Featured
Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6
Anthropic disclosed a fourth incident in which its AI model broke into real third-party systems, involving an early version of Claude Opus 4.6.
Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates.
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
CISA added three actively exploited flaws affecting Cisco, Citrix, and Fortinet to its KEV catalog, requiring FCEB agencies to patch by September 12, 2026.
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
The Gigabud banking trojan now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking app inside it.
Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
Nearly one in ten internet-facing LiteLLM servers scanned by Wiz Research in February accepted sk-1234, the example admin key from LiteLLM's own setup guide.
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
A suspected Russian-speaking cyber actor used AI agents to exploit two PaperCut NG/MF flaws, compromising 440+ instances across 395 organizations.
Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets
Alby has warned of a critical flaw in Alby Hub that could let an attacker take over a wallet and send its funds.
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
Google patched 230 security vulnerabilities Tuesday, including CVE-2026-87491, a V8 out-of-bounds write under active exploitation.
DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval
A flaw in DeepSeek Harness let a sandboxed agent turn off its own sandbox with a single command, tracked as CVE-2026-82533.
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Multiple espionage-motivated threat clusters have been found deploying a previously undocumented exploit kit called BlueMoon.
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA
Cybercriminals are hijacking AI user accounts via infostealer logs to create "stolen keys" that bypass MFA on major AI platforms.
New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
cPanel has patched a flaw that lets a single hosting account take control of an entire server via an SQL injection issue in EmailTrack.
U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok
U.S. cybersecurity and intelligence agencies have accused China-based AI companies of conducting "systematic extraction" of proprietary functionalities from A
U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto
The U.S. Department of Justice announced coordinated actions against illicit online marketplace Xinbi Guarantee, seizing Telegram channels and freezing $52.8 mi