3 stand-out Paramount+ movies to watch this week (June 22-28)


If you’re not at least a few episodes into the new season of The Agency, or haven’t started watching all the Scream movies in order on Paramount+ yet, then you’re either too busy enjoying the weather (good on you) or those selections just might not be your jam.

I’m really hoping, then, that this week’s suggestions (or at least one of them) are a good fit for movie night, and they couldn’t be more different. There’s a double dose of Channing Tatum—one of him in uniform, one of him very much on the wrong side of the law—plus a razor-sharp ensemble that turns the 2008 financial meltdown into something you’ll actually enjoy watching.

3

22 Jump Street

Jonah Hill and Channing Tatum head back to school … again

I wrote about the original movie in this hilarious buddy cop franchise when it appeared on Paramount+ this month. But I found myself returning to its second round, 22 Jump Street, when Sony recently announced that 24 Jump Street is officially in the works—with the tag line “It took so long to make, we had to skip one.” In the meantime, 2014’s 22 Jump Street catches up with mismatched cops Schmidt (Jonah Hill) and Jenko (Channing Tatum), for another romp at undercover work, this time posing as students at a local college to trace the supply of a new, dangerous party drug.

Of course, the way-too-old-for-school partners are awful at fitting in at college, too, which makes for all kinds of awkward comedic moments that the franchise is known for as they get swept up in college life—Jenko bonds with a meathead football player, Schmidt drifts toward the art crowd, and their partnership nearly falls apart. Directors Phil Lord and Chris Miller (Spider-Man: Into the Spider-Verse) return to the helm, taking the opportunity to make supreme meta fun of lazy, money-grubbing sequels—the movie’s end credits take this to another level with its movie poster gag.

Of course, some familiar faces return from the first film, including Ice Cube as the always-furious Captain Dickson, as well as Dave Franco and Rob Riggle, to round out the cast. Come for Hill and Tatum’s amazing chemistry, stay for Tatum’s endlessly-memed “My name’s Jeff” scene.

2

The Big Short

The 2008 mortgage crash and the men who saw it coming

Adam McKay’s 2015 financial drama The Big Short has an ensemble cast that reads like a leading-men laundry list—Bale, Gosling, Carell, Pitt, Strong—who adeptly take the most tangled and convoluted financial disaster of the last two decades and somehow makes it sing.

Adapted from Michael Lewis’s bestseller The Big Short: Inside the Doomsday Machine, it tracks the scandalous 2008 mortgage collapse and the handful of financial outsiders who saw it coming and bet against the entire U.S. housing market. Twitchy, barefoot hedge-fund genius Michael Burry (Christian Bale) discovers the bubble first; furious, moralistic trader Mark Baum (Steve Carell) jumps in out of spite; smug banker Jared Vennett (Ryan Gosling) narrates with a permanent smirk (and occasional fourth-wall break); and retired guru Ben Rickert (Brad Pitt) reluctantly guides two hungry up-and-comers to make their money while they can.

Speaking of fourth wall breaks, McKay uses it brilliantly throughout the film, roping in celebrities like Anthony Bourdain, Selena Gomez, and Margot Robbie to explain key financial concepts, like credit default swaps, CDOs, and mortgage bonds. With five Oscar nominations, including Best Supporting Actor for Bale and Director for McKay, the film only won one for Best Adapted Screenplay. It’s a movie that’ll leave you fascinated and furious, earning its 89% critics’ score.

1

Roofman

You’ll root for Channing Tatum’s loveable thief on the lam

And now for the second Channing Tatum movie on this week’s list, and it’s a good one. Just ask Rotten Tomatoes, where it has an 87% critics score. If you’re after a quirky, feel-good watch that refuses to sit in any one genre, Roofman is a charming comedy that’s part crime drama, part romance, part stranger-than-fiction biopic—and is an easy yes.

Writer-director Derek Cianfrance (Blue Valentine, The Place Beyond the Pines) builds Roofman around the genuinely unbelievable story of Jeffrey “Roofman” Manchester, an Army veteran who spent the late ’90s robbing McDonald’s restaurants by cutting through their roofs and very politely relieving employees of the cash. And that’s the tame part: after escaping prison in 2004, Manchester managed to live undetected for months (largely on M&Ms) inside a Charlotte, North Carolina Toys “R” Us.

Tatum has rarely been better, playing Manchester as a sweet, fundamentally decent guy who’s simply made a mountain of terrible choices and just wants something resembling a normal life. While camped out in the store—keeping tabs on the staff through a network of secretly placed baby monitors—he falls for employee Leigh (Kirsten Dunst), and the two start seeing each other beyond the toy aisles. His double life inevitably gets messy, but Manchester is so likable underneath it all that you can’t help pulling for him. Dunst lends real warmth and earnestness to single-mom Leigh, and Peter Dinklage is a scene-stealer as Mitch, the gloriously joyless Toys “R” Us manager.


Something for everyone

It might be a bit of a 90-degree turn going from one of these movies to the next, but that’s exactly why the week won’t get boring. But if none of my picks are up your alley, How-To Geek’s streaming section has loads more recommendation lists to help.

paramount__logo.jpg

Subscription with ads

Yes, $8/month

Simultaneous streams

3

Live TV

Select live sports (NFL on CBS & UEFA Champions League)

Price

Starting at $8/month or $60/year




Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)







Source link