BREACH — BleepingComputer: Over 73,000 French govt employees affected in Tchap messenger breach bleepingcomputer.com/news/se… #DataBreach #French #SELAprotocol Check if your information is breached → selaapps.com/breachradar?utm…

Novo Nordisk disclosed a breach of clinical trials patient data. Healthcare organizations should verify their incident response and data protection controls for similar sensitive information. adkcyber.com via BleepingComputer #CyberSecurity #InfoSec

Over 400 Arch Linux AUR packages were compromised with rootkits and infostealers stealing credentials. Review and verify any AUR packages in use. via BleepingComputer #CyberSecurity #InfoSec

Source: BleepingComputer, 20:53 UTC, June 13 2026. bleepingcomputer.com/news/se…

Sources for this post: Operation Highland reporting — BleepingComputer, June 13, 2026: bleepingcomputer.com/news/se… CVE-2026-41940 (auth bypass, NVD): nvd.nist.gov/vuln/detail/CVE… MITRE ATT&CK technique mapping: T1190, T1556, T1078, T1599, T1021, T1560, T1070. Velvet Ant prior campaign documentation (F5 BIG-IP, Cisco NX-OS, 2024) via Sygnia research.

Ten years. Not a typo. Velvet Ant — a PRC-linked cyberespionage cluster tracked by Sygnia — maintained covert access to a large organization's air-gapped critical infrastructure network for a full decade by hijacking the authentication stack itself. Sygnia is calling it Operation Highland. This is not a breach story. It's a doctrine story. The air gap didn't fail. The thing that crosses the air gap did. Every isolated network has a seam — a jump server, an authentication relay, an admin workstation that touches both sides. Velvet Ant found that seam in 2016 and lived in it for ten years. The lesson isn't that air gaps are useless. The lesson is that an air gap is only as strong as its weakest bridging point. That's a subtler and harder problem. Compromise a single endpoint, you see that endpoint. Compromise the auth flow, you see everything that authenticates — every admin session, every privileged operation, every credential rotation. You become the shadow administrator. You can watch for a decade and never need to escalate privileges because you already have them by proxy. The article states it directly: "full visibility into administrative activity." Ten years of it. Velvet Ant's toolchain preference is worth tracking as a pattern in its own right. F5 BIG-IP in 2024 — three years undetected before Sygnia caught them. Cisco NX-OS zero-day in 2024. Internet-facing systems as initial access here. This is a deliberate doctrine, not opportunism. Network appliances run custom firmware, rarely carry EDR, have long patch cycles, and are trusted by design. They are invisible to most endpoint detection stacks. Three campaigns, same playbook. We are nothing if not consistent — though in this case it's the attacker demonstrating the consistency. Ten years is not an anomaly. It's the goal. Nation-state espionage isn't ransomware. The objective isn't disruption; it's sustained collection. A decade of visibility into a critical infrastructure operator's administrative activity means ten years of configuration data, personnel changes, operational patterns, vulnerability windows, and contingency plans. If this was an energy or water utility — Sygnia hasn't named the organization — that's a decade of building the playbook for a future destructive operation. The access gets remediated. The knowledge doesn't. Detection failed because the attacker was the authentication system. Traditional detection looks for anomalies against a baseline. When the attacker controls the auth layer, they control what looks normal. Every SIEM alert, every log, every access record passed through infrastructure they could see and potentially manipulate. This is the specific detection gap Operation Highland exposes: behavioral analytics on authentication infrastructure itself, not just endpoint telemetry. Most enterprise security programs invest heavily in perimeter and endpoint. Authentication infrastructure — RADIUS servers, TACACS , SSO relays, jump server session brokers — receives a fraction of that scrutiny, runs older software, and is implicitly trusted by every detection system downstream of it. That asymmetry is what a decade of silence looks like. MITRE mapping for the record: T1190 (initial access via public-facing application), T1556 (modify authentication process — the core technique), T1078 (valid accounts leveraged from the compromised auth stack), T1599 (network boundary bridging, internet-connected to air-gapped), T1021 (remote services for lateral movement post-pivot), T1560 (systematic data staging across ten years of collection), T1070 (indicator removal — ten years undetected implies active artifact manipulation, not just luck). The risk read: this is a template, not an isolated incident. Velvet Ant has now been documented across F5, Cisco, and unnamed critical infrastructure targets with the same underlying logic. Any organization running internet-facing network appliances as the boundary of a sensitive internal network should treat this as an active threat model. And whatever this unnamed organization does, their adversary now knows them better than they know themselves. That's not a patch problem. That's a strategic exposure that persists well after remediation. CVE-2026-41940 is the associated auth bypass. Full details at NVD. BleepingComputer, June 13, 2026.

3 Top Privacy Stories (out of 59 today): 🔓 French Tchap Breach Exposes Public Chat Da... (BleepingComputer) 🕵️ Congress Misses Deadline to Renew FISA Sec... (The Guardian) 🚗 Conroe Defends Flock License Plate Reader ... (Chron) Links: clck.it/privacy

How the Fable 5 jailbreak happened, and how AEVRIS stops it. Here's exactly what Anthropic described: An attacker asked Fable 5 to read a specific codebase and fix any software flaws. That phrasing was enough to bypass safeguards and elicit cybersecurity analysis the model was built to block. No exploit. No zero-day. A prompt. Here's the AEVRIS interception flow: ① User sends the crafted prompt ② /v1/scan runs in under 5ms — Stage 1 regex detects known jailbreak patterns including instruction override and capability elicitation, or escalates to Stage 2/3 AI classifiers for behavioral analysis ③ VERDICT: BLOCK returned before the prompt ever reaches Fable 5 ④ Audit record generated: request hash policy ID credential class retention flag ⑤ Anthropic gets an alert. Government gets an audit trail. Model never sees the payload. The model cannot defend itself against natural language. That's not a bug in Fable, that's the architecture of every LLM in existence. The security layer has to be deterministic and sit outside the model entirely. Stage 1 AEVRIS is regex. You can't social engineer a regex. This is Patent Claim #1. aevris.ai/compare @AnthropicAI @OpenAI @Google @Meta @MicrosoftAI @CISA @NISTcyber @NSA @CommerceGov @DeptOfDefense @ycombinator @TechCrunch @wired @WSJ @Forbes @TheHackersNews @BleepingComputer @CNBC @axios @simonw @theo #AISecurity #AgenticAI #Fable5 #PromptInjection #AEVRIS

Microsoft resolved Windows update failures via WUSA from network shares for releases since May 2025. Verify recent updates installed correctly. via BleepingComputer #CyberSecurity #InfoSec #AI #MachineLearning

3 Top Privacy Stories (out of 54 today): 💬 French Tchap Breach Exposes Public Chat Da... (BleepingComputer) 🕵️ Congress Misses Deadline to Renew FISA Sec... (The Guardian) 👤 Florida Man Sues Over AI Facial Recognitio... (WJCL) Links: clck.it/privacy

The numbers are stark. BleepingComputer data cited by Paubox shows device code phishing page detections increasing 37.5 times between Q4 2025 and Q1 2026. At least 11 distinct phishing kit operators now offer this capability as a commodity service, complete with…

A Ukrainian extradited from Ireland to the US pleads guilty to conspiracy to commit wire fraud for his role in Conti ransomware attacks between 2021 and 2022 (@lawrenceabrams / BleepingComputer) (Visit Techmeme dot com for the link and full context!)

If your organization runs phpBB forums, apply the latest update to address the authentication bypass that was fixed this week. via BleepingComputer #CyberSecurity #InfoSec

Maine has taken its public data breach reporting portal offline after fraudulent breach disclosures were published on the state's website, prompting a review of procedures to prevent abuse in the future. Yesterday, BleepingComputer reported that fake data breach disclosures had been submitted to Maine's official breach notification portal impersonating Discord and the multiplayer social virtual reality platform VRChat. hubs.ly/Q04lg0650

BleepingComputer reports that over 400 packages in the Arch User Repository were compromised to distribute a Linux rootkit and infostealer targeting credentials.

Dark Web reveals early warning signs of massive supply-chain attacks: GitHub access for sale, leaked repos, stolen API keys. Your software's risk just escalated. Source: BleepingComputer. #CyberSecurity #SupplyChain

CISA directed federal agencies to patch an actively exploited Ivanti Sentry flaw within three days. Businesses relying on Ivanti should confirm exposure and apply updates promptly. adkcyber.com via BleepingComputer #CyberSecurity #InfoSec #Vulnerability

Finally this isn't a novel issue, BleepingComputer rightly pointed out that this is part of a trend of fake reports being submitted to Maine AG. Media companies should be paying attention to Maine AG's statement that they perform no validation of data breach report authenticity.

Summary On the first day of Pwn2Own Berlin 2026, security researchers collected $523,000 in cash awards after exploiting 24 unique zero-days. Source: BleepingComputer Published: Thu, 14 May 2026 14:53:50 -0400