The Defensive Line Weekly — Episode 25 (28 June – 5 July 2026). A new CitrixBleed exploited in 24 hours; FortiBleed theft turns to ransomware; device-code phishing goes pro; AI runs ransomware end-to-end.

🤖 Voices are AI-generated. Story curation and analysis is human.

A new CitrixBleed (CVE-2026-8451)

* Citrix Security Bulletin CTX696604 — fixed builds

* watchTowr Labs — CitrixBleed to Infinity and Beyond: technical analysis

* Field Effect — Citrix NetScaler memory disclosure: patch guidance

* SecurityWeek — New CitrixBleed vulnerability exploited immediately after public disclosure

FortiBleed → INC Ransom and Lynx ransomware

* SOCRadar — FortiBleed: INC / Lynx ransomware link

* Dark Reading — FortiBleed actors tied to INC and Lynx ransomware gangs

* SecurityWeek — FortiBleed campaign linked to INC, Lynx ransomware attacks

* BleepingComputer — FortiBleed credential theft campaign linked to Lynx ransomware

ARToken — device-code phishing as a service

* Cisco Talos — ARToken: inside an EvilTokens affiliate panel targeting Microsoft 365

* Sekoia — EvilTokens: AI-augmented phishing-as-a-service for automating BEC fraud

* Microsoft — AI-enabled device-code phishing campaign (April 2026)

* Microsoft Learn — Conditional Access: block authentication flows (device code)

JADEPUFFER — AI-agent-run ransomware

* Sysdig — JADEPUFFER: agentic ransomware for automated database extortion

* BleepingComputer — JADEPUFFER ransomware used AI agent to automate entire attack

* SecurityWeek — Agentic AI used to conduct ransomware attack via Langflow

Honourable mentions

* Socket — PolinRider: North Korea-linked supply chain campaign expands

* OpenSourceMalware — PolinRider rides again: North Korean attack expands across GitHub

* The Hacker News — North Korean hackers publish 108 malicious packages

* The Hacker News — New ChocoPoC RAT targets vulnerability researchers

Vulnerabilities

* MSRC — CVE-2026-45659: Microsoft SharePoint RCE

* The Hacker News — SharePoint RCE CVE-2026-45659 added to KEV

* Cisco — Unified Communications Manager security advisory

* SecurityWeek — Cisco confirms in-the-wild exploitation of Unified CM vulnerability

Subscribe

* This week’s written edition — The Defensive Line Weekly #28

The Defensive Line Weekly — Episode 24, covering 21–28 June 2026. A weekly briefing for blue teamers and security leaders: the biggest stories of the week, why they matter, and what to do next.

🤖 Voices are AI-generated. Story curation and analysis is human.

Sources

Cisco Catalyst SD-WAN zero-day exploited for months

* Mandiant / Google Cloud — zero-day exploitation of Cisco Catalyst SD-WAN Manager

* Cisco Security Advisory — SD-WAN Manager privilege escalation

* The Hacker News

* SecurityWeek

Amazon Q Developer flaw — malicious repos and cloud credential theft

* Wiz — Amazon Q vulnerability

* AWS Security Bulletin

* The Hacker News

* SecurityWeek

“BadBlocker” — 11M-install ad blocker that can run code anywhere

* Island — BadBlocker research

* The Hacker News

Russian intelligence targeting Signal backup recovery keys

* FBI / IC3 Public Service Announcement

* CISA advisory

* The Hacker News

* The Record

Operation Endgame — SocGholish, Amadey and StealC takedown

* Europol

* Microsoft Security Blog

* The Hacker News

* Wired — LastPass user data stolen again

Honourable mentions & vulnerability roundup

* The Register — “Miasma” npm supply-chain campaign

* Novee Security — “Cordyceps” CI/CD weakness

* The Hacker News — Cordyceps exposes 300+ GitHub repos

* Microsoft — photo-zip campaign targeting hospitality

* The Hacker News — “Gaslight” macOS stealer with prompt injection

* BleepingComputer — CISA deadline for exploited Cisco CUCM flaw

* Dark Reading — attackers weaponise Cisco CUCM flaw

* The Hacker News — CISA adds exploited PTC Windchill RCE

* The Hacker News — “DirtyClone” Linux kernel flaw

* The Hacker News — Linux “pedit” copy-on-write exploit

The Defensive Line Weekly podcast is the audio version of the weekly Defensive Line Substack intelligence summary. Written by humans but read by AI. It turns the week’s key cyber stories into a practical conversation between Carter and Lizzie.

FortiBleed and edge credential exposure

* CISA — CISA urges hardening Fortinet devices after reports of credential exposure

* NCSC — Advice following global targeting of Fortinet firewalls and VPN gateways

* The Hacker News — CISA warns Fortinet customers as compromised credentials leak

Klue, OAuth tokens and SaaS integration risk

* Huntress — Klue breach investigation

* Klue — Update on recent Klue security incident

* The Hacker News — Salesforce disables Klue app

* BleepingComputer — Klue OAuth breach linked to Icarus Salesforce data theft attacks

Mastra, AutoJack and trusted tooling

* Microsoft Threat Intelligence — Postinstall payload inside Mastra npm supply chain compromise

* Microsoft Defender Security Research — AutoJack: single-page RCE on host running AI agent

* BleepingComputer — Microsoft links Mastra AI supply-chain attack to North Korean hackers

* The Hacker News — 144 Mastra npm packages compromised

* The Hacker News — AutoJack attack lets one web page execute code

* BleepingComputer — Microsoft fixes AutoGen Studio flaw

Honourable mentions

* ESET Research — Killing me gently: inside Gentlemen’s EDR killer framework

* The Hacker News — F5 patches two critical NGINX Open Source flaws

* The Hacker News — Hackers exploit Gravity SMTP WordPress plugin

* Dark Reading — Novo Nordisk breach exposes dev pipeline risk

* The Hacker News — Operation Endgame disrupts SocGholish

* The Hacker News — AryStinger malware infects legacy D-Link routers

The Defensive Line Weekly podcast is the audio version of the weekly Defensive Line Substack intelligence summary — the same curated briefing for blue teamers and security leaders, in a format you can listen to on the move.

This week: PeopleSoft zero-day hits universities; AUR packages hijacked; AI agents turn ordinary inputs into code paths.

ShinyHunters / Oracle PeopleSoft

Oracle Security Alert

Google Cloud / Mandiant

Rapid7

Dark Reading

The Record

Software supply chain — Arch AUR and npm

The Hacker News — Arch AUR

The Hacker News — GitHub / npm

AI agents as attack surface

Check Point Research — LangGraph

Field Effect — Langflow

The Hacker News — Agentjacking

The Hacker News — OpenClaw

Honourable mentions

The Hacker News — The Gentlemen ransomware

PRODAFT — Inside the Phantom Mantis Operation

The Hacker News — Velvet Ant

Sekoia — APT28

Splunk Advisory

Ivanti Security Advisory

The Record — Great Marlow School

The Register — Plymouth City Council

The Register — Novo Nordisk

The Hacker News — Google smishing lawsuit

The Defensive Line Weekly podcast is the audio version of our weekly Defensive Line Substack intelligence summary — the same curated briefing for blue teamers and security leaders, in a format you can listen to on the move.

This week: A self-spreading supply chain worm hits npm, PyPI and GitHub; AI turns up as both an attacker’s tool and an attack surface; and a five-month email espionage campaign against a stock-exchange executive.

Supply chain worm (Miasma / Shai-Hulud)

* Microsoft

* Socket

* The Hacker News

* Dark Reading — IronWorm (further reading)

AI on both sides — Meta AI support bot & EDR evasion

* KrebsOnSecurity

* Check Point

* Sophos

* Dark Reading

Five-month email espionage

* Symantec Threat Hunter Team

* Dark Reading

Honourable mentions

* Google Gemini voice assistant — Dark Reading

* Claude Code GitHub Action — Microsoft

* FFmpeg — 21 vulnerabilities — The Hacker News

* Palo Alto Networks PAN-OS — Unit 42

* Palo Alto Networks advisory

* SolarWinds Serv-U — The Hacker News

Gogs unpatched remote code execution

* Rapid7

* BleepingComputer

* SecurityWeek

ShinyHunters: Charter and Carnival

* BleepingComputer — Charter

* BleepingComputer — Carnival

* The Record

* Carnival Corporation notice

FBI warning: Silent Ransom Group

* FBI IC3 Advisory

* The Record

* SecurityWeek

* CyberScoop

Honourable mentions

* Palo Alto GlobalProtect: Rapid7, Palo Alto Networks advisory, CISA KEV

* ChatGPT share links: Push Security, BleepingComputer

* GREYVIBE: WithSecure Labs, The Hacker News

* npm supply chain: Microsoft Security Blog

Story 1: Developer Supply Chains Under Sustained Assault

* OX Security — TeamPCP / GitHub breach

* StepSecurity — Nx Console VS Code extension

* GitHub Security Blog — Investigating unauthorised access

* SafeDep — Megalodon mass GitHub repo backdooring

* StepSecurity — Megalodon CI/CD secrets exfiltration

* Aikido Security — Laravel-Lang supply chain attack

* Snyk — Laravel-Lang supply chain advisory

* The Hacker News — Packagist supply chain attack

* Socket — TrapDoor cross-ecosystem campaign

Story 2: Kali365 — FBI Warns of oh-auth Token Theft Platform

* FBI IC3 Public Service Announcement

* Arctic Wolf — Kali365 token and session theft

* The Record — FBI warns of Kali365

* Microsoft — Protect against consent phishing

* Microsoft — Configure user consent

* Microsoft — Block device-code flow with Conditional Access

Story 3: A Zombie Account Hands Over the Water Supply

* The Register — Zombie user account let hackers control the city’s water

Honourable Mentions

* Check Point Research — Nimbus Manticore operations during the Iranian conflict

* Microsoft Security Blog — Fox Tempest malware-signing service

* Malwarebytes — NYC Health + Hospitals breach

* Aikido Security — Google API key 23-minute deletion window

* MSRC — Microsoft Defender CVE-2026-41091

* Dark Reading — Microsoft Exchange OWA zero-day

The Defensive Line Weekly is a weekly intelligence briefing for blue teamers and security leaders — the stories that matter most, with clear implications and practical defensive actions. This podcast is the audio version of the weekly Defensive Line Substack newsletter, bringing the same curated analysis to your ears. Voices are AI generated, but the analysis and script is human curated.

Topic 1: South Staffordshire Water — 22 Months Undetected

* ICO enforcement notice

* The Record

* BleepingComputer

* Help Net Security

* Computer Weekly

Topic 2: BlackFile — Vishing and Real-Time AitM

* Google Threat Intelligence Group (GTIG)

* Push Security

Topic 3: Mini Shai-Hulud — npm Supply Chain Worm

* TanStack postmortem

* OpenAI disclosure

* StepSecurity (TanStack)

* Socket (TanStack)

* StepSecurity (node-ipc)

* The Record

* The Hacker News (TanStack)

* The Hacker News (node-ipc)

Honourable Mentions

* Cisco Security Advisory CVE-2026-20182

* Rapid7 (Cisco SD-WAN)

* Cisco Talos (SD-WAN exploitation)

* Microsoft Security — Kazuar/Secret Blizzard

Subscribe to The Defensive Line on Substack for the full weekly written edition.

The Defensive Line Weekly is a weekly intelligence briefing for blue teamers and security leaders — the stories that matter most, with clear implications and practical defensive actions. This podcast is the audio version of the weekly Defensive Line Substack newsletter, bringing the same curated analysis to your ears. Voices are AI generated, but the analysis and script is human curated.

ShinyHunters / Canvas Breach

* Bitdefender Technical Advisory

* Instructure Incident Update

* Krebs on Security

* Push Security analysis

* Halcyon

* PCMag

PAN-OS CVE-2026-0300

* Palo Alto Networks Security Advisory

* Unit 42 Threat Brief

* Rapid7

* BleepingComputer

* Canadian Centre for Cyber Security

Vibe-Coded Apps Leaking Corporate Data

* Wired — RedAccess Research

* Axios

* PCMag

Honourable Mentions

cPanel Escalation

* The Hacker News

* SecurityWeek

* watchTowr Labs

Dirty Frag Linux LPE Zero-Day

* BleepingComputer

Supply Chain Infostealer Cluster

* Netskope Threat Labs — OpenClaw/Hologram

* BleepingComputer — JDownloader

* BleepingComputer — Fake OpenAI/Hugging Face

Ivanti EPMM Zero-Day

* Ivanti Advisory

The Defensive Line Weekly is a podcast version of our weekly Substack intelligence summary — the security stories that matter most for blue teamers and security leaders, with clear implications and practical defensive actions. AI voices are used, but the content is human curated and written with the support of AI.

Topic 1: Helpdesk Impersonation Continues to Succeed

* CrowdStrike — Cordial Spider adversary profile

* CrowdStrike — Snarky Spider adversary profile

* Google / Mandiant GTIG — Expansion of ShinyHunters SaaS data theft

* Unit 42 / RH-ISAC — Extortion in the enterprise: defending against BlackFile attacks

* CyberScoop — CrowdStrike names Cordial Spider and Snarky Spider

Topic 2: cPanel & WHM and CopyFail

cPanel / WHM CVE-2026-41940

* watchTowr Labs — cPanel WHM authentication bypass

* cPanel vendor advisory — 28 April 2026

* Censys — The cPanel situation

* Help Net Security — cPanel zero-day exploited

* Rapid7 — CVE-2026-41940 ETR

CopyFail CVE-2026-31431

* Wiz Research — CopyFail Linux privilege escalation

* Ubuntu security advisory

* AlmaLinux blog

* Red Hat CVE advisory

* Microsoft Security Blog — CopyFail cloud and Kubernetes impact

* CERT-EU SA 2026-005

Topic 3: Three Supply Chain Attacks in One Week

* SentinelOne — Week 18 supply chain roundup

* Aikido Security — PyTorch Lightning PyPI compromise

* Socket — PyTorch Lightning compromised

* The Hacker News — Poisoned Ruby gems and Go modules

* The Hacker News — PyTorch Lightning supply chain

* The Register — SAP npm supply chain

Honourable Mentions

* TRM Labs — North Korea 2026 crypto theft

* Arctic Wolf — BlueNoroff ClickFix and AI-generated Zoom lures

* NCSC — AI-driven patch wave warning

* Fortinet PSIRT FG-IR-26-100

* Fortinet PSIRT FG-IR-26-112

* The Register — Gemini CLI critical RCE