Cybersecurity Update June 25, 2026: Ghost CMS Exploit, Lazarus Group RAT, Supply Chain Attacks

Key points

• •In 2026, the IRGC front conducted covert and destructive cyberattacks on both operational technology and information systems, including food industry manipulation, demonstrating advanced espionage and sabotage activities during a ceasefire. This highlights the growing complexity and stealth of state-linked cyber operations targeting critical infrastructure.[Reddit /r/netsec]
• •UK businesses faced a massive wave of cybercrime totaling 5.19 million incidents over the last year, underscoring the pervasive and widespread nature of digital threats in a key global economy. This scale of attacks stresses the urgent need for enhanced cybersecurity defenses in commerce and industry.[Cybersecurity Insiders]
• •Exploitation of Ghost CMS's critical SQL injection vulnerability CVE-2026-26980 affected over 700 websites, enabling attackers to inject malicious scripts for ClickFix hijacking campaigns. With a CVSS score of 9.4, this vulnerability exposed significant security risks in popular content management systems in 2026.[The Hacker News RSS]
• •Dutch authorities intensified cybercrime enforcement by seizing 800 servers and arresting two suspects involved in enabling large-scale cyberattacks across Europe. This crackdown in 2026 targeted infrastructure used to support malicious operations, demonstrating growing law enforcement capabilities against cybercriminal networks.[Cryptika Cybersecurity]
• •NIST's 2026 draft publication SP 1800-41 provides critical ransomware response and operational recovery guidance specifically for manufacturing networks, addressing a sector increasingly targeted by ransomware attacks. The framework aims to strengthen operational technology resilience and reduce downtime caused by cyber incidents.[Industrial Cyber]
• •The FBI's 2026 warning on the Kali365 phishing kit reveals a severe threat where attackers hijack Microsoft 365 OAuth tokens to gain unauthorized enterprise and government data access. This attack vector highlights vulnerabilities in authentication protocols critical to cloud security.[LinkedIn]
• •A Cambridge cybersecurity start-up founded by elite competitive hackers secured a $2.9 million funding boost in 2026 to advance AI-driven cybersecurity solutions. This investment reflects strong market confidence in innovative approaches to combating sophisticated cyber threats.[Cambridge Independent]
• •The Lazarus Group, attributed to North Korea, deployed a sophisticated RemotePE memory-only Remote Access Trojan targeting financial and cryptocurrency organizations in 2026. Their ongoing use of advanced malware indicates persistent and evolving cyber espionage against lucrative financial sectors.[The Hacker News]
• •After a ransom demand was rejected in April 2026, the ShinyHunters group leaked a 9.4GB database containing sensitive data from 7-Eleven franchisee systems affecting 185,300 accounts. This large-scale data breach exemplifies the financial and reputational risks associated with extortion-driven cybercrime.[Reddit /r/netsec]
• •The TrapDoor supply chain attack campaign, active since May 2023, continues to distribute credential-stealing malware through more than 34 malicious packages affecting over 384 versions across npm, PyPI, and Crates.io repositories. This ongoing threat emphasizes the critical need for supply chain security in open-source software ecosystems.[The Hacker News RSS]

Relevant articles