Security gaps are getting harder to spot. |
Today’s stories include a 7-Eleven breach, a botnet takedown, weakened AI safeguards, and growing concerns around how organizations handle sensitive data long after devices leave production. Tell us what content you want to see on TechRepublic by taking this quick survey. Read past newsletters here. | |
|
|
Here’s what you need to know: |
|
|
|
7-Eleven Breach Exposes Applicant Data |
7-Eleven is notifying franchise applicants after attackers breached internal systems containing sensitive application data. The breach has been linked to the ShinyHunters extortion group, which reportedly stole more than 600,000 records from a connected Salesforce environment and later leaked the data online. |
Researchers say the incident highlights growing risks tied to cloud platforms and third-party business applications, with some exposed records reportedly containing social security numbers.
Organizations using Salesforce or similar cloud platforms should immediately review third-party app permissions, enforce phishing-resistant MFA, and audit dormant user accounts for unnecessary access. |
CrowdStrike Disrupts Glassworm Supply Chain Attacks |
CrowdStrike, Google, and the Shadowserver Foundation disrupted the Glassworm botnet targeting developers through poisoned GitHub repositories and malicious software packages.
More than 300 GitHub repositories were reportedly compromised, while Glassworm used decentralized infrastructure to maintain resilient C2 operations. The campaign highlights how attackers are targeting developer ecosystems to gain access to CI/CD pipelines and trusted software distribution channels.
Audit developer accounts for unauthorized OAuth tokens, enforce signed commits and MFA, and continuously monitor dependency installations for unexpected post-install scripts or outbound network activity. |
AI Guardrails Bypassed in Minutes |
Researchers showed how easily open-source AI models from Google and Meta could be stripped of safety protections to generate harmful content, including malware code and biological weapon instructions.
The study used a GitHub-based tool called Heretic to remove built-in guardrails from more than 3,500 AI models, raising concerns about the security risks of open-source AI adoption. These findings are also increasing pressure on U.S. and European regulators to strengthen oversight around AI safety, misuse, and harmful outputs.
Organizations testing open-source AI models should isolate them in sandboxed environments, restrict internet access, and log prompt/output activity to identify unsafe behavior before production deployment. |
|
|
|
How confident are you in your AI guardrails? |
|
|
|
Yesterday's Pulse Check Results |
Resilience Check: If a critical third-party platform failed tomorrow… |
|
|
|
Security Tools You Can Use |
|
|
|
AI-Driven Threats Reshape Pentesting |
Organizations are moving beyond conducting just annual penetration tests as cloud, AI, and rapidly changing development environments outpace traditional assessment cycles. Researchers say the shrinking gap between vulnerability disclosure and exploitation, due to AI, is making periodic penetration testing far less effective. |
The shift is driving adoption of continuous security validation and AI-powered offensive security tools that prioritize real-world exploitability and faster threat detection.
Organizations should start integrating continuous exposure validation directly into CI/CD workflows and routinely test whether previously remediated vulnerabilities silently reappear through configuration drift or deployment changes. |
Poor Data Sanitization Raises Security Risks |
A Blancco report found that rising AI adoption and weak data sanitization practices are increasing risks tied to data leaks and compliance issues. Despite strong confidence in data sanitization practices, 38% of organizations still reported data leaks tied to improperly erased or redeployed devices. Researchers also found that AI adoption, growing compliance pressure, and rising data volumes are driving more aggressive device destruction and complicating end-of-life data management. Organizations should require verifiable sanitization certificates for all retired storage assets and routinely test erased devices with forensic recovery tools to validate that sensitive data cannot be recovered. |
|
|
|
AI adoption is moving fast, but hidden security risks inside applications can create costly delays, compliance concerns, and operational blind spots.
Join TechRepublic with Black Duck on June 17, 2026, at 11:00 AM ET for Uncover Hidden Risks Across Your AI Applications. This expert-led session will share practical ways to improve visibility, strengthen governance, and reduce AI-related software risk without slowing innovation. Register now to strengthen your AI security strategy. |
|
|
|
How Exposed Is Your Sensitive Data? |
Data theft can expose sensitive information, disrupt operations, and create long-term financial and security risks. |
How to reduce the risk of data theft: |
- Enable MFA, encrypt sensitive files, and restrict user access to reduce the impact of stolen credentials and limit the blast radius of compromised systems.
-
Use data loss prevention (DLP) tools and monitor unusual outbound traffic to detect and block potential data exfiltration attempts.
- Regularly audit cloud storage, sharing permissions, and inactive accounts to identify exposed data and unnecessary access risks.
|
Small improvements in data protection practices can help reduce the risk of costly data exposure incidents. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
