This digest covers a range of InfoSec news, from a Salesforce data theft via a compromised Klue integration and a mass phishing campaign impersonating Boots, to the discovery of GlassWASM WebAssembly malware hidden in trojanized Open VSX extensions. It also highlights red-teaming honey pot detection, recent ASUS driver CVEs, a Dropping Elephant loader chain, and Homebrew 6.0’s new security features.

• Compromised Klue OAuth tokens let the Icarus extortion group siphon Salesforce data via ~1,000 API calls in 15-minute bursts over a full day
• Romanian phishers spoofed a Boots "free sample" campaign, hitting ~9 million customers via a hacked Bolivian government checkout page and a compromised UK mail server
• GlassWASM malware hides in trojanized Open VSX extensions (ExarGD.vsblack, noellee-doc/flint-debug), using a Solana wallet to fetch encrypted C2 addresses for second-stage payloads
• Homebrew 6.0 adds default Bubblewrap sandboxing on Linux, a tap-trust opt-in system, and an OSV-based `brew vulns` vulnerability scanner

Homebrew 6.0.0 adds a tap trust security model that forces explicit trust for third-party taps, switches to a faster, smaller internal JSON API by default, and enables sandboxing on Linux. It also refines install and upgrade prompts based on user feedback, speeds up bundle installs, boosts overall performance, and introduces initial support for macOS 27.

• Homebrew 6.0.0 requires explicit trust before running any third-party tap or tap-qualified formula's Ruby code, with Bubblewrap sandboxing now enabled by default on Linux to match macOS.
• The new internal JSON API is now default, cutting network calls during brew update and making brew leaves ~30% faster.
• Three security advisories are patched: a POST-download redirect bypass, a Git-hook code execution flaw in the macOS .pkg installer, and a /var/tmp plist trust issue.
• Install/upgrade commands now prompt for confirmation by default (ask mode) based on user survey feedback, and brew bundle installs formulas in parallel with npm/krew/winget support.

This issue covers how to make design systems AI-ready with structured specs and audit scripts, and argues for global preload-based loading states instead of scattered spinners. It also highlights Homebrew 6.0’s security and sandbox upgrades, an AMD auto-update RCE fix, and new on-device AI features from WWDC.

• Design systems become AI-ready by storing specs as structured Markdown, locking tokens into closed named variables, and running audit/sync scripts to catch hard-coded overrides and stale docs.
• Loading UX improves by preloading and caching data at the router/app level with one global fallback, instead of scattering per-component spinners.
• Homebrew 6.0.0 adds mandatory "tap trust" approval for third-party repos, defaults to a faster JSON API, and brings sandboxing to Linux.
• AMD's AutoUpdate tool fetched metadata over HTTPS but downloaded executables over unsigned HTTP, a flaw AMD initially resisted fixing before patching it.