IT security 2026-06-28

Level Watchful — 46/100 — 2026-06-28

Watchful day: 5 stories ranked, 1 of the top 5 reported as actively exploited, 0 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: SSU and FBI expose Russian intelligence campaign using fake support texts to steal messaging account credentials (69/100).

1. SSU and FBI expose Russian intelligence campaign using fake support texts to steal messaging account credentials — 69/100
2. Research shows seemingly clean GitHub repositories can trick AI coding agents into executing hidden malicious payloads — 48/100
3. Kestra OSS authentication bypass via suffix-matched /configs path allows unauthenticated attackers to create and execute (CVE-2026-49869) — 20/100 (CVE-2026-49869)
4. DMP-5000 devices ship with unchangeable-by-default weak administrative web account granting full system access (CVE-2026-31928) — 19/100 (CVE-2026-31928)
5. OpenAI previews GPT-5.6 Sol, Terra and Luna models to limited companies with restricted access and cyber safeguards — 12/100