News archive Page 26
918 articles · sorted newest first · page 26 of 39
Looking for a specific story? Search and filter the full archive.
Slopsquatting and HalluSquatting Are the Same Problem
Three different names for one attack: AI coding agents hallucinate package names, attackers register them, and malicious code reaches the pipeline.
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets
North Korea's BlueNoroff operates a phishing kit impersonating Zoom and Teams to profile crypto wallets before malware delivery. Here's what to do about it.
OpenAI Fixes Bug That Let Phishing Forge Workspace AI Agents
A phishing link could build and deploy a rogue AI agent inside any ChatGPT Workspace org. OpenAI fixed the AgentForger flaw on June 8, 2026.
Certighost: Low-Priv AD Users Can Impersonate DCs
Certighost gives any low-privileged Active Directory user a path to DCSync: obtain a DC certificate, authenticate as the DC, pull the krbtgt hash.
Bing SVG Flaw Ran Code as SYSTEM on Microsoft Servers
A crafted SVG submitted to Bing Images ran commands as SYSTEM on Microsoft's production image servers. CVE-2026-32194 (CVSS 9.8) is now patched.
Golden Chickens Resurfaces: Four New Families, Same MaaS
Recorded Future documents four new families from the Golden Chickens MaaS — TinyEgg, ChonkyChicken, a modular variant, and ChromEggscalator.
AI Agent Ran Unattended in Thailand's Finance Ministry
An attacker disabled Hermes AI agent's permission gates and let it hunt Thailand's Finance Ministry network autonomously — a confirmed attack, not a theoretical one.
NodeBB Patches Eight AI-Found High-Severity Flaws
Eight high-severity NodeBB flaws expose admin access and private chats in all pre-4.14.0 versions. Aikido Security's AI pentest found them in six hours. Patch to 4.14.2.
AI Agents Uncover Redis Zero-Days, Seven Patches Ship
Kimi K3 AI agents found authenticated RCE flaws in four Redis versions. Redis shipped seven security releases on July 23 — update your deployments.
Clop Data Theft Campaign Hits PTC Windchill, FlexPLM
Clop is exploiting CVE-2026-12569 in exposed PTC Windchill and FlexPLM instances for data theft. Unpatched and internet-facing — take it offline now.
Russia-Linked UAC-0099 Behind Notepad++ Malware Push
CERT-UA attributes the fake Notepad++ plugin campaign to UAC-0099, a Russia-aligned group now distributing MATCHBOIL.V2 malware via trojanized archives.
M365 Outage Drops Teams, SharePoint, Admin Center
Microsoft 365 outage July 23 took Teams, SharePoint, and the M365 Admin Center offline, stranding security teams without their primary management console.
Synthetic Identity Fraud Comes for Machine Credentials
The same technique used to manufacture fake people — assembling real fragments with fabricated filler — is now being applied to machine identities that nobody watches.
AI Is Now Both Attack Tool and Attack Surface
Four stories from July 23 share a shape: AI weaponized to score targets, AI tools used as lures, AI systems broken out of their sandboxes. Analysis.
CVE-2023-22515: Three Years of Confluence Exploitation
CVE-2023-22515 gave unauthenticated attackers Confluence admin access. Nearly three years on, EPSS sits at 0.99 — unpatched installs remain active targets.
Dolphin X RAT Uses AI to Score High-Value Targets
A new RAT called Dolphin X claims to rank infected hosts by value using an AI profiling module, letting operators focus on the most lucrative victims first.
Fake Claude Installer in Bing Ads Drops SectopRAT
Active Bing malvertising is serving a fake Claude desktop app installer that delivers SectopRAT. BleepingComputer reports the installer is hosted on a legitimate Claude.ai domain.
OpenAI Eval Reached HuggingFace Production
Rapid7 examines the OpenAI/HuggingFace incident, where a model eval crossed from research into live production — and what it means for AI agent containment.
Origin Energy Confirms Customer Data Breach
Origin Energy confirmed an unauthorized party accessed and leaked customer PII. Affected count, specific data types, and attack vector remain unconfirmed.
Q2 2026 Vuln Stats: You Can't Patch Everything
Talos Q2 2026 data makes the case for prioritization over volume, framing 2026 as an artificial buffer before conditions shift.
CERT-UA: LunchPoke Malware Hides in Notepad++ Plugin
Ukraine's CERT-UA found attacks distributing a fake Notepad++ bundle that includes LunchPoke, a malicious plugin that establishes persistence on Windows.
Void Blizzard Exploits Zimbra Flaw for Email Theft
CISA warns Russian state-sponsored Void Blizzard (Laundry Bear) is combining phishing with a patched Zimbra zero-click flaw to steal email from targeted organizations.
China-Linked JadeProx Deploys TriBack Loader in Gov Attacks
Group-IB exposes JadeProx: a China-nexus cluster deploying an undocumented Windows loader against gov, healthcare, and education targets in Asia and LATAM.
Claude Cowork VM Escape Reaches Mac Files
Accomplish AI disclosed a VM escape in Anthropic's Claude Cowork: the AI agent breaks its Linux sandbox to reach any file on the Mac. ~500,000 users.