> TODAY'S SUMMARY (78 articles)
Today's cybersecurity landscape reveals significant threats and vulnerabilities. A troubling report indicates that White House network addresses were exploited by multiple residential proxy services, raising concerns about data security. Attackers are actively probing for a recently identified remote code execution (RCE) vulnerability in WordPress, highlighting ongoing risks in widely used platforms. A zero-day vulnerability in Zyxel switches has been exploited despite previous patches failing to address the issue, putting numerous devices at risk. Meanwhile, the Indian CERT warns of AI-driven cyberattacks targeting fintech and crypto sectors. Additionally, phishing scams exploiting popular culture, such as the upcoming GTA 6 release, continue to proliferate, indicating a shift in tactics among cybercriminals. Organizations are urged to bolster their defenses against these evolving threats.
|
// AI-powered summary generated at 16:00
More than half a dozen services advertised on underground forums and messaging platforms, offering discounted or “unlimited” token access to frontier AI models, were discovered by Okta. Okta believes the trend is likely driven by Chinese users seeking access to AI models that are unavailable because...
Different logos, different color schemes, same scam.
Testers found that Anthropic's AI agent Mythos attempted to social engineer Github developers into accepting malicious code.
Cisco has fixed a critical vulnerability (CVE-2026-20200) in its Integrated Management Controller (IMC), which allows an attacker to run commands as root through the controller’s web interface. The fix was part of Cisco’s August 5 advisory batch, and unlike the bugs squashed by the hardening release...
Apple has imposed strict new submission limits on its bug bounty portal after finding itself overwhelmed by low-quality, AI generated vulnerability reports - many of which were found to be describing security flaws that simply didn't exist.
Read more in my article on the Hot for Security blog.
A Canadian hacker has admitted involvement in the widespread compromise of 165 Snowflake customer accounts used to steal data and extort victims
Discover how attackers hijack AI tokens to fuel gray market transfer stations by stealing developer API keys.
The post Token Jacking: Cybercriminals Could Be Stealing Your AI Resources appeared first on Unit 42.
The attack on water systems across seven states was preventable. Utilities had the playbook. They didn't use it.
The post The water sector just got it’s wake-up call. Again. appeared first on CyberScoop.
Shortly after OpenAI publicly acknowledged the Hugging Face breach on July 21, Reuters journalist Raphael Satter called me for comment on a story which would reveal shocking new details about OpenAI’s “rogue model” incident: The agent hadn’t just slipped its leash for a few ho...
The incident involved a testing environment set up by Irregular, similar to what Anthropic reported last week.
The post Meta AI Hacked External Systems During Cybersecurity Testing appeared first on SecurityWeek.
Debian has issued a security advisory addressing multiple vulnerabilities in libde265 that could lead to denial of service, memory exhaustion, or arbitrary code execution, urging users to upgrade.
Meta says an AI model hacked a company during testing after accidental internet access, marking the third disclosed AI lab breach in weeks. Meta confirmed that one of its AI models breached an unidentified company during cybersecurity testing, after its independent testing partner Irregular gave the...
Maksim Silnikau was the creator and administrator of the ransomware group and involved in Angler EK’s distribution.
The post Belarusian Ransom Cartel Mastermind Gets 16 Years in Prison appeared first on SecurityWeek.
Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, and r...
Microsoft expanded its Zero Trust for AI strategy with updates to the Zero Trust Assessment tool and the Zero Trust Workshop. The additions help organizations assess security posture, prioritize remediation, and apply zero trust principles to AI agents and AI-assisted software development. Zero Trus...
When I first started working on enterprise AI security initiatives, I expected the biggest challenges to be technical. I assumed we’d spend most of our time discussing prompt injection, model security, vector databases or the latest LLM vulnerabilities.
I was wrong — or at...
Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them.
In several of the attack paths, the model never ran at all, so system prompts, content filters,...
The Open Secure AI Alliance has announced plans for the Shared AI Findings Exchange (SAFE)
More evidence is emerging about how AI is becoming part of the day-to-day workflow for cybercriminals, from building and refining tools to managing infrastructure and accelerating vulnerability research.
Drawing on recovered prompt logs, attack tooling, and threat actor con...
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a JetBrains TeamCity vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a JetBrains TeamCity vulnerability, tracked as CVE-2026-63077 (CVSS score of 9.8...