Daily Cybersecurity News - June 23, 2026

Anthropic released Fable 5 with extra guardrails to block cyberattack generation. The bypass appeared in public within days anyway.

The model is a hardened fork of Mythos Preview. Researchers used prompt chaining and roleplay overrides to extract working attack code despite the new filters.

Public reports claim the safeguards were bypassed, but Anthropic disputes that the examples prove a real high-risk jailbreak.

Public jailbreak writeup surfaced three days after the model launch.

FFmpeg just patched a flaw in its video decoder that can hand attackers remote code execution on media servers.

The bug, called PixelSmash, sits in the decoder and lets crafted input corrupt memory. It can trigger denial of service or, under specific conditions, full remote code execution on servers.

Jellyfin servers face the biggest exposure. Other apps like Kodi, Emby, Nextcloud PhotoPrism, and OBS Studio can also crash or misbehave when they ingest malicious media.

The flaw affects the widely used decoder across multiple projects that rely on FFmpeg for video handling.

Tata Electronics confirmed a data breach at one of its Indian facilities that supplies components to Apple and Tesla.

Attackers accessed internal systems and stole employee records plus some customer-related files. The company did not name the group or detail the initial access method.

The incident highlights exposure for major supply chain players even when direct customer data stays limited. Reuters reported that Tata received a ransom demand, while Tata declined to comment on that detail.

Tata said the affected site handles semiconductor assembly and testing for global clients.

A stolen developer credential and session cookie appeared in infostealer logs before attackers used Miasma to poison Red Hat npm packages.

The exposed credential appeared weeks before the Miasma worm pushed malicious versions across 32 Red Hat npm packages. It spreads by hijacking developer publish rights.

This flips the usual supply chain story. Instead of zero-days or clever code, the attackers just bought valid credentials and waited.

The worm is derived from Mini Shai-Hulud and hit packages tied to Red Hat infrastructure.

A phishing campaign is hitting WhatsApp users across countries with messages that deliver VBScript files disguised as business documents.

The script executes a loader that fetches and runs a remote access tool for full system control. Victims receive the attachment after replying to the initial message.

The trick of using WhatsApp replies to deliver the payload is familiar but the choice of VBScript for initial execution stands out in recent campaigns.

Microsoft observed a similar WhatsApp VBS campaign beginning in late February 2026, and Kaspersky reported fresh activity in June 2026 across multiple countries.

Attackers hit Fortinet FortiGate firewalls at scale with the FortiBleed campaign, stealing credentials straight off the devices.

They deployed a custom sniffer on compromised firewalls to capture authentication secrets in transit. Targets include organizations running exposed FortiGate appliances.

The approach is straightforward: compromise the perimeter device and snoop locally instead of chasing endpoint malware. This reuses a classic edge-device foothold tactic.

SOCRadar reported a large-scale campaign involving exposed FortiGate devices and credentials captured through a custom sniffer.

Attackers can hijack cloud storage buckets across providers by claiming globally unique names after deletion.

Unit 42 tested the technique on AWS, Azure, and Google Cloud. Deleted buckets leave their names available. An attacker creates a new bucket with the same name and receives traffic intended for the original.

The research shows a real data-stream hijacking risk when a globally unique bucket name is deleted and then recreated under another account. Most production workloads keep buckets active.

The write-up includes working code samples and cross-cloud reproduction steps.