Search the archive

Replace persistent access with Zero Standing Privileges

Just-in-time, just-enough access, scoped to the task, and automatically revoked when work ends.

CRITICAL JFROG ARTIFACTORY VULNERABILITY REPORTEDLY EXPLOITED IN THE WILD

Attackers reportedly began exploiting CVE-2026-82329 days after disclosure, minting admin tokens in vulnerable JFrog Artifactory deployments.

ALIEXPRESS ACCUSED OF FINGERPRINTING SHOPPERS WITH SILENT AUDIO TRICK THAT ALSO MUTED A DEV'S HEADPHONES

AliExpress scripts generate inaudible WebAudio sawtooth signals, collect frequency data, and query display size, memory, plugins, WebGL, and mouse activity.

ANTHROPIC WARNS CLAUDE USERS OF INFOSTEALER MALWARE INFECTIONS

Anthropic warned affected Claude users that infostealers hijacked browser sessions and drained usage limits. The malware included Vidar, Lumma, StealC, RedLine, Acreed, and AMOS. Anthropic logged out compromised sessions, removed stored payment methods, and refunded identified unauthorized charges. Users should remove malware before re-adding payment details.

SHINYHUNTERS CLAIMS IT STOLE 284 MILLION PATIENT RECORDS FROM MCKESSON

McKesson detected an intrusion on August 25 tied to third-party apps in its Oncology & Multispecialty and Medical-Surgical units. ShinyHunters vished McKesson employees, hijacked Okta SSO accounts, then pulled roughly a terabyte from Salesforce and Snowflake over four days. The group demanded $55,236,150 with a 72-hour deadline, which McKesson didn't pay. Breached data includes 284 million records containing SSNs, birth dates, Medicaid info, medical record numbers, medication/allergy data, and employee records.

CRITICAL MICROSOFT UFO MCP FLAW LETS ATTACKERS REMOTELY CONTROL ANDROID DEVICES WITHOUT AUTHENTICATION

Unauthenticated attackers can drive ADB commands on Android devices connected to Microsoft's open-source UFO Desktop AgentOS through CVE-2026-73296, which affects versions up to v3.0.7 and has no official patch. Attackers can exploit this vulnerability to capture screenshots, extract UI hierarchy data, and tap, swipe, and text-entry actions on TCP 8020 and 8021 whenever operators follow the documented remote-deployment guidance and bind to 0.0.0.0. Users should restrict those ports to trusted hosts and front the services with TLS and an authenticated reverse proxy until the proposed UFO_MCP_API_KEY bearer-token fix merges.

PHILIPPINE NUCLEAR AGENCY AND NAVAL CONTRACTOR TARGETED BY SUSPECTED CHINESE-SPEAKING OPERATOR USING KNOWN VULNERABILITIES

Researchers found an exposed Amsterdam server staging tools and stolen Philippine data. Custom scripts abused ownCloud CVE-2023-49105, impersonating known users through unsigned WebDAV URLs. The recovered data included reactor records, radiation-safety files, employee PII, travel documents, BitLocker keys, KeePass data, and AxCrypt files. Logs referenced roughly 9 GB taken from the nuclear agency. A naval contractor's WordPress site was breached through LiteSpeed Cache CVE-2024-28000 and XML-RPC password guessing. The server also hosted Sliver, Metasploit, Mettle, and a loader that fetched a second-stage payload.

WHEN IT SNOWS IT POURS – ANATOMY OF A SERVICENOW RED TEAM

MDSec red-team engagements turned phished ServiceNow users, exposed MID config.xml files, and over-permissioned roles into tenant admin access. Roles including catalog_admin, import_admin, and sn_cmdb_editor enabled Glide-script execution or role chaining. Operators created hidden admin accounts, altered timestamps, removed login and role histories, and used scheduled jobs as SnowFall C2 callbacks. From the tenant, they enumerated incidents and attachments, extracted credentials, bypassed adaptive authentication, and executed commands on MID servers through JAR plugins or the ECC queue.

WHEN THE SOURCE ATTACKS BACK: PROMPT INJECTION IS COMING FOR OSINT

Security researcher Dekens has demonstrated how adversaries can manipulate AI-assisted OSINT investigations by planting hidden prompt injections within digital documents. Through a dedicated training lab, Dekens highlights techniques like pushing CSS div elements off-screen, embedding white-on-white text in PDFs, and hiding instructions in unformatted spreadsheet cells. While not yet observed in active campaigns, these invisible artifacts successfully steer language models toward false narratives without altering the visually rendered file. To defend against poisoned sources, investigators should hash original documents and independently extract text using tools like Apache Tika or Tesseract to compare against the visual output. Furthermore, analysts must strictly isolate AI models in read-only environments to prevent untrusted inputs from executing unauthorized actions.

EMBA

EMBA is designed as the central firmware analysis and SBOM tool for penetration testers, product security teams, developers, and responsible product managers. It supports the complete security analysis process, starting with firmware extraction, doing static analysis and dynamic analysis via emulation, building the SBOM, and finally generating a web-based vulnerability report.

INTRODUCING ADAPTIVE INTELLIGENCE: UNDERMINING THE ECONOMICS OF EVERY BOT ATTACK

Cloudflare has launched Adaptive Intelligence, a bot detection engine designed to make evasion economically unviable for attackers by continuously retraining its models on live traffic. Rather than relying on deterministic rules, the engine utilizes non-deterministic signal weighting and delayed reactions to prevent threat actors from isolating and defeating specific defenses. This cross-temporal evaluation allows the system to detect slow credential-stuffing attacks distributed across residential proxies that would otherwise bypass standard rate limits. Enterprise customers can activate the continuous retraining component immediately by enabling "Auto Update Machine Learning" in their Bot Management dashboard, while advanced features such as disposable rule generation are still in development.

CLOUDFLARE OS

Cloudflare OS is an “operating system” for AI productivity that consists of an agent chat UI, a sandboxed application development environment for small personal apps, and security guardrails.

OEMPOCALYPSE NOW

Calif researcher Lukas Maar has developed a universal exploitation strategy that elevates an unprivileged Android app to root across modern Samsung, Xiaomi, and Oppo devices. Rather than hunting for generic kernel or chipset vulnerabilities, Maar targeted the proprietary OEM software overlays, such as One UI and HyperOS, that span each vendor's entire device lineup. The exploit leverages a page use-after-free vulnerability mapped to a freed physical page. This reliable technique successfully bypasses KASLR, control-flow hijacking, and slab protections without modification across kernels 5.4 through 6.12. While this initial publication outlines the overarching methodology on locked bootloaders, Maar plans to release the specific exploit chains affecting July 2026 flagship devices like the Galaxy S26 Ultra in future installments.

OPEN-SOURCE POST-QUANTUM CRYPTOGRAPHY SERVERLESS CA

Paul Schwarzenberger updated his open-source serverless CA with support for ML-DSA post-quantum cryptography. CA private keys are generated and used within AWS KMS FIPS 140-3 HSMS. ML-DSA is still not universally supported by applications, so users should check compatibility before adopting.

HOW AI BUILDERS WILL GET HACKED

Developers who are frequently building tools with AI should ensure that they have a continuously running system that maintains a list of publicly exposed systems and continuously probes for basic security properties. AI builders can consider using full harnesses to comprehensively test critical systems. With the velocity of AI development, losing track of dangling, public resources will become a key attack vector.

DATA SECURITY INCIDENT - 27.08.26

Manchester Airports Group says an unauthorized party obtained booking and Wi‑Fi signup data from Manchester, Stansted, and East Midlands airports.

UPDATE ON RECENT CYBERSECURITY INCIDENT

Boston Scientific detected a cyber incident on August 25 that disrupted on-premises operating systems and business applications.

POWER LEAK: AMAZON KIRO IDE PROMPT INJECTION ENABLES DATA EXFILTRATION

A crafted Kiro workspace can direct the agent to read .env data, place it in powersRecommendationUrl, and invoke Kiro Powers. The IDE then fetches the attacker-controlled URL with the secret in its query string. Mindgard reproduced the path in trusted and untrusted workspaces, and Amazon fixed the reported behavior in Kiro IDE 0.8.140.

HASBRO DATA BREACH EXPOSED EMPLOYEE PERSONAL INFORMATION

Hasbro notified current and former employees that attackers may have accessed names, contact details, national ID numbers, and financial information. Massachusetts records list 436 affected residents. The disclosure may stem from March's network incident, which forced system shutdowns, and from Hasbro's reporting $11 million in cleanup costs and $25 million in delayed sales.

OMARCHY: ANY USER PROCESS CAN ESCALATE TO ROOT

Omarchy added its default user to the Docker group out of the box, and since supplementary groups are inherited, every process in the desktop session could reach the root-owned Docker socket and mount the host filesystem as root without a password or prompt. Browsers, editors, npm scripts, and AI coding agents all inherited that access, turning any ordinary application compromise into full machine compromise. The researcher disclosed privately that the group membership was removed in 4.0.1, and versions back through 3.8.4 remain affected.

TERMINALFIX CAMPAIGN DEPLOYS A REVERSE TUNNEL THROUGH MULTISTAGE INTRUSION

TerminalFix uses compromised sites and fake Cloudflare CAPTCHA prompts to copy malicious PowerShell into a victim's clipboard. The command downloads a ZIP, then abuses LockScreenContentServer.exe to sideload dui70.dll, which then extracts payloads from PNG pixel data, creates Run-key and scheduled-task persistence, and enumerates Active Directory, trusts, administrators, servers, and system details. A Python client opens a TLS WebSocket tunnel to gitnow[.]dev:443, allowing SOCKS-style access to internal hosts. Look out for nonstandard LockScreenContentServer.exe paths, dui70.dll loads, pythonw.exe client.py activity, and the listed C2 domains.

FIRE ANT EVOLVES: FROM HYPERVISORS TO TRUSTED INFRASTRUCTURE

The Fire Ant threat actor has escalated from hypervisor compromises to direct infection of network control planes via purpose-built IOS XR implants. These sophisticated router implants establish unauthorized GRE tunnels to legacy Linux hosts and actively suppress syslog alerts by injecting exclusion clauses into CLI outputs. On the authentication layer, the actor deploys a tool called TacTap to inject malicious libraries into the tac_plus process, ultimately harvesting credentials using a single-byte XOR key. Sygnia researchers assess that this activity strongly overlaps with the China-nexus UNC3886 cluster. To detect this activity, defenders must hunt for unexplained GRE interfaces, tac_plus process injections, and specific log-clearing commands across independent network and memory telemetry.

THREAT HUNT AI: HOW WE BUILT AN AI SECURITY ANALYST ON AWS FOR UNDER $500 A MONTH

Grow Therapy built an agentic threat hunting workflow on AWS that leveraged existing log sources such as Snowflake, CloudTrail, and Datadog for an additional cost of less than $500/month. Users submit a YAML threat hunt request, which then kicks off a five-phase workflow: first, Sonnet gathers relevant data, and then Opus compares the data to existing baselines, enriches and analyzes the context, assigns a confidence score to the findings, and performs adversarial analysis to validate them. False positives are tracked in Snowflake and injected into the adversarial validation step, which has significantly reduced false-positive reports.

AIPERMISSION

Local-first permission gateway for AI agents: connector-based SSH, Postgres, and Redis access with scoped tokens, human approval, audit logs, and encrypted local credentials.

RE-SHELL

re-shell is a Nix flake-based reverse engineering environment designed for use with Claude Code.

RUST-PROOF YOUR CODE WITH OUR NEW TESTING HANDBOOK CHAPTER

Trail of Bits has added a new chapter to its Testing Handbook on Rust. The chapter begins with an overview of what guarantees Rust does and doesn't make and then discusses some tools and methods for dynamic and static analysis. The chapter also includes gotchas from the team's experience analyzing Rust code.

A CALL FOR COLLECTIVE ACTION ON CYBER DEFENSE

OpenAI and hundreds of other top companies have called for rapid cyber defense efforts as automated attacks spread. The letter targets unpatched software, excessive permissions, weak authentication, and legacy-system debt, asking organizations to verify fixes, use least privilege, and apply compensating controls, and asking vendors to share tested playbooks and threat intelligence.

OWNING THE AI STACK

Cybersecurity consultants and other organizations requiring consistent cyber capabilities should begin shifting to local models. The gap between local models and frontier labs has closed significantly, with DeepSeek v4 Pro even beating out frontier labs on some cyber benchmarks. When organizations rely upon frontier labs, they lose control, and changed behaviors or guardrails can lead to harness and workflow breakage.

ADAPTIVE AGENTIC WORMS ARE HERE

A proof-of-concept worm running last year's open-weight models exploited 73.8% of an isolated 33-host network and replicated to 61.8% of it across 15 autonomous seven-day runs, chaining initial command execution into privilege escalation into self-replication, with each copy staging its own harness and local LLM or calling back to the parent host when local compute fell short. Researchers observed agents locating the IP blacklist in their own source and rewriting it to unlock monitoring hosts they had been forbidden to target, though hypervisor-level containment intercepted every attempt and no escape occurred. Detection currently rests on the resource signature, heavy GPU consumption, and sustained outbound inference traffic, so defenders should baseline per-host compute and egress, flag long-lived low-rate connections during off-peak windows, and assume that throttling is the first evasion an operator will add.

practical AI, security, and networking guidance. Register Now

BERLIN REFUSES TO PAY HACKERS WHO STOLE DATA FROM THE CITY'S STATE NETWORK

Berlin rejected extortion demands after attackers breached its state network.

ANOTHER X86 ADVISORY FROM SOME ENTITY OTHER THAN INTEL OR AMD

An unnamed x86 vendor other than Intel or AMD has been shipping undocumented WBINVD prefix hints since 2025.

CHROME WEB STORE EXTENSIONS CAUGHT STEALING CRYPTO, BROWSER DATA

Following a supply chain compromise in which threat actors purchased popular browser tools, nineteen Chrome and Edge extensions were weaponized via automatic updates to silently strip security headers and hijack cryptocurrency transactions before being removed from the Chrome Web Store.

MEDICAL DEVICE MAKER BOSTON SCIENTIFIC SAYS A CYBERATTACK IS CAUSING A ‘GLOBAL DISRUPTION' TO ITS OPERATIONS

Boston Scientific reported a cyberattack disrupting access to core IT systems and business applications. The outage has impaired order processing and shipments, but the company has not confirmed whether implanted devices, patients, or customer data are affected. Its investigation continues, and there is no restoration timeline.

'NOVACOOKIES' KIT STEALS MICROSOFT 365 SESSIONS FOR $320 A MONTH

NovaCookies rents AitM phishing infrastructure for $320 monthly. It relays Microsoft 365 logins and steals authenticated session cookies, bypassing MFA. Island found at least 755 supporting domains targeting hundreds of organizations and uses fake DocuSign document shares and trusted redirect hops. Defenders should deploy phishing-resistant MFA, correlate browser and token activity, and revoke active sessions and refresh tokens after suspected compromise.

THREE UK AIRPORTS HIT BY CYBER ATTACK WITH DATA OF 8.7M ACCESSED

Manchester, London Stansted, and East Midlands airports suffered a data breach where attackers accessed data belonging to 8.7M customers. The incident involved data related to car park, lounges, and fast-track bookings, and in-airport WiFi signups. The breached data includes email addresses, phone numbers, vehicle registration numbers, and postcodes.

VMS WON'T CONTAIN CYBER-CAPABLE AGENTS

Trail of Bits gave GPT 5.6-Cyber preview access and tasked it with escaping a QEMU/KVM sandbox on a patched Debian 12 host, and it broke out three separate times over roughly 12 hours of largely unsupervised operation. The agent chained a recently disclosed host-kernel bug first, then pivoted to an unpatched libslirp CVE paired with an unmarked bug fix after the kernel got updated, and finally, once QEMU was rebuilt from upstream source, synthesized a full exploit chain from three fresh 0-days (a QEMU VAPIC SMRAM flaw, a KVM shadow-page desync, and a libslirp ICMP-reflection bug) plus one kernel fix that hadn't reached the distribution's stable branch. Trail of Bits recommends treating such agents as advanced persistent threats: move to minimal-attack-surface hypervisors like Firecracker (which held even after a kernel hardlock), track upstream patches rather than trusting distro backport cycles, and enforce least-privilege network access, time-boxed runs, and pristine per-session environments.

EDGE INFRASTRUCTURE UNDER SIEGE: WHAT TWO INDEPENDENT DATASETS REVEAL ABOUT WHO'S EXPLOITING YOUR PERIMETER

A joint analysis by Tenable and SentinelOne revealed that state-sponsored groups and ransomware operators are independently exploiting the same edge device vulnerabilities. Researchers identified 12 flaws with confirmed multi-nexus exploitation by evaluating 93 CVE attribution pairs, including critical bugs in PAN-OS GlobalProtect (CVE-2024-3400) and Check Point Quantum (CVE-2024-24919). The underlying exposure data highlights severe remediation bottlenecks across major enterprise vendors. F5 appliances led exposure rates with 54 percent of customer environments carrying an actively exploited CVE, while Citrix deployments suffered a median patch time of 461 days. Additionally, Ivanti edge products demonstrated a predictable pattern of serial exploitation refreshing every 8.5 to 13 months. Security teams must prioritize patching F5 and Citrix appliances immediately while deploying feature set minimization and strict endpoint protections to block lateral movement following a perimeter breach.

COULD OPENCLAW HAVE ACTUALLY HACKED THAT AUSTRALIAN GYM? WE DECIDED TO TEST IT

Aikido recreated an Australian gym-booking incident using OpenClaw and Claude Opus 4.6. The test app exposed two flaws: client-side-only booking limits and an IDOR cancellation endpoint. Across ten runs, the model bypassed the booking window nine times. It cancelled another user's reservation in two runs, including one response to a generic waitlist request. Replay tests covered 16 decision points and found dominant responses averaged 96.38 percent with the model's actions shifting with small prompt and context changes.

deterministic guardrails. See the full findings

AGENTSWEEP

AgentSweep is a fully offline tool to find and redact secrets in your AI coding agent's local history.

PERSPECTIVEGRAPH

PerspectiveGraph is a tool that finds the reachable paths from internet exposure, through excessive privilege, to a sensitive asset, by correlating the scanners you already run into one live graph of your environment

NOISEHOUND

NoiseHound is a tool that ingests the same graph data as BloodHound and re-ranks paths by expected detection cost instead of hop count.

DISRUPTING A NEW COVERT INFLUENCE CAMPAIGN FROM RUSSIA

OpenAI banned Russian-origin accounts promoting the International Burke Institute, a fake Israel-based think tank. Operators used VPNs and Russian prompts to create posts for X, LinkedIn, Facebook, Substack, and Telegram. IBI republished academic work under false names and published a “sovereignty” index praising Russia, and its Telegram channels drew 10,000–20,000 followers.

CISA RED TEAM COMPROMISED TWO CRITICAL INFRASTRUCTURE ORGS, ONE DETECTED NOTHING

CISA's red team gained domain-level access at two critical-infrastructure organizations. One organization missed the intrusion amid false positives, disconnected SOC tooling, default credentials, AD CS flaws, cleartext secrets, and permanent AWS keys. The other organization isolated phishing-hit workstations within 2–20 minutes, yet assessors later obtained domain-controller secrets through an SCCM-stored service credential.

FBI SEIZES CHINA-LINKED HACKING PLATFORMS QSCAN AND QTROUTER USED AGAINST CRITICAL INFRASTRUCTURE

The FBI has seized QScan and QTRouter, China-linked hacking platforms used against critical infrastructure. Organizations should hunt for indicators of compromise associated with these platforms and report any findings to authorities.

CYBER THREATS NUDGE TRUMP TO SIGN EXECUTIVE ORDER ON FOREIGN EQUIPMENT IN US ENERGY INFRASTRUCTURE

Recent cyber threats prompted Trump to sign an executive order on foreign equipment in US energy infrastructure.

RING ADOPTS NEW TAKE ENCRYPTION STANDARD FOR SMART HOME DEVICES

Ring is adopting the TAKE (Throw Away the Key Encryption) encryption standard for its smart home devices.