> TODAY'S SUMMARY (2 articles)
Today's cybersecurity news highlights significant threats, including a major breach at French Bank Crédit Mutuel Arkéa, where attackers exploited vulnerabilities in a third-party service provider to steal up to $133 million. This incident underscores the ongoing risk associated with third-party integrations. Additionally, refrigeration cyberattacks continue to target European retailers, raising concerns about supply chain security. As organizations face these evolving threats, proactive measures and timely patching, especially in light of upcoming Patch Tuesday, are crucial for mitigating risks. Overall, the focus remains on enhancing security protocols to safeguard against sophisticated cyber threats.
|
// AI-powered summary generated at 12:00
Different logos, different color schemes, same scam.
Testers found that Anthropic's AI agent Mythos attempted to social engineer Github developers into accepting malicious code.
Cisco has fixed a critical vulnerability (CVE-2026-20200) in its Integrated Management Controller (IMC), which allows an attacker to run commands as root through the controller’s web interface. The fix was part of Cisco’s August 5 advisory batch, and unlike the bugs squashed by the hardening release...
Apple has imposed strict new submission limits on its bug bounty portal after finding itself overwhelmed by low-quality, AI generated vulnerability reports - many of which were found to be describing security flaws that simply didn't exist.
Read more in my article on the Hot for Security blog.
A Canadian hacker has admitted involvement in the widespread compromise of 165 Snowflake customer accounts used to steal data and extort victims
The attack on water systems across seven states was preventable. Utilities had the playbook. They didn't use it.
The post The water sector just got it’s wake-up call. Again. appeared first on CyberScoop.
Shortly after OpenAI publicly acknowledged the Hugging Face breach on July 21, Reuters journalist Raphael Satter called me for comment on a story which would reveal shocking new details about OpenAI’s “rogue model” incident: The agent hadn’t just slipped its leash for a few ho...
Discover how attackers hijack AI tokens to fuel gray market transfer stations by stealing developer API keys.
The post Token Jacking: Cybercriminals Could Be Stealing Your AI Resources appeared first on Unit 42.
The incident involved a testing environment set up by Irregular, similar to what Anthropic reported last week.
The post Meta AI Hacked External Systems During Cybersecurity Testing appeared first on SecurityWeek.
Debian has issued a security advisory addressing multiple vulnerabilities in libde265 that could lead to denial of service, memory exhaustion, or arbitrary code execution, urging users to upgrade.
Meta says an AI model hacked a company during testing after accidental internet access, marking the third disclosed AI lab breach in weeks. Meta confirmed that one of its AI models breached an unidentified company during cybersecurity testing, after its independent testing partner Irregular gave the...
Maksim Silnikau was the creator and administrator of the ransomware group and involved in Angler EK’s distribution.
The post Belarusian Ransom Cartel Mastermind Gets 16 Years in Prison appeared first on SecurityWeek.
Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, and r...
Microsoft expanded its Zero Trust for AI strategy with updates to the Zero Trust Assessment tool and the Zero Trust Workshop. The additions help organizations assess security posture, prioritize remediation, and apply zero trust principles to AI agents and AI-assisted software development. Zero Trus...
When I first started working on enterprise AI security initiatives, I expected the biggest challenges to be technical. I assumed we’d spend most of our time discussing prompt injection, model security, vector databases or the latest LLM vulnerabilities.
I was wrong — or at...
Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them.
In several of the attack paths, the model never ran at all, so system prompts, content filters,...
The Open Secure AI Alliance has announced plans for the Shared AI Findings Exchange (SAFE)
More evidence is emerging about how AI is becoming part of the day-to-day workflow for cybercriminals, from building and refining tools to managing infrastructure and accelerating vulnerability research.
Drawing on recovered prompt logs, attack tooling, and threat actor con...
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a JetBrains TeamCity vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a JetBrains TeamCity vulnerability, tracked as CVE-2026-63077 (CVSS score of 9.8...
This week Help Net Security is at the Mandalay Bay, where Arsenal is running alongside the Briefings. If you’ve never been, it’s the corner of Black Hat that feels least like a conference and most like a workshop: a room full of stations where the people who wrote the tools stand behind laptops and...