These news items are automatically aggregated from industry sources and are not individually reviewed. Any inaccuracies are unintentional —
let us know and we'll correct or remove it.
The European Commission’s Cloud and AI Development Act, adopted on 3 June as the centrepiece of its Tech Sovereignty Package, creates four assurance levels for cloud services and would bar the three American hyperscalers, who hold roughly 70 percent of the EU cloud market between them, from the highest tiers reserved for defence, banking, energy, and healthcare. Trilogue negotiations could stretch past 2027, but the direction of travel for European public sector and regulated-industry procurement is already clear.
Progress Software’s Kemp LoadMaster, ECS Connection Manager, ObjectScale Connection Manager, and MOVEit WAF are affected by CVE-2026-8037, a CVSS 9.8 pre-authentication root command injection rooted in an uninitialized heap buffer inside the escape_quotes() sanitisation function. WatchTowr Labs published a full exploit chain on 29 June. Patches have existed since early June, but internet-facing load balancers are notoriously slow to update.
Qilin, now the most prolific ransomware-as-a-service operation of 2026, listed German legwear maker Kunert Fashion and French firm KALIACT ANCHETA et Associes on its leak site on 29 June. The group has claimed more than 500 victims this year alone, with manufacturing the single most targeted sector and stolen VPN credentials, often protected by no multi-factor authentication, as its favoured way in.
GitGuardian’s State of Secrets Sprawl 2026 report recorded 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34 percent year-over-year increase. AI-assisted commits leak credentials at twice the baseline rate, 24,000 secrets were found in MCP configuration files, and 64 percent of valid secrets from 2022 remain unrevoked.
Apple has confirmed that Siri AI will not launch in the EU on iOS 27 or iPadOS 27 after the European Commission rejected every compliance proposal Apple put forward under the Digital Markets Act. EU iPhone and iPad users have no timeline for the feature, and both sides publicly disagree about who is responsible.
The intelligence agencies of the United States, United Kingdom, Australia, Canada, and New Zealand issued a joint warning on 23 June 2026 that frontier AI models are advancing rapidly enough to outpace established cyber defences within months. The warning highlights rising AI-assisted attack speed, including documented cases where adversaries move laterally inside compromised networks in under 30 seconds.
Researchers at SentinelOne have identified a new macOS backdoor, dubbed Gaslight, attributed to North Korea-aligned threat actors. Written in Rust, it embeds 38 fabricated system error messages as a prompt injection payload to mislead AI-assisted malware analysis tools. The technique did not bypass current production platforms in testing, but the escalating scale of the injection approach signals that attackers are actively probing AI security tooling for exploitable weaknesses.
The European Commission issued a formal Statement of Objections to Amazon Web Services and Microsoft Azure on June 25, 2026, marking the first time the Digital Markets Act has been applied directly to cloud computing infrastructure. AWS and Azure together hold over 70 percent of the EU cloud market. A final designation is expected by late October 2026 and would require both providers to open their platforms to interoperability, eliminate self-preferencing, and guarantee data portability, with fines of up to 10 percent of global annual turnover for non-compliance.
A newly disclosed stealthy backdoor named Mistic, linked to the initial access broker KongTuke, has been used against organisations in insurance, IT, education, and professional services since April 2026. Mistic runs entirely in memory, writes nothing to disk, and can delete itself on command, making it largely invisible to file-based endpoint scanners. Access obtained through Mistic is sold to ransomware operators including Qilin, Rhysida, Akira, and Black Basta.
Security firm AIR pushed a malicious AI agent skill through a popular marketplace and reportedly reached 26,000 agents, including corporate accounts, while passing every automated security scanner tested. The attack exploits a structural gap in how skill marketplaces evaluate trust: scans happen once at submission, but the payload can be rewritten on the hosting server at any time after approval. The incident marks a new class of supply chain risk that grows in proportion to AI agent adoption.
This site uses cookies. By continuing to use this website, you agree to their use.
We’ll help you resolve your infrastructure challenges
Our team of experts is ready to help you with your infrastructure challenges. We’ll give you honest and personal treatment. Get in touch to learn more.
