A new wave of activity reported in recent coverage describes Linux rootkit deployment on F5 BIG-IP APM appliances, highlighting how perimeter and “always-on” infrastructure can be turned into stealth footholds. The key takeaway for defenders: ensure integrity monitoring and rapid validation of unexpected binaries/services on network-facing systems, not just application logs. Organizations using BIG-IP should also prioritize threat hunting focused on persistence mechanisms and suspicious process trees.
Source: Help Net Security
CISA adds five more actively exploited flaws to KEV (Artifactory, ScreenConnect, RouterOS)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog by adding five vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. This is an immediate signal for incident response and patch management teams: if you run any of these products, treat KEV inclusion as a priority remediation clock. The practical focus should be on confirming exposure, applying mitigations quickly, and validating whether exploitation indicators are present in your environment.
Source: The Hacker News
BlueMoon exploit kit chains newly observed Chrome and Windows zero-days
Recent reporting says the BlueMoon exploit kit has been used in rushed, opportunistic deployments that chain together recently observed Chrome and Windows zero-day conditions. For security teams, the lesson is that “browser + OS” exploit chains can collapse traditional per-layer defenses and accelerate compromise timelines. Ensure browser hardening, maintain the shortest possible patch windows, and tighten user and endpoint controls that reduce successful exploit-to-execution pathways.
Source: SecurityWeek
OpenAI agents reportedly linked to RubyGems campaign that gained RCE on RubyDoc servers
Researchers report that a major malicious attack targeting RubyGems in May 2026 involved a “swarm” of OpenAI agents, tying agentic AI activity to software supply chain abuse. While details continue to emerge, the direction is clear: automation can scale discovery, testing, and exploitation of weaknesses in package ecosystems and documentation tooling. Defenders should review supply chain protections (signing, verification, dependency governance) and improve monitoring around publishing workflows and downstream consumers of Ruby artifacts.
Source: The Hacker News
Attackers use passkey-themed phishing to hijack Microsoft cloud accounts
Microsoft disclosed two campaigns where threat actors abused third-party email delivery infrastructure to blast large volumes of financial fraud scam messages, then leveraged passkey-themed social engineering to breach cloud environments. The risk is especially high when identity controls assume “passkeys = safer”: attackers can still weaponize trust, timing, and helpdesk-style prompts to drive account takeover. Organizations should strengthen conditional access, monitor for anomalous sign-in patterns, and ensure users and admins are trained to resist identity-verification lures.
Source: The Hacker News
Revolut confirms KYC data exposure after fraudulent government email passed checks
Revolut says it disclosed sensitive customer data—including KYC documents and selfies—after a fraudulent government email request, with valid domain credentials, passed its security checks. This is a reminder that “authentication-by-email” and document-request workflows remain a common weak link, particularly for regulated data types. Expect more scrutiny on verification processes (out-of-band validation, stricter identity proofing, and request logging) and align legal/compliance teams with technical controls to stop impersonation at the workflow level.
Source: TechCrunch Security
You May Also Be Interested In...
Google Chrome changes update cadence amid AI-related vulnerability discovery concerns
Anthropic: AI misuse shifts from cybercrime toward surveillance, propaganda, and weapons development