🔴NetNut Takedown, 🎯Cursor AI RCE, ⚠️CitrixBleed Exploitation, 🎯Pegasus on Investigator, ⚠️Cisco Unified CM

The NetNut takedown is the day's defining story. Google, the FBI, and international partners dismantled a residential proxy network built on more than two million compromised Android devices, many of them smart TVs and streaming boxes infected through trojanized apps. In a single week in June, 316 distinct threat clusters used it to hide password sprays and reach victim environments; disrupting the backend will push proxy operators to buy capacity from competitors, so expect churn rather than quiet. NetNut takedown

Perimeter appliances are the second front. The NetScaler memory disclosure CVE-2026-8451, which shares root cause with CitrixBleed, was exploited by at least two actors within 24 hours of disclosure, and Cisco confirmed attackers are exploiting the Unified CM SSRF CVE-2026-20230 three weeks after public proof of concept, with over 200 instances still exposed. Both are patched but remain reachable in large numbers. NetScaler exploitation

The DuneSlide findings on the Cursor AI editor matter beyond one product: two CVSS 9.8 flaws chain prompt injection to sandbox escape and OS-level code execution, fixed in Cursor 3.0. Citizen Lab also identified Pegasus infections on the phone of a former PEGA committee member, the first time a committee member has been publicly named a victim, with high confidence of two separate infections during the committee's work.

Watchlist: NetScaler patching or SAML identity provider disablement, Unified CM 14SU6 or 15SU5, Cursor 3.0 or later, and developer toolchain trust boundaries.