Security incidents in June 2026

Attackers used a SimpleHelp sign-in flaw to reach computers managed by IT support providers and install credential-stealing malware. Ask your provider to update its server to 5.5.16 or 6.0 RC2 or later and check for unauthorised access.

Attackers use CVE-2025-67038 to take over Lantronix EDS5000 equipment without signing in. Four other Lantronix families are affected. Fixes are available for all five; ask IT to update firmware and restrict management access.

Attackers are using three critical UniFi OS flaws affecting Ubiquiti gateways, network controllers, video recorders and storage devices. Install the correct OS update for your model and ask your installer to check for earlier compromise.

Attackers used CVE-2026-12569 to run code without signing in to PTC Windchill and FlexPLM business servers. Patches are available. Ask IT to apply PTC's version-specific fixes, check for compromise and replace exposed credentials.

Attackers used CVE-2026-20262 to create or overwrite files on Cisco Catalyst SD-WAN Manager, potentially gaining full control. Organisations should preserve diagnostic logs, contact Cisco support and install the fixed release for their branch.

Attackers are exploiting CVE-2026-20253 to manipulate files on vulnerable Splunk Enterprise servers without signing in. Businesses and family offices using 10.0 or 10.2 should install 10.0.7 or 10.2.4 or later. Splunk Cloud is unaffected.

Oracle PeopleSoft PeopleTools 8.61 and 8.62 flaw CVE-2026-35273 lets attackers take over servers without a password. ShinyHunters used it from 27 May. Oracle patched it 10 June. Organisations running PeopleSoft should patch and check for prior compromise.

Attackers are exploiting CVE-2026-7473 in certain Arista network switches configured as tunnel endpoints. No patch is planned. Network administrators must apply Arista’s traffic-filtering mitigations rather than wait for an update.

Attackers are exploiting CVE-2026-10520 to take over exposed Ivanti Sentry business gateways without logging in. Ask IT to install R10.5.2, R10.6.2 or R10.7.1 or later, restrict access and check for compromise.

Attackers are using a LiteLLM AI gateway flaw that lets even low-privilege users run code on its server. Organisations should update to 1.83.7 or later, apply relevant Red Hat fixes and check for compromise.

Check Point firewalls with IKEv1 remote-access VPN can be logged into without a valid password (CVE-2026-50751). Used in attacks since 7 May, including a Qilin ransomware case. Install Check Point's hotfix or disable IKEv1/legacy clients, then check logs from 7 May.

Attackers exploited a Chrome V8 flaw through malicious web pages. Desktop Chrome and Microsoft Edge have fixes. Update your browser through its About page and relaunch it; users of other Chromium browsers should check their maker’s update.

Attackers used CVE-2026-20245 to take full control of Cisco SD-WAN management systems after gaining administrative access. Fixes are available. Business and family-office IT teams should upgrade and ask Cisco to check for compromise.

Attackers are exploiting CVE-2026-28318 to crash SolarWinds Serv-U file-transfer servers without signing in. Version 15.5.4 and earlier are affected. Ask your IT provider to install 15.5.4 Hotfix 1; older installations must first upgrade to 15.5.4.

Attackers are exploiting Joomla Content Editor to run code on websites without logging in. Ask your website manager to update JCE and check for existing backdoors: updating alone does not clean an infected site.

Attackers are exploiting Mirasvit Full Page Cache Warmer versions before 1.11.12 on Magento and Adobe Commerce shops. Store operators should update the extension and have their developer check for signs of compromise.

Attackers exploited Cisco’s business phone-system servers through CVE-2026-20230. Systems with WebDialer enabled are exposed. Ask IT to install 14SU6, 15SU5 or the applicable Cisco patch; disabling WebDialer is a temporary mitigation.

Attackers are using an old Linux kernel flaw to gain administrative control, including escaping some containers. Fixes date from 2022. Update Linux computers and container hosts through their vendor, then restart; replace obsolete systems.

Attackers used a LiteSpeed cPanel plugin flaw to gain full control of shared hosting servers. If you own a hosted website, ask your host to confirm cPanel plugin 2.4.8 or later is installed and check for compromise.

Attackers are exploiting CVE-2024-21182 in Oracle WebLogic Server, which runs business applications. It can expose sensitive server-accessible data without a login. Organisations should install Oracle’s fixes, available since July 2024.

Google fixed CVE-2025-48595, an Android Framework flaw on Android 14 to 16 that may be used in limited, targeted attacks. CISA lists it as exploited. Install Android's June 2026 security update (patch level 2026-06-01 or later) and update apps only from Google Play.

A compromised website supplier let attackers steal about US$3 million from Polymarket customers. Polymarket said it removed the malicious code and would refund victims. Check June account activity and contact support about losses or unpaid refunds.

Aesto Health’s December 2025 breach affected 9,540,683 patients through their healthcare providers. Information included health, identity and financial details. Check your notice, use the offered protection and consider freezing your US credit files.

A breach of KDDI’s shared email platform exposed 12,231,954 people’s addresses, including passwords for 7,616,173. Customers of six Japanese providers should follow their provider’s reset instructions and replace reused passwords.

Ethereum MEV bot JaredFromSubway.eth lost about US$7.5M on 20 June 2026 after fake token contracts tricked it into granting spending approvals. The money went to Tornado Cash and none is reported recovered. Nothing for families to do.

Melbourne's Elina weight-loss clinic confirmed an unknown party logged into two HotDoc accounts. An attacker claims 28,000+ patients' details, including Medicare numbers, are for sale. As of 3 Nov 2026 we found no update. Past patients should watch for phishing.

A breach at the vendor behind Texas hunting and fishing licences exposed driver's licence details, passport numbers, emails, phones and home addresses of 3M+ customers.

Cardiac-monitor maker iRhythm says attackers tricked their way into third-party-hosted business apps and stole patient data in June, then demanded payment. Notices went out from 2 October. If you get one, watch for medical identity theft and fake iRhythm contacts.

Two Ochre Tuggeranong Square HotDoc accounts were accessed without permission. Patient contact and booking details were affected. Access was stopped; watch for scams and follow any individual notification from Ochre.

Novo Nordisk confirmed theft of coded clinical-trial records and healthcare professionals’ contact details. It says patients’ direct identifiers were not exposed. Watch for impersonation messages; privacy questions can go to [email protected].

A cyberattack halted normal operations at Mackay Sugar’s Farleigh and Racecourse mills, disrupting growers. All three mills were operational by 26 June, but the data investigation remained open. No household software update is required.

Aflac Japan exposed personal and insurance information for about 4.4 million customers, including bank details for 220,000. Notification letters have been sent. Check bank transactions and verify unexpected calls or messages directly with Aflac.

About 339,000 Napoleon Perdis customer records were published free by an attacker in June. The company says a supplier, Retail Express, was compromised; customers were emailed in October. Expect scam calls and emails, and don't act on unexpected messages.

ShinyHunters leaked University of Nottingham student records (about 454,600 email addresses, passport numbers, disabilities, fee data). Current and former students should watch for phishing and scams, check haveibeenpwned.com, and be wary of anyone citing their course or fees.

Syscoin's bridge accepted a malformed proof on 7 June 2026 and about 5 billion SYS (reported as about US$10m) were created. Syscoin says all were returned and burned. The bridge was still paused as of its 15 June report. Holders need do nothing.

A flaw in London Hydro's (Ontario, Canada) customer portal let someone download customers' names, contact details, service addresses and meter details between 5 and 17 June. It's fixed and a man is charged.

Stolen project keys let attackers drain Humanity Protocol wallets and create H tokens, collapsing the price. Replacement tokens and a claims process followed. H holders should check their wallet or exchange and use Humanity's official recovery portal.

ShinyHunters published MSG staff, customer and celebrity records; HIBP lists 9.8 million unique email addresses. Check your email exposure and independently verify messages or calls referring to MSG visits, tickets or customer enquiries.

Attackers stole AdaptHealth patient data after compromising a contractor’s session. The breach affected 4,115,802 people. Affected patients should use the offered identity protection and check healthcare and insurance statements.

Brazilian delivery app iFood confirmed a December 2025 breach of about 1.2 million users' names, phone numbers, addresses and CPF taxpayer IDs. A hacker claims 43.8 million; iFood disputes it. Expect phishing that uses your details, and trust only the official app.

South Korean streaming service Tving lost information from 39.54 million accounts, including former users. Check your breach notice, change reused passwords and verify unexpected compensation messages through Tving directly.

Attackers abused Instagram recovery to obtain password-reset links for other people’s accounts. Meta identified 20,225 affected accounts, disabled the tool and secured accounts. Enable two-factor authentication and follow any official recovery checkpoint.

Kaspersky found dozens of booby-trapped Wallpaper Engine 'application' wallpapers on Steam Workshop, some with tens of thousands of downloads, carrying a backdoor and Lumma/Vidar infostealers. Valve removed them. Only install app wallpapers from creators you trust.

StegoAd hid malicious code in 119 Edge extensions with up to 2.6 million installations. Payloads could steal passwords, sign-in codes and cookies. Microsoft removed the listings; check extension IDs, remove matches and secure sensitive accounts.

Belarus-linked Ghostwriter has sent fake Gmail admin alerts since March 2026 to steal passwords and 2FA codes from prominent Poles and their families. Never sign in from an email link. Use a passkey or security key, and check the address bar.