Daily Cybersecurity News - July 1, 2026

Two bugs in the Cursor AI code editor let a plain prompt break the safety sandbox and run commands on the host machine.

Researchers at Cato AI Labs called the issues DuneSlide. One flaw lets injected text reach the terminal runner without user approval. The other bypasses path checks so the prompt can target any file or directory.

Affects Cursor Desktop versions before 3.0. Cursor 3.0, released April 2, includes the fix. The editor runs untrusted AI suggestions directly against the local workspace.

Cato released a 140-line reproduction that chains both issues in one prompt.

Progress Kemp LoadMaster appliances face active exploitation attempts on a critical pre-auth RCE flaw in the API.

CVE-2026-8037 is an OS command injection issue with CVSS 9.6. Unauthenticated attackers send crafted requests to the /accessv2 endpoint and execute arbitrary commands on the appliance. Attempts started June 29 after a public PoC dropped.

Affects LoadMaster deployments with the API exposed. Load balancers in production networks are the primary targets.

This is the second LoadMaster command injection flaw hit with real-world attempts after CVE-2024-1212.

Unknown attackers ran a massive password spraying campaign against Microsoft 365 tenants.

They fired more than 81 million login attempts over two weeks using breached username/password combinations through Azure CLI and the ROPC OAuth flow.

This is standard spray-and-pray tradecraft, not novel tooling. The scale alone makes it stand out from typical low-and-slow attempts.

Huntress linked most of the activity to an IPv6 range controlled by LSHIY LLC.

Attackers are shipping trojanized Pyrogram forks on PyPI to target developers who build Telegram bots.

The packages have been active since November. Once installed they give remote file read access on the victim's server. Targets are Python developers working on Telegram automation.

This is lazy supply-chain abuse. The actor reuses a known vector instead of developing novel code or infrastructure.

Campaign has been running for eight months and remains active.

A China-aligned group is hitting critical systems across Southeast Asia. They breached at least ten organizations including state-owned entities.

Attackers used a new backdoor for access and control. The group focused on regional infrastructure and government targets.

This shows reuse of familiar regional targeting patterns rather than brand new techniques. Overlap with known clusters is likely but unconfirmed in detail.

Active targeting began recently with deployments limited to a small set of victims so far.

Attackers are hijacking exposed AI inference endpoints to run their own offensive workloads without credentials.

They scan for exposed AI services like Ollama and LiteLLM, then submit prompts to use those endpoints for offensive AI workloads. Targets span any organization running these models publicly.

This is mostly lazy infrastructure abuse rather than novel tradecraft, relying on default configurations and internet-exposed instances instead of new exploits.

Operators have used the same pattern against Jupyter notebooks and exposed databases for years.

ClickFix campaigns now run on API servers that hand out unique malware copies to every visitor.

A researcher dissected three thousand live samples and found the payloads are generated on the fly, each one wrapped in fresh obfuscation before it reaches the victim machine.

The approach is mostly automation layered on a technique that has been around for years, but the scale of real-time variation is new.

The dataset covers activity from April through June 2026 across multiple criminal clusters.