← Latest security roundup All past issues

securitySunday, June 21, 2026

ChatGPT phishing, AI agent flaws, and Secure Boot deadline

Today's security roundup is a triple threat: AI interfaces are now being weaponized for phishing, three major AI agent frameworks have critical exploits in the wild, and a Secure Boot certificate deadline looms. Plus, an unpatchable iPhone exploit and a $7.5 million MEV bot heist add to the chaos.

Sources

AI as attack surface

Two stories today show AI systems themselves becoming the vector, not just the target.

#01permiso.ioJun 21

ChatGPhish: The Page Is the Payload

P0 Labs found that ChatGPT's Markdown rendering can turn any page a user asks it to summarize into a phishing form. Trust in the AI's output is the attack surface.

10 min readRead original

#02venturebeat.comJun 21

AI agent framework flaws hit 7,000 servers | VentureBeat

Three popular AI agent frameworks, LangGraph, Langflow, LangChain, have SQL injection and path traversal bugs being actively exploited. Attackers can steal API keys and achieve RCE on servers.

12 min readRead original

Supply chain and hardware

Meanwhile, foundational trust mechanisms are cracking, from silicon to certificates to code provenance.

#03www.gizchina.comJun 21

Apple's Newest Unpatchable Exploit Hits iPhone XR to iPhone 11 — Permanently

The usbliter8 exploit targets an unpatchable SecureROM flaw in A12/A13 chips. No software fix can close this door on iPhone XR through 11.

#04www.wired.comJun 21

A Critical Deadline Is Approaching for Windows and Linux Security

Three Microsoft-signed Secure Boot certificates expire June 24. Systems that don't update may fail to boot or lose protection against UEFI malware.

#05worldnewsguru.usJun 21

Chinese AI models raise ‘sleeper agent’ fears after report finds more vulnerable code for US users

Booz Allen warns that code from Chinese AI models may contain hidden vulnerabilities, introducing supply chain risks for U.S. developers and federal agencies.