Cybersecurity briefing — June 28, 2026.

JFrog Security Research describes DirtyClone (CVE-2026-43503, CVSS 8.8) as a Linux kernel privilege escalation that can silently rewrite executables in memory, leaving little to no disk trace. It’s the latest in the DirtyFrag family, and an exploit walkthrough has already been published—meaning defenders likely need to treat this as “active and urgent” rather than purely theoretical. Patch immediately and verify kernel hardening and detection controls for in-memory execution tampering.

Source: Security Affairs

Microsoft Threat Intelligence reports a targeted phishing campaign against hospitality organizations using plausible “guest complaint” lures. Victims are led to deploy TonRAT, with resilient persistence to keep access after initial compromise. Organizations should tighten email security controls, improve user reporting workflows, and review endpoints for TonRAT indicators and persistence mechanisms.

Source: Security Affairs

SecurityWeek reports that threat actors are monetizing investment fraud by selling scam templates powered by the legitimate DCloud Uni-App toolkit. The use of common development components can speed up creation and deployment at scale while blending into normal web technology fingerprints. Defenders should strengthen brand/domain monitoring, fraud-aware DNS and web filtering, and customer-facing safeguards to reduce successful lure traffic.

Source: Security Week

The Security Service of Ukraine (SSU), in coordination with the FBI, describes a long-running Russian intelligence campaign targeting messaging accounts of Ukrainian officials and others across Europe and the U.S. The technique: fake support communications designed to harvest credentials from high-value personnel. This underscores the need for stronger account verification (especially for mobile/official messaging channels) and rapid take-down/rotation procedures when compromise is suspected.

Source: The Hacker News

Wired reports that LastPass users had their data stolen again, reinforcing that credential managers remain a high-value concentration point for attackers. Incidents like this typically drive follow-on risks: password reuse exploitation, account takeover attempts, and fraud against downstream services. Users should assume breach exposure may have wider blast radius than expected and prioritize revoking sessions, rotating secrets, and reviewing security alerts.

Source: Wired

Help Net Security’s roundup highlights the operational impact of the Fortibleed campaign and points to a Cisco Unified CM flaw being exploited in the wild. While the “week in review” format isn’t a single vulnerability deep dive, it’s a useful signal that attackers are actively chaining vulnerabilities and social engineering to reach production environments. Security teams should cross-check exposure for both publicly known weaknesses and any vendor advisories referenced in recent reporting.

Source: Help Net Security

Forbes reports Microsoft has extended Windows 10 support for another year for a fee, effectively moving the end-of-life timeline for many organizations. Even with extended support, the security posture still depends on patching discipline, compensating controls, and migration readiness. Enterprises should treat this as “time purchased,” not “time forgiven,” and accelerate application compatibility testing and upgrade roadmaps.

Source: Forbes Security