Daily Cybersecurity News - June 22, 2026

A 29-year-old memory leak in Squid Proxy can spill previous users' HTTP requests to attackers.

CVE-2026-47729 sits in the FTP directory listing parser. An attacker who controls an FTP server reachable by the proxy triggers a strchr loop that walks past a null terminator and reads stale data from a recycled 4KB buffer.

Shared proxies in corporate networks, schools, and public Wi-Fi are most exposed. Only cleartext HTTP requests are at risk; CONNECT-tunneled HTTPS stays safe.

The bug dates to a 1997 NetWare compatibility commit and was found by feeding Claude Mythos Preview the FTP state machine.

Apple shipped a permanent flaw in the BootROM of A12 and A13 chips. Attackers with physical USB access can run unsigned code in the SecureROM and break the secure boot chain. The Secure Enclave is not compromised, so passcodes and encrypted user data stay protected.

The vulnerability lives in the ROM itself so firmware updates cannot fix it. No CVE exists because Apple does not assign them to hardware silicon issues.

Affects iPhone XS through 11 series and some iPad models running those SoCs. Only matters for physical-access threat models like forensic tools or lost devices.

Exploit demonstrated on iPhone XS running iOS 18.1.

North Korean operators hit the NPM ecosystem with a supply chain compromise on the Mastra packages.

They injected a malicious dependency into over 140 packages that pulls a payload aimed at crypto browser extensions. The vector is classic dependency poisoning in a popular JavaScript framework.

This is reused tradecraft, not a novel technique, but it shows the group shifting focus toward developer tooling and cryptocurrency theft.

The operation targeted at least 140 packages and hit users installing the framework for AI-related projects.

Attackers ran a broad credential harvesting campaign against Fortinet devices.

They collected over 86,000 working credentials from compromised FortiGate firewalls and SSL VPN gateways. The operation focused on edge appliances that many organizations leave exposed to the internet.

The campaign reused credential stuffing and weak management access, tactics seen in prior Fortinet targeting. No new zero-days surfaced in the activity.

Database of confirmed credentials reached 86,000 entries before Fortinet issued guidance.

The Gentlemen ransomware crew now ships a tool that knocks out endpoint security on target machines.

GentleKiller scans for running EDR processes, then terminates them before the ransomware payload executes. Affiliates get the framework as part of their deployment kit.

The approach reuses familiar process-killing tactics seen in other ransomware families. What stands out is the packaged delivery to partners rather than custom builds per campaign.

ESET has tracked GentleKiller since early 2026. The Gentlemen crew itself only emerged in late 2025.