As your dedicated cybersecurity services provider, CyberOne equips you with timely and in-depth information about current cyber attacks. Discover a weekly cybersecurity report of the latest exploits and breaches shaping the ever-evolving cybersecurity landscape.
Weekly Cybersecurity Report | Week 26, 2026
Information security updates and events from the past week
1. Continued Fallout from the “Klue” Supply Chain Breach
The most significant operational event this week was the ongoing impact of the breach at Klue, a market intelligence SaaS provider.
- The Incident: Between June 11 and 24, threat actors (identified as the “Icarus” group) exploited a legacy credential to access Klue’s infrastructure. They harvested OAuth tokens, allowing them to impersonate the service and access the Salesforce environments of nearly 200 organizations.
- Victims: Major cybersecurity and tech firms were affected, including Huntress, Recorded Future, Tanium, Jamf, Snyk, and Gong.
- Status: While Klue deactivated all OAuth tokens by June 12 and Salesforce disabled the integration by June 17, the threat actors began posting exfiltrated CRM data on a Tor-based leak site on June 19, with reports of the victim list still expanding as of June 22.
2. Escalation of Iranian Cyberattacks on Israel
Director General Yossi Karadi of Israel’s National Cyber Directorate reported a sharp surge in hostile cyber activity throughout June, linked to ongoing regional tensions.
- The Stats: Israel recorded approximately 4,800 hostile cyber incidents in June 2026, nearly triple the 1,600 incidents recorded during the same period in 2025.
- Targeting: Attacks have focused on critical infrastructure, government agencies, and small-to-medium businesses, including law and accounting firms.
- Outcome: While Israeli authorities successfully blocked attacks against critical infrastructure, several smaller organizations with weaker defenses suffered severe disruptions, often requiring total system wipes to recover.
3. New “Agentjacking” Attack Class
A novel attack vector targeting AI-driven development tools, dubbed “Agentjacking,” was disclosed by Tenet Security.
- The Threat: The attack targets AI coding agents like Claude Code, Cursor, and Codex. By manipulating repository configurations or local settings, attackers can hijack these agents to perform unauthorized actions that bypass standard security controls, as the agents’ actions are “authorized” by the user.
- Context: This is the third documented AI coding agent attack vector within six weeks, highlighting a rapidly evolving threat surface as developers increasingly rely on automated AI assistance.
4. US Government Policy Shifts & Quantum Preparedness
- Quantum-Resistant Encryption: On June 22, President Trump signed an executive order establishing strict, ambitious deadlines for federal agencies and government contractors to adopt quantum-resistant encryption algorithms to prevent future data decryption by foreign adversaries using quantum computing.
- AI Safety: U.S. authorities have raised national security concerns regarding high-capability AI models. Consequently, Anthropic has suspended access to its new Claude Fable 5 and Mythos 5 models following testing that showed the models could identify sensitive vulnerabilities in government systems.
5. CISA Adds New Vulnerabilities to KEV Catalog
CISA continues to update its “Known Exploited Vulnerabilities” (KEV) list based on active
exploitation in the wild. Notable additions this week included:
- CVE-2025-67038: A code injection vulnerability in Lantronix EDS5000 devices (Added June 23).
- CVE-2026-34908: An improper access control vulnerability in Ubiquiti UniFi OS
(Added June 23). - CVE-2026-12569: An improper input validation flaw in PTC Windchill and FlexPLM
(Added June 25).
The cybersecurity attacks highlighted in this report aren’t just incidents, they’re blueprints of the adversary’s arsenal. To protect your business you need the right partner. CyberOne is here to help! Check out our services.
