News archive Page 31
918 articles · sorted newest first · page 31 of 39
Looking for a specific story? Search and filter the full archive.
Agent Data Injection: SQL injection, different decade
Seoul National, UIUC, and Largosoft show AI agents misread punctuation in trusted data as structural delimiters. No CVE, no vendor fix planned.
FortiSandbox: two 9.8 unauth RCEs hit KEV, Sunday deadline
CISA added CVE-2026-39808 and CVE-2026-25089 to KEV today — unauthenticated OS command injection in Fortinet FortiSandbox, CVSS 9.8 each, federal BOD 26-04 deadline this Sunday.
ClickLock macOS stealer kills apps until user types password
Group-IB documents ClickLock, a macOS stealer delivered via ClickFix that kills Finder, Dock, and browsers on a 210ms loop until the victim types their login password.
PhantomEnigma rides Brazilian .gov.br sites and mailboxes
ANY.RUN links a Brazilian banking crimeware operation to 20+ hijacked .gov.br sites and mailboxes, using signature-valid mail and trusted redirects.
AttackerKB's public tier closes August 18
Rapid7 retires the public AttackerKB site and its open submissions on August 18. Analysis, writeups, and API access move behind curation and a customer login.
23andMe settles genetics breach: $18M, 43 states
Multistate AG coalition led by New York's Letitia James. Settlement resolves claims over the 2023 credential-stuffing breach that exposed 6.9M customers' genetic profiles.
Daxin resurfaces in Taiwan alongside new Stupig backdoor
Symantec finds the Daxin kernel rootkit resurfacing at a Taiwan manufacturer, alongside a previously unreported pre-login SYSTEM backdoor called Stupig.
Two Scattered Spider affiliates get 5.5 years for TfL hack
Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty under the UK Computer Misuse Act. The 2024 intrusion knocked out 148 TfL systems and cost £29 million.
Unpatched Shark vacuums: regional root, no CVE, no patch
tokay0 published a Shark robot vacuum flaw July 13: over-permissive AWS IoT device cert grants root on any other Shark in the same region. No patch.
Spirals ransomware: full network encrypted in under 24h
Symantec documents Spirals, a new ransomware family: IIS web-shell entry to a fully encrypted network in under 24 hours — one confirmed victim so far, an IT services firm in South Asia.
OpenAI discloses GPT-Red, its internal automated red-teamer
OpenAI describes GPT-Red, an internal automated red-teamer that scales prompt injection discovery and adversarially trains later models against those attacks.
Cursor: opening a repo runs its git.exe. No patch, 7 months.
Mindgard disclosed a Cursor zero-day July 14 after seven months without a fix. Opening a repo with a git.exe file runs it as you. Windows only. No patch.
The July patch count Microsoft warned would come
Microsoft credited AI discovery for July's record 622-CVE Patch Tuesday. That's the second half of the story the MDASH post previewed a week earlier.
KB5099539 lands: Windows 10 ESU carries the July zero-days
Microsoft's KB5099539 delivers July's Patch Tuesday to Windows 10 22H2 and LTSC 2021 fleets, including two exploited zero-days. Enrollment required.
Intruder ships an LLM vuln-discovery product, plus a 0-day
Intruder shipped an LLM code-slicing pipeline that turned up a WordPress plugin zero-day, plus more bugs still under responsible disclosure.
CISA KEV: Oracle EBS Payments 9.8 unauth RCE lands
CISA added CVE-2026-46817 to KEV on Wednesday: unauthenticated CVSS 9.8 takeover of Oracle E-Business Suite Payments. Oracle's May 2026 CPU already has the fix.
Zoom PSIRT: patch Workplace 7.0.0, unauth takeover 9.8
Zoom pushed a critical unauth account-takeover advisory (ZSB-26014, CVSS 9.8) for the Windows Workplace client and VDI Client — patch to 7.0.0 or the branch build.
Dutch bust €100M fraud ring, 20 call centers, 700 shills
Dutch Politie takedown of a 2021-active investment-fraud ring — 20 call centers, ~700 fake advisers, five-country arrests, €100M+ estimated peak monthly.
SonicWall SMA1000: what Rapid7 saw before disclosure
Rapid7 caught the SMA1000 zero-day exploitation before SonicWall's advisory. Attackers took credentials, MFA seeds, and pivoted to internal domain controllers.
Unit 42: TuxBot v3 shipped LLM chain-of-thought in comments
Palo Alto Unit 42 documents TuxBot v3, an IoT botnet whose developer left an AI safety disclaimer and raw reasoning traces in the shipped binary.
Trend Micro: bandcampro ran a C2 botnet on Gemini CLI
Trend Micro logs 200+ Gemini CLI sessions from a Russian-speaking actor tracked as bandcampro: C2 migration, credential work, and daily botnet ops.
KNX account-lockout flaw added to CISA KEV, three years on
CVE-2023-4346 turns the KNX Association's account-lockout mechanism into a device-purge weapon on a building-automation bus. CISA added it to KEV under BOD 26-04.
AWS persistence: four patterns to hunt after an incident
Rapid7's Jan Blažek maps four AWS persistence classes — new IAM users, assume-role edits, Lambda backdoors, federated tokens — with the CloudTrail signals to hunt for each.
Kaspersky: OkoBot phishes seeds inside Ledger, Trezor apps
Kaspersky's GReAT team says OkoBot has hooked Electron in Ledger and Trezor apps since April 2025 to draw a fake seed-phrase prompt inside the real wallet UI.