<\/p>\n
SafePal has disclosed that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses, phone numbers, and purchase details of approximately 39,798 customers. \u00ab\u00a0All of the malicious RubyGems packages appear to be typosquats of popular Ruby dependencies, but rather than the clever SEO-fueled typosquats we’ve seen from other threat actors (e.g., events-channel imitating the popular Node.js events module), they’re all clumsy typos.\u00a0\u00bb The 16 gems have been published… OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker . The implant is equipped to harvest Windows credentials using pixel-perfect fake lock screens, offer a reverse SOCKS5 pivot into victim networks, execute arbitrary commands, and establish persistence on the host. There is no evidence that the technique has spread successfully in the wild, and the same paper reports that a review of archived posts from Moltbook, the social network for AI agents, found no successful agent-to-agent propagation despite several attempts.<\/p>\n<\/p>\n
Adform is telling people to clear their browser cache because the altered file may remain cached after the fix, and to check any wallet address before sending funds. Attackers modified a JavaScript file served by advertising technology company Adform , turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. \u00ab\u00a0We are proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques,\u00a0\u00bb the company said. N-able has released a fresh round of hotfixes for N\u2011central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management (RMM) product. A configuration that allowed arbitrary devices on that APN to communicate with one another let the attacker pivot from a compromised wind-farm network to a controller at the CHP plant. While the intruders were still active inside the network, and customers lost neither heat nor electricity.<\/p>\n<\/p>\n
More alerts are making your team slower, and an outcome-based SOC fixes that July 20, 2026 Google\u2019s $10,000 refund test shows why AI agents need zero trust August 18, 2026 Microsoft\u2019s August 2026 Patch Tuesday fixes roughly 400 flaws, including three Zero-days, with one actively exploited and two publicly disclosed. NIST seeks input on modernizing the National Vulnerability Database as AI reshapes vulnerability management, risk assessment and remediation. As enterprises race to bolt AI onto every business process, security leaders are being forced to answer a harder question… The program could allow vetted private US companies to access targeted systems without the owner\u2019s authorization and, in more disruptive operations, damage or destroy systems or infrastructure.<\/p>\n<\/p>\n
\u00ab\u00a0Specifically, on job search websites, after reviewing a candidate’s resume, the attackers contact a potential victim \u2013 typically a system administrator or IT specialist \u2013 on behalf of an IT company (such as ATLAS Business Group),\u00a0\u00bb CERT-UA said . The campaign is assessed to be ongoing since May 2026. CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145 , which is a subgroup within Sandworm (aka APT44, Seashell Blizzard, and UAC-0002), a sophisticated hacking group affiliated with the GRU. This week has plenty of them, covering cloud services, AI tools, malware, data breaches, scams, and new attack methods.<\/p>\n<\/p>\n
<\/p>\n
President Trump\u2019s bold vision to secure and accelerate American artificial intelligence (AI) innovation is being actioned through the creation of \u201cGOLD EAGLE,\u201d a clearinghouse that enables unprecedented cybersecurity vulnerability coordination. The report also found that cyberattacks are already a recurring business risk. Both versions were released last month. Google on Thursday announced that it fixed a whopping 1,072 security bugs in Chrome versions 149 and 150, surpassing the total number of flaws the company fixed across the prior 23 milestones combined. Windows ticketing keeps private-key operations available while the user is interactively signed in, allowing code running as the user to ask Windows to sign authentication data.<\/p>\n<\/p>\n
Targets of the campaign include manufacturing, automotive, aerospace, and retail sectors. Several Artifactory CVE records were published on July 27 with affected-version ranges and fixed-version thresholds, but neither JFrog nor OpenAI has said whether any of those records correspond to the vulnerabilities used during the evaluati… https:\/\/sportsbookpayperhead.com\/2024\/12\/27\/cybersecurity-best-practices-protecting-your-sportsbook-from-online-threats\/<\/a> OpenAI on Tuesday revealed the rogue artificial intelligence (AI) agent that escaped its sealed evaluation environment and broke into Hugging Face’s production environment also hacked multiple third-party accounts and services as part of the attack. Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge.<\/p>\n<\/p>\n The research highlights how compromised routers and IoT devices can be turned into distributed reconnaissance infrastructure that evades traditional IP-based defenses and supports follow-on exploitation. The botnet uses these devices to conduct targeted scanning and fingerprinting, helping threat actors rapidly identify vulnerable infrastructure\u2014sometimes within hours of a new vulnerability disclosure\u2014and appears to have a particular focus on U.S. military-related networks. This abuse has caused people to believe that fake images and videos are genuine and dismiss real content as misinformation.<\/p>\n<\/p>\n The Police National Legal Database (PNLD) has confirmed that police, government and customer contact information was compromised and published on the dark web. The Justice Department has never named the company, in Wednesday’s announcement or in the October 2024 indictment, identifying the victim only as a U.S. software-as-a-service (SaaS) pr… The intrusions reached at least 165 organizations and exposed records belonging to at least 100 million people.<\/p>\n<\/p>\n<\/p>\n
AI can find zero-days but still can\u2019t reliably write secure code<\/h2>\n<\/p>\n
<\/p>\n
\n