Immediate priority must be given to the unpatched Fastjson RCE and active ServiceNow exploits, both of which provide high-impact entry points for attackers. We are also seeing a trend in sophisticated evasion techniques, including browser-based malware assembly and BYOVD crypters, alongside continued supply chain risks that GitHub is attempting to mitigate via Dependabot cooldowns.
This legacy edition is awaiting expanded Slugnet analysis and is not yet indexed.
Audio briefing
A spoken version of today’s prioritized cybersecurity briefing.
The audio edition is not available yet.
Attackers are actively exploiting a critical unauthenticated remote code execution vulnerability (CVE-2026-16723) in Alibaba's Fastjson 1.x Java library. The flaw allows malicious JSON requests to execute code with the privileges of the Java process, and no patch is currently available.
This legacy edition predates Slugnet’s expanded analytical assessment.
A pre-authentication remote code execution vulnerability in ServiceNow is being actively exploited in the wild. Additionally, AI platform Hugging Face has suffered a material data breach.
This legacy edition predates Slugnet’s expanded analytical assessment.
A China-linked threat group is using the Cruciferra crypter service to deliver remote access trojans via income tax-themed phishing lures. The malware employs Bring Your Own Vulnerable Driver (BYOVD) and process ghosting techniques to evade detection on Windows systems.
This legacy edition predates Slugnet’s expanded analytical assessment.
East Asian threat actors are targeting government entities in the Middle East using new malware families dubbed TELESHIM, MIXEDKEY, and BINDCLOAK. The operation leverages Telegram as a command-and-control channel to maintain persistence.
This legacy edition predates Slugnet’s expanded analytical assessment.
Threat actors have compromised public Wi-Fi gateways to target traveling corporate employees. The attackers use these hijacked appliances to harvest Microsoft 365 credentials.
This legacy edition predates Slugnet’s expanded analytical assessment.
The SourTrade malvertising campaign uses malicious JavaScript to instruct browsers to assemble Windows executables directly in memory using a legitimate Bun runtime. This technique bypasses traditional file-based detection by avoiding the delivery of a complete malicious binary.
This legacy edition predates Slugnet’s expanded analytical assessment.
GitHub introduced a cooldown mechanism for Dependabot that delays pull requests for new package releases by three days. This measure is designed to prevent the immediate adoption of poisoned packages in supply chain attacks.
This legacy edition predates Slugnet’s expanded analytical assessment.
Coca-Cola confirmed a data breach following a ransomware attack on its Fairlife brand. The Anubis cybercrime group has claimed responsibility and is threatening to leak stolen data.
This legacy edition predates Slugnet’s expanded analytical assessment.
Hackers stole personal and dental health information from DentaQuest's computer network in May 2026. The breach potentially impacts over 23 million individuals.
This legacy edition predates Slugnet’s expanded analytical assessment.
The Nono project provides an open-source sandboxing environment for AI agents to mitigate risks from prompt injection and hallucinations. It prevents agents from using the host's plaintext credentials or accessing unauthorized files in the environment.
This legacy edition predates Slugnet’s expanded analytical assessment.