Daily Briefing for 06.30.26

Top stories.

1. US Supreme Court rules that geofence searches generally require warrants.
2. Maximum-severity SimpleHelp flaw is now actively exploited.
3. US government offers $10 million reward for info on Russian state-backed hackers.

US Supreme Court rules that geofence searches generally require warrants.

In a landmark 6-3 ruling, the US Supreme Court ruled yesterday that obtaining cellphone location history records is a search under the Fourth Amendment, meaning law enforcement generally must obtain a warrant before accessing this data from tech companies, the Record reports.

The case involved a Virginia man, Okello Chatrie, who was charged with bank robbery in 2019 after police found him by searching Google location history records. The police had obtained a warrant, but Chatrie's lawyer argued that the search was overly broad and should not have been allowed even with a warrant. Chatrie pleaded guilty and was sentenced to twelve years in prison after officers found $100,000 in cash, a gun, and demand notes at his home, but he retained the right to appeal the court's decision to allow this additional evidence. Chatrie's lawyer argues that the evidence is "fruit of the poisoned tree" because the initial geofence search was unreasonable. The Supreme Court sent the case back to the US Court of Appeals for the Fourth Circuit to determine whether this specific warrant satisfied the Constitution's requirements.

Privacy advocates celebrated the decision, with George Washington University law professor Andrew Guthrie Ferguson telling the Record that "the Supreme Court [has] upgraded the Fourth Amendment to meet the digital age."

Maximum-severity SimpleHelp flaw is now actively exploited.

Threat actors are now actively exploiting a maximum-severity flaw in the SimpleHelp remote monitoring and management (RMM) tool, Suriq reports. The vulnerability (CVE-2026-48558), which was patched in late May, is an authentication bypass flaw that can allow "remote, unauthenticated attacker [t] submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session." The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its  Known Exploited Vulnerabilities (KEV) catalog yesterday.

Researchers at Blackpoint observed threat actors exploiting the vulnerability to gain initial access before deploying two newly observed malware strains tracked as "TaskWeaver" and "Djinn Stealer."

US government offers $10 million reward for info on Russian state-backed hackers.

The US State Department is offering a $10 million reward for information leading to the identification or location of members of two Russian state-backed hacking groups, SecurityWeek reports. The FBI last week issued an updated advisory outlining the groups' targeting of Signal backup recovery keys, attributing the activity to threat actors tracked as "UNC5792" and "UNC4221." UNC5792 is tied to Russia's FSB Border Guards, while UNC4221 is believed to operate on behalf of Russia's military services.

The State Department says the threat actors are conducting "malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act." The department is seeking members' identities, locations, and affiliations, as well as information on technical infrastructure and funding sources.