|
|
Monday starts with the usual promise that everything is under control. Then the logs wake up.
This week, trusted tools crossed lines, old flaws found new work, exposed systems stayed exposed, and attackers kept hiding inside normal-looking services. Nothing looked strange at first. That helped.
That is the mood. Here is the full recap.
⚡ Threat of the Week
OpenAI Says Its AI Agent Went Rogue and Targeted Hugging Face — OpenAI disclosed that it lost control of two AI models during a security evaluation that ended in a breach of Hugging Face. The AI company said its AI models broke out of a sealed testing environment and broke into Hugging Face's production system to find solutions for the ExploitGym benchmark. "The incident also makes clear that advanced models can discover and exploit novel attack paths in real-world systems without source-code access," OpenAI said. "It highlights that advanced cyber capabilities must be developed alongside stronger safeguards and defensive tools." The development is the latest sign that capable AI models can pose serious cybersecurity risks even when they're being tested for defensive or research purposes. The incident also demonstrates that frontier models are becoming more capable of carrying out complex, multistep cyber operations, particularly when guardrails designed to restrict that activity are removed. OpenAI did not say what data was accessed.
|
|
|
|
|
Know Your AI Blast Radius Before Cybercriminals Do
If one of your AI agents were compromised right now, how much damage could it do – and how fast would you know? Keeper's free AI Agent Blast Radius Calculator tells you exactly where you stand: 10 questions, instant results and no form required. Assess your AI agent risk now.
|
|
|
|
|
|
|
|
|
🔔 Top News
Check Point Patches Exploited SmartConsole Flaw — Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild. The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass affecting the Check Point SmartConsole login process that allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Lotem Finkelstein, vice president of research at Check Point, said the company is aware of a handful of customers being targeted by this flaw, and that it has already notified them. It did not disclose the nature of the attacks or when they were discovered. China-Nexus Operation Uses TriBack Loader — A threat actor with ties to China has been observed using DLL side-loading techniques to deliver TriBack Loader, which is used to deliver AdaptixC2 and Beagle. Targets of the campaign include a Vietnamese public hospital's medical imaging system, the Malaysian Ministry of Foreign Affairs, and multiple Hong Kong educational institutions. The activity has been codenamed JadeProx by Group-IB. The threat actor exploits internet-facing systems in Southeast Asia to drop web shells for persistent access. Against end-user targets in Latin America, spear-phishing ZIP archives or MSI installers are used to deliver TriBack Loader. "JadeProx operates by conducting phishing campaigns delivering Windows loaders for initial access, tunnelling tools maintaining persistence across compromised networks, and custom Go-based relay infrastructure keeping the operator’s traffic hidden behind Alibaba and Cloudflare," Group-IB said. Hacker Runs Hermes AI Agent to Target Thai Finance Ministry — An unknown threat actor leveraged Hermes, an autonomous AI agent using "YOLO" mode, to target Thailand's Ministry of Finance (MOF), an analysis of three simultaneous open directories hosted on AS132883 (TOPIDC) has revealed. "Hermes output logs show the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous," Hunt.io said. "Purpose-built scripts target MOF Hadoop infrastructure with a HiveServer2 client using hardcoded credentials and a malicious Hive UDF issuing commands and returning output over WebHDFS." Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes — A Russian state-supported espionage group codenamed Laundry Bear exploited a then-zero-day in Zimbra (CVE-2025-66376) to access Western mailboxes. The issue was fixed by Zimbra in November 2025, but not before it was weaponized in attacks targeting government and commercial organizations since July 2025. The attacks are designed to deliver a JavaScript payload called ZimReaper that captures the victim's credentials and 2FA codes and sends them to actor-controlled infrastructure. The flaw affects Zimbra Collaboration Suite version 10.0 before 10.0.18 and 10.1 before 10.1.13. Certighost Exploit Allows Privilege Escalation — A proof-of-concept (PoC) exploit has been released for CVE-2026-54121 (aka Certighost), a critical privilege elevation vulnerability in Active Directory Certificate Services (AD CS) that lets any authenticated domain user perform privileged Active Directory operations. Microsoft patched the flaw earlier this month. "The exploit lets any low-privileged, authenticated domain user with no requirement for admin rights or user interaction required to obtain a valid certificate impersonating a Domain Controller and use it to run DCSync and extract the krbtgt secret, a precursor to Golden Ticket-level domain compromise," Dataminr said.
️🔥 Trending CVEs
Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.
Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-32194 CVE-2026-32191 (Microsoft Bing), CVE-2026-10591 (AWS Kiro), CVE-2026-48294 (Adobe Acrobat Chrome extension), CVE-2026-8933 (snap-confine), CVE-2026-16232, CVE-2026-62144, CVE-2026-62145 (Check Point), CVE-2026-64600 (Linux kernel), CVE-2026-15226 (Ubuntu), CVE-2026-15899, CVE-2026-15900, CVE-2026-15901 (Google Chrome), CVE-2026-15342 (Plane), CVE-2026-16411, CVE-2026-16412, CVE-2026-16360 (Mozilla Firefox), CVE-2026-16157 (Duplicati), CVE-2026-14985 (Analog Way Picturall Quad Compact Mark II), CVE-2026-47056, CVE-2026-60217, CVE-2026-60358, CVE-2026-60360, CVE-2026-60365, CVE-2026-60366, CVE-2026-60379, CVE-2026-60389, CVE-2026-60644, CVE-2026-61211, CVE-2026-60402, CVE-2026-61146 (Oracle), from CVE-2026-15611 to CVE-2026-15617 (Logto), CVE-2026-57239 (Foxit PDF Reader), CVE-2026-57308, CVE-2026-23795, CVE-2026-23794 (Apache Syncope), CVE-2026-65906, CVE-2026-64812, CVE-2026-64813 (JetBrains), CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, CVE-2026-8314 (Rockwell Automation), CVE-2026-12927 (Schneider Electric), CVE-2026-42958, CVE-2026-42953, CVE-2026-49033 (Labcenter Proteus PDSPRJ), CVE-2025-40947, CVE-2025-40948, CVE-2025-40949 (Siemens ROX II OT switches), CVE-2026-54052 (n8n), and multiple vulnerabilities in NodeBB, Redis, and Zimbra (no CVEs).
🎥 Expert Webinars
AI Ships Code Faster Than Security Can Review It → AI-assisted development is producing more code than traditional review and CVE-based remediation can keep up with. This webinar gives security leaders a practical framework for controlling the growing attack surface, enforcing secure-by-default development, and scaling delivery without losing control of software risk. AI Attacks Move in Minutes. Can Your Security Team Keep Up? → AI can now find vulnerabilities, build exploits, and chain attacks faster than traditional security operations can respond. This webinar presents a practical framework for expanding attack-surface visibility, speeding up investigations, and building security operations that can contain machine-speed threats.
📰 Around the Cyber World
Meta Announces Facebook Verified — Meta announced Facebook Verified, a free badge designed to confirm that a Facebook profile belongs to a real person rather than an AI-generated fake. "Facebook Verified uses a simple selfie-based process," Meta explained. "You record a short video selfie, which we check against your existing profile photos to confirm a match. The process is free and typically takes just a few minutes. Accounts must meet our trust and safety standards to qualify for verification." New Kali365 Ringer Phishing Attack Uses Google Sites Voicemail Wrapper — ZeroBEC said it detected a Kali365 device-code phishing attack targeting an unnamed financial, regulated customer. "The lure used a missed-call notification and a trusted Google Sites wrapper before redirecting through Google redirector, OCI API Gateway, and a Cloudflare-protected Kali365 host," ZeroBEC said. "The campaign targeted multiple organizations on the same day, including financial and insurance services customers, using the same Google Sites landing page, sender subdomain, subject pattern, and fake internal reference ID. The user was instructed to authorize an attacker-controlled device-code session through Microsoft rather than submit a password to a fake login page." The voicemail-themed attack has been codenamed Kali365 Ringer. 53 Slopsquatting Targets Across 5 Frontier LLMs — A new piece of research has found frontier models, including across Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2, are hallucinating non-existing package names, posing software supply chain risks. Of the 127 names initially identified, 53 of them, 41 on PyPI and 12 on npm, were still available for registration as of April 2026. "An attacker could publish malware under one of these names and wait for an AI coding tool to recommend it to a developer," Socket said. This technique, known as slopsquatting, exploits package names that AI models repeatedly invent. Because every model in the study generated the same names, one malicious registration could potentially target users across several model providers." How SVGs Carry Malicious Scripts — A new analysis from ReversingLabs has detailed how the abuse of SVG files in cyber attacks can complicate detection. "Threat actors use this functionality to craft SVG files that can act maliciously," ReversingLabs said. "Malicious SVGs can take the form of fake login pages, data exfiltrators, or malicious downloaders, amongst other things. SVGs are frequently overlooked, as they are assumed to be benign images, leaving a gap in security architecture. SVGs are difficult to detect, can easily be snuck into emails or webpages, and are able to perform malicious and legitimate actions simultaneously. Many security solutions do not account for malicious SVGs, seeing them only as images." From ClickFix to ClaudeFix — A new campaign has been observed using shareable Claude chats to host ClickFix instructions, leading to the deployment of malware. "As AI platforms have grown in popularity, threat actors have increasingly abused legitimate features such as shareable chats to lend credibility to malicious content," Zscaler said. "Malvertising was a key part of this campaign. Attackers used paid ads to lure Mac users searching for Claude into shared Claude chats that instructed them to run ClickFix commands leading to the download of MacSync Stealer." Microsoft Bolsters Windows Enterprise Activation Security — Microsoft is making Trusted Platform Module (TPM)-backed attestation a requirement for Windows Key Management Service (KMS) to activate Windows devices at scale. "As attackers have exploited fake or cloned KMS servers, organizations face increased compliance and licensing risk," the tech giant said. "Microsoft is now further strengthening defenses with KMS Hardware-Secured, which uses Trusted Platform Module (TPM)-based attestation to help verify that a KMS host is running on trusted hardware before it can activate Windows devices. Starting with upcoming Windows Server releases, KMS hosts must prove they are running on verified, uncompromised hardware before activating clients. This is achieved through TPM – a hardware root of trust that provides cryptographic proof of integrity." Abusing Trusted Business Workflows to Deliver Phantom Stealer — A new phishing campaign is disguising itself as routine business communications to lend it a veneer of trust and deliver Phantom Stealer. The phishing lures distribute malicious JavaScript files packaged within compressed archive attachments. "Although the emails impersonate different trusted entities, including a global logistics provider and a government tax authority, they ultimately lead to an identical multi-stage infection chain," Seqrite Labs said. "Once executed, the JavaScript downloader launches an obfuscated PowerShell script that performs the entire malicious workflow in memory, significantly reducing its on-disk footprint and making detection more challenging. The infection chain ultimately deploys Phantom Stealer v3.5.0, which harvests sensitive information from the compromised system and exfiltrates the collected data via SMTP using encoded content." What's in the INC Ransomware Panel? — An analysis of the INC Ransomware's negotiation panel has found it to be developed using React 18, with react-timer-hook utilized for countdown timers, react-viewer for image gallery, React-Toastify for notifications, and Socket.io for real-time chat. The panel has been active since 2024. The panel also supports file upload for test decryption, ransom tracking, and leak management. Origin Energy Confirms Data Breach — Australian energy giant Origin Energy Limited confirmed there was an "unauthorized access and disclosure of some customers' data," and that it's "working to understand the total number of impacted customers." Impacted information may include name, address, date of birth, contact phone number, and account information, as well as the last four digits of a credit card, or the last three digits of a bank account. An investigation was launched on July 22, 2026. NULLZEREPTOOL, a Telegram-Controlled DDoS and Multi-Function Attack Framework — Flare.io disclosed details of a Telegram-controlled attack framework called NULLZEREPTOOL that supports a DDoS engine and a "growing list of wireless attack, credential-theft, and botnet features that exist only in code, never observed in use." Two versions have been observed: an earlier variant with a focused DDoS and proxy management feature set, and a later variant that retains all previous functionality while adding WiFi/Bluetooth attack modules, credential extraction, and a hierarchical botnet tasking structure. The disclosure comes as the cybersecurity company also highlighted Mycelium, a botnet framework which has been advertised as an AI-as-a-Service platform. "Rather than describing a simple malware implant, the framework advertises a modular enterprise-grade architecture: production-grade C++ platform built around modular plugins supporting exploitation, persistence, browser forensics, distributed computing, reconnaissance, AI services, and autonomous operations," security researcher Assaf Morag said. North Korea's ClickFake Interview Campaign — North Korean threat actors with ties to the Contagious Interview campaign are leveraging ClickFix-like lures to target cryptocurrency and Web3 professionals with fake job interviews to deliver PylangGhost RAT on Windows and the GolangGhost RAT on macOS as part of a bogus skill assessment. "For ClickFake Interview, the actors are creating fraudulent companies or impersonating known ones in the crypto industry, and reach out to targets on social media (e.g., LinkedIn), inviting them to ClickFix-empowered fake skill assessments," SOCRadar said. "Their ClickFix panels incorporate gating, tailored questions based on advertised roles, psychological pressure to act fast, video recording, and social engineering that pushes targets to run malicious commands through fake camera errors."
🔧 Cybersecurity Tools
Beetle → It is an open-source, offline-first platform for analysing Android and iOS apps, including Flutter and React Native builds. It combines static analysis, evidence-backed findings, attack-chain correlation, source navigation, OWASP MASVS mapping, and reporting in one local workspace, with optional AI assistance for investigating results. ndrstnd → It turns a coding agent’s branch changes into a clear, evidence-linked story. Instead of reading thousands of lines file by file, you can see what changed, why it matters, where the risk is, and which exact diff hunks support each claim. It runs locally and works with Codex and Claude Code.
Disclaimer: This is strictly for research and learning. It hasn't been through a formal security audit, so don't just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law.
Conclusion
The lesson this week is simple: attackers do not need everything to fail. One trusted tool, one old bug, one exposed service, or one careless setting can be enough.
The best defence is still the boring work. Patch early. Remove access nobody needs. Watch the tools that act on your behalf. Treat anything public as something people will eventually test.
That is the week’s warning. Small gaps rarely stay small for long.
|
|
|
|
|
|
|
