Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
MetaMask is responding to an ongoing security incident affecting part of its infrastructure. The company is proactively exiting affected validators in its non-custodial staking operations, coordinating with clients and partners. Lido confirmed the exits are underway, with final validators expected to be exited by October 7, likely incurring foregone rewards and possible downtime penalties.
OpenAI detected an extraction campaign beginning July 1, with spikes on July 24–25 involving 16,000 requests from more than 4,000 users. Related activity affected over 15,000 users and was disrupted by July 28. Operators replayed encrypted reasoning and used cross-conversation prompts, with OpenAI linking a core cluster to Moonshot AI personnel, restricted accounts, closed replay paths, added output checks, and shared indicators with partners.
British Transport Police ran a six-month live facial recognition trial at London rail stations, scanning over 500,000 faces.
Antino, a new Rust-based Windows backdoor that runs C2 entirely through Microsoft Graph API calls to attacker-controlled Outlook and OneDrive, compromised roughly 350 endpoints across Asia in a China-nexus espionage campaign that Cisco Talos tracks as UAT-11587.
Signal 8.30 brought end-to-end encrypted on-device backups to iOS and desktop, completing the secure backups rollout across all platforms with a standardized format, though attackers have reportedly begun targeting the recovery keys.
ControlPlane chained four OpenBao flaws into an unauthenticated-to-RCE exploit that forges a SPIFFE provisioner certificate via an ACME URI SAN bypass, hijacks an admin role through case-insensitive ACL paths, and crosses namespaces to restore a malicious Raft snapshot. The final step executes any pre-existing binary whose SHA-256 the attacker can guess, even on read-only images and auto-unseal nodes, and Vault Community Edition remains unpatched after IBM declined a mutual disclosure agreement. Upgrade to OpenBao v2.6.3 or v2.7.0, or, as a stopgap, remove plugin_directory and enforce ACME EAB via BAO_DISABLE_PUBLIC_ACME.
Researchers from VUSec and Scuola Superiore Sant'Anna disclosed Branch Target Reuse (BTR), a Spectre-v2 variant that reuses stale indirect branch prediction entries in JIT engines after code is freed and reallocated. Proof-of-concept exploits against the Linux cBPF JIT recover the root password hash in minutes on patched Intel systems with default protections. Mitigations are merged in the Linux kernel (CVE-2026-64507, CVE-2026-64508). Mozilla is prioritizing site isolation over IBPB-based fixes.
The Gold Star Mortgage Financial Group is facing a lawsuit from customers after an alleged data breach by the BrainCipher ransomware group. The lawsuit alleges that the ransomware group stole more than 10k files from the mortgage lender, including full names, SSNs, residential addresses, and other contact information.
The Creative Sound Blaster Katana V2X soundbar accepts unauthenticated Bluetooth connections and exposes its proprietary CTP control protocol over BLE. Firmware updates also use CTP and verify only a trivial SHA-256 checksum, allowing an attacker within ~15 meters to install custom firmware without pairing or physical access. The modified firmware adds a full USB keyboard HID descriptor and repurposes an existing diagnostic task to type commands after boot, turning the speaker into a remote BadUSB device. A proof-of-concept payload waits ~20 seconds for USB to initialize, then types echo pwned and presses Enter on the connected PC. Bluetooth stays enabled in sleep mode with no user-accessible toggle. Creative initially declined to classify this as a vulnerability.
This post describes a code execution technique in which an exploit abuses POSIX “cancellation points” to eventually execute code. This works by executing DWARF bytecode to mangle the .eh_frame_hdr data that is used when unwinding the stack. While this technique was discovered in the context of CTFs, it has applications outside of CTFs.
Invictus traced a run of 2026 incidents to stolen classic GitHub PATs, typically lifted from developer endpoints by info-stealers and used to map every reachable repository through bursts of /repositories/{id}/readme API calls before cloning. In one case, a single token exposed 1,100+ potential secrets across 300+ repos, and validating and rotating them took 30+ people over a week. Since GitHub keeps Git clone events for only seven days and api.request events require Enterprise audit log streaming, responders should scope to the token's full reach wherever logs are missing, then migrate off classic PATs to fine-grained tokens, GitHub Apps, or OIDC.
Reco maps active software agents, their identities, permissions, data access, systems, sessions, API connections, tools, workflows, and employee applications. Teams can revoke excessive permissions, disable risky integrations, and enforce access policies.
OpenShell is NVIDIA's sandboxed runtime for autonomous AI agents, enforcing per-agent policy on file access, syscalls, and network connections at the kernel level. Its standout feature is formal verification of policy changes, which flags risky new access, like credentialed calls to a new host, and holds it for human review. Agents never see real secrets, since credentials are injected only into requests bound for approved endpoints.
cgg (Call Graph Generator) is a tool that generates Mermaid diagrams of call graphs directly from source code.
Glow Labs found 13,000 internal screenshots posted to public GitHub repos by AI coding agents at 300+ orgs. Agents bypassed GitHub's CLI image limits by creating public repos or using gitshot, leaking billing screens, treasury consoles, and unreleased features. Most images lived in developers' personal accounts, evading org scanners. To prevent this, audit personal repositories and gists, restrict agent auto‑approval, and add runtime hooks to block pushes to public or non‑org repos.
During the Government Accountability Office (GAO)'s review of DOGE's access to sensitive data, six agencies could not or refused to provide sufficient records. The SEC and NOAA disputed the GAO's authority to conduct the investigation and refused to cooperate. The VA and SBA also did not provide records but didn't cite a reason for doing so. At the CFPB, access was granted to 19 systems, with one DOGE team member being able to view, modify, and delete information in the bureau's primary human resources system. At the Department of Education, one DOGE member received limited access to two federal student aid systems and an admin account on the department's network.
Anthropic posted a blog detailing the threat posed by GLM-5.3 as a cyber-capable, open-source model. Anthropic stated that GLM-5.3 performed comparably to Mythos Preview in ExploitBench, an internal binary exploitation benchmark, and a test of open-ended offensive cyber capabilities when paired with a human expert. Anthropic also reports that a deceptive prompt subverted GLM-5.3's guardrails 64% of the time, prefilling the model's thinking tokens subverted guardrails 92% of the time, and abliterated versions of the model do not contain these ls. guardrails.
Donald Trump and executives from Anthropic, Google, Meta, OpenAI, Nvidia, and xAI signed a voluntary accord.
Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that allows arbitrary code execution via a crafted file.
Starting in mid-October, Microsoft Entra ID will enforce a Content Security Policy that permits only Microsoft CDN-hosted scripts on browser sign-in pages at login.microsoftonline.com.
Sponsored
Hybrid environments mean more flexibility — and more consoles, more policies to sync, and more gaps to miss. This technical article shows
consolidate it all into a single dashboard. SEE HOW THE DEPLOYMENT WORKS: * GATEWAY LOAD BALANCER INTEGRATION: Route traffic to a FortiGate security VPC for unified inspection * UNIFIED SECURITY PROFILES: Configure routing tables and shared policies across cloud and on-premises * REAL-TIME DETECTION AND RESPONSE: Monitor threats and take action from a single FortiGate dashboard
The Defense Manpower Data Center exposed unencrypted personal data through a vulnerable file-sharing server. Unauthorized users accessed files between October 2025 and July 16, 2026. Records included Social Security numbers, names, birth dates, contact details, demographic data, and military specialties. The breach affects 2.76 million living people and 294,000 deceased individuals.
A high-severity flaw in the official MCP Python SDK let malicious MCP servers redirect OAuth token requests to attacker-controlled endpoints. Affected 1.x (1.9.1–1.29.1) and 2.x (2.0.0–2.1.1) clients sent the client secret, authorization code, and PKCE proof key to the attacker, enabling full account takeover with the app's granted permissions. Fixes are in 1.30.0 and 2.2.0. ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider also require passing issuer= to pin the expected login service.
The Dutch Institute for Vulnerability Defense (DIVD) reported that they suffered an AI-driven breach. The organization said that the breach was “loud and very, very messy” with the agent working autonomously and over explaining itself in comments, allowing the DIVD to easily reverse-engineer its attack. The threat actor exploited a vulnerability in a vulnerability in an undisclosed software that the organization stated was not Citrix NetScaler.
Sponsored Google results led victims to "Plus 5.6," a Custom GPT on chatgpt.com that answered every prompt with a fake outage notice pointing to a Google Sites ClickFix lure, and Huntress tied at least 40 incidents to the campaign. The eight-stage chain sideloaded malicious DLLs through Canon-signed (later Stardock-signed) binaries, hid its loader inside a WAV file and a NuGet package. It then unpacked a full-featured RAT from a custom encrypted file system that located its C2 over DNS-over-HTTPS. The signed hosts change with each wave, so defenders should detect behaviors instead: PowerShell spawning msiexec on GUID-named MSIs in %TEMP%, signed apps running from fake %LOCALAPPDATA%\Programs folders, and self-restoring Run key and scheduled task pairs, which require killing the process before removing persistence.
NeedyMantis is a modular post-compromise malware family deployed since at least October 2025 by China-based actors, including Storm-3069 from the DAEMON Tools supply chain compromise, against telecoms, universities, intergovernmental organizations, and government contractors. It was sideloaded as fake DLLs alongside legitimate software like Poedit, curl, Vim, and TightVNC, then unpacked from custom XOR-encrypted archives through shellcode loaders into a stripped-down PE format, and communicated over WebSockets with RC4-encrypted traffic and loadable modules. Defenders should hunt for spoofed DLLs such as WinSparkle.dll or libcurl.dll in unusual ProgramData paths, the hard-coded "firefox/21.0" user agent, and connections to corp.tripswithengine[.]com.
Enterprises monitor human logins closely but often grant autonomous AI agents broad production access via long-lived service accounts and API tokens. These agents can initiate, approve, and execute high-value actions end-to-end, collapsing segregation of duties. The piece lays out six controls: isolate agent identities, scope permissions to the minimum needed, assign a business owner, log prompts and tool calls, run periodic access reviews, and build an out-of-band kill switch.
Sponsored
Standing credentials are a liability. Every shared password or SSH key is one more thing an attacker can steal. Tailscale PAM grants access by identity instead, letting engineers reach databases and clusters without touching a secret. Sessions are logged. No jump hosts, no vaults.
Rig Security provides an identity protection platform for agentic AI. It maps identity dependencies across providers, cloud, on-prem, network edges, and endpoints. A lightweight sensor distinguishes AI agent sessions from human sessions and enforces policy at runtime, and the system blocks risky agent actions without disabling the human account.
A searchable list of tracked, signed, and abused kernel drivers.
cryptoptic is a tool that uses CodeQL, orchestrated via GitHub Actions, to scan a repository or entire GitHub organization and produce an inventory of every cryptographic function in use, the library it comes from, and when it gets called.
Dutch police arrested a 24-year-old Amsterdam man, identified by multiple sources as Pepijn van der Stap (aka “Umbreon”), in connection with the ShinyHunters hacking group. He previously served time for extorting over a dozen companies, earning €1.5–2.7 million, and was released in December while still facing civil suits.
The FBI told staff that a hack of its FBIJobs.gov portal exposed agents' and applicants' names, addresses, job titles, Social Security numbers, and some medical records, including blood and urine samples and psychiatric reports. ShinyHunters says it exploited an Oracle PeopleSoft vulnerability and is not demanding money, but wants the bureau to correct an earlier report about its activities. The portal remains offline, and the bureau has not publicly confirmed whether the breach meets the legal threshold for a “major incident” requiring notification to Congress.
OpenAI will not release GPT-6.1 Astra after tests found problems with scope, authorisation, and reporting completed work.
Microsoft linked Storm-3168, the actor behind JadePuffer (the first documented agentic ransomware), to an 18-hour June attack in which two hijacked Azure service principals were used for reconnaissance and then destruction, likely after an employee exposed client secrets in a public GitHub issue.
Sponsored
…and most teams aren't ready for it. After all, if a developer sent customer data to an unapproved model provider this morning, would anything in your stack have recorded it? This Airia eBook [5] lays out how to close the governance gap with: * 9 signals [6] that cover the sources of AI risk: your workforce, your infra, and your code * 6 requirements to look for in a discovery solution * 1 data-driven look at the state of play in AI security The EU AI Act's reporting clock starts at detection. Are you ready?
CISA added CVE-2026-88771 and CVE-2026-88772 to its KEV catalog after confirming global exploitation. Both have CVSS scores of 9.5. The flaws enable unauthenticated command execution, remote code execution, or denial of service. CVE-2026-88772 requires DTLS, which VPN virtual servers enable by default. Administrators should patch, inspect for compromise, isolate affected appliances, revoke access, rotate secrets, and investigate connected systems.
The Bank of Korea (BOK) is facing scrutiny over its cybersecurity program following a data breach earlier this year. The breach occurred in May and June after attackers accessed a GitHub system used by a contractor for an online training program. The exposed data included employees' names, email addresses, phone numbers, positions, duties, and passwords for 186 employees.
Security firm Patchstack warns users of the Elementor Website Builder plugin for WordPress about a new CSRF vulnerability that could allow unauthenticated attackers to create admin accounts. The vulnerability is a one-click attack that requires an authenticated admin to click a link that sends a malicious REST API request to create the account.
The traditional view of containers as a strong security and isolation mechanism is being eroded by the plethora of kernel vulnerabilities being uncovered. This article explains how a recent vulnerability in the AF_UNIX subsystem can be leveraged by attackers for container escapes. The authors recommend moving untrusted workloads to MicroVMs like Firecracker or Kata Containers for untrusted workloads.
DPRK's PolinRider malware spread through GitHub organizations by force-pushing rewritten commits from infected developers' machines, planting VS Code folderOpen tasks that run an obfuscated JavaScript payload disguised as fa-solid-400/500/900.woff2 and, since September 28, fa-solid-300.llf. OpenSourceMalware traced 853 force-pushes across three Binary-Mindz repos and found variants with different paths, obfuscators, and C2-reported build markers running in parallel, which it reads as deliberate A/B testing, while copied author dates and reused commit messages quietly reverted three cleanup attempts. Defenders should flag fake fonts by file content rather than name, scan every branch through bare clones, audit force-push activity logs, and enforce force-push blocking and signed commits on all branches.
AWS automatically attaches the AWSCompromisedKeyQuarantineV3 managed policy to an exposed IAM user within 10 seconds of a public GitHub push, with the CloudTrail AttachUserPolicy event misleadingly attributed to the victim's IAM user rather than to AWS automation. Each policy version tracked real-world attack evolution, with permissions added to block Lambda-based cryptomining, S3 data deletion for extortion, and Bedrock API abuse after Permiso's research exposed unauthorized InvokeModel calls. Security teams should alert on unexpected AttachUserPolicy events in CloudTrail, treat the quarantine event as confirmation of active key exposure rather than as resolution, and rotate all affected credentials before removing the policy.
Sponsored
Containers, remote teams, and data lakes each need different security approaches. Explore tutorials that walk you through zero-trust networking, identity-based access controls, and Amazon S3 antivirus scanning — matched to the right layer in your AWS environment. LEARN
Kontext Security runs a runtime enforcement platform that sits between AI agents and the systems they access. It checks each agent's identity, task, target resource, and requested action in real time. Teams can start in observe mode, then switch to enforcement to block unauthorized actions, as the platform logs every agent action and the decisions made, with context.
NVIDIA launched the Open Agent Safety Platform with OpenShell runtime controls and Sentry monitoring on BlueField-4 DPUs. OpenShell traces actions, applies policies, and supports NVIDIA, Arm, and Intel systems. Sentry verifies identity, inspects requests, protects data access, and can quarantine agents within milliseconds. Anthropic, Salesforce, SAP, Scale AI, and more than 100 organizations are integrating these controls.