file exfiltration, screen capture, and system information harvesting. Recent attacks have used phishing emails and malicious RDP configuration files, with one November campaign exploiting a WinRAR vulnerability to compromise twenty Ukraine-based targets.

Cryptocurrency-based prediction market Polymarket has promised to fully refund users after hackers stole roughly 3 million dollars through a compromised third-party vendor that injected malicious code into the platform's frontend. According to blockchain security firm PeckShield, the attackers made off with around 3 million dollars worth of pUSD, Polymarket's trading currency, from at least 11 victims through a phishing campaign before converting the stolen funds into Ethereum. Polymarket says it has contained the breach and removed the malicious dependency, though the company hasn't disclosed exactly how many users were affected or confirmed the total amount stolen.

The Linux Foundation has launched Akrites, a new open source security initiative that establishes a shared Security Incident Response Team to coordinate vulnerability discovery, patching, and disclosure across the open source software ecosystem. Backed by major tech companies including Google, Microsoft, AWS, and OpenAI, the project aims to address a critical timing problem where AI-enabled attackers can rapidly reverse engineer vulnerabilities from public patches and exploit them before organizations can deploy fixes. Akrites will also act as a maintainer of last resort for abandoned projects, ensuring security patches can still be delivered even when original developers are no longer active.

Boston-based cybersecurity startup Nebulock has raised 25 million dollars in Series A funding, bringing its total funding to over 33 million dollars, with FirstMark leading the round. The company, which emerged from stealth a year ago, uses AI-powered autonomous threat hunting to track behavioral patterns across endpoints, cloud, identity, and network systems, creating what they call a "behavioral system of record" that can spot suspicious activities before they become breaches. The new funding will go toward expanding the platform's capabilities and hiring across engineering and go-to-market teams as the company aims to help security teams shift from reactive to proactive protection.

Google has uncovered details about STOCKSTAY, a new backdoor being used by the Russian hacking group Turla in espionage campaigns targeting Ukraine. The malware represents an evolution in Turla's toolkit as the group continues its intelligence-gathering operations against Ukrainian entities. Google's disclosure provides security teams with fresh indicators to detect and defend against this latest threat from the well-established Russian cyber-espionage group.