Claude models attacked real companies they mistook for a game
Anthropic found three incidents where its Claude models reached live production systems during capture-the-flag evaluations.
The Latest
Azure Cosmos DB bug could have unlocked every tenant database
Wiz found a chain it calls CosmosEscape that let a crafted Gremlin query grab a platform-wide master key.
Prompt injection turns Word documents into self-spreading worms
Researcher Hakon Maloy showed how hidden instructions in a Word file can alter Copilot output and copy themselves into new…
Okta buys Permiso to pair identity posture with threat detection
Okta's deal for Permiso Security merges identity threat detection with posture management as AI agents multiply.
Fake macOS update pages drop crypto stealers in DPRK campaign
North Korea-linked actors are using fake full-screen macOS updates to push ClickFix-style clipboard attacks.
Gitea patch blocks RCE that turned patches into git hooks
CVE-2026-60004 lets a repository writer plant a git hook and run commands as the Gitea service account.
CareCloud breach hits 350,000 with medical and financial data loss
Hackers stole personal, financial and medical data from CareCloud's AWS environment in March.
BMC research finds 24,650 servers leaking password hashes
Research finds tens of thousands of internet-facing BMCs disclosing IPMI password hashes without authentication.
Image uploads can leak Rails master keys through critical Active Storage bug
A CVSS 9.5 Rails Active Storage flaw lets unauthenticated attackers read arbitrary server files through crafted image uploads.
CVSS 10 Ruflo bug gives attackers full control of AI agents and their memory
Ruflo's unauthenticated MCP bridge earns a perfect CVSS 10 as researchers demonstrate AI memory poisoning.
Attackers weaponize Cisco FMC static credentials before Cisco released hotfix
CISA adds actively exploited Cisco FMC static credentials flaw to its known vulnerabilities catalog.
Spy group OWAReaper backdoor survives password changes and device rebuilds
TA488 exploits OWA cross-site scripting flaw to plant browser implants that survive credential rotation.
ShinyHunters takes credit for DentaQuest breach exposing 23 million patients
DentaQuest is notifying over 23 million patients after the ShinyHunters extortion group stole 234 GB of data including Social Security…
Microsoft launches first cybersecurity AI model as part of Project Perception
Microsoft unveiled MAI-Cyber-1-Flash, its first specialized cybersecurity AI model, scoring 96% on CyberGym benchmarks and cutting vulnerability discovery costs by…
Spotlight
JetBrains patches critical TeamCity bug allowing unauthenticated server takeover
CI/CD platforms have become prime targets for attackers seeking supply chain access, and JetBrains’ latest security advisory underscores the risk.
VMware VM breakout threat patched across ESXi product line
Broadcom shipped emergency patches for a critical VM escape vulnerability affecting VMware ESXi, vCenter, and Fusion products.
Coordinated OT attack hits over 30 Minnesota water utilities
A coordinated cyberattack targeted operational technology systems at more than 30 community water utilities across Minnesota.
Cyera buys Oasis Security for $1B in identity-data merger
Data security company Cyera agreed to acquire agentic access management provider Oasis Security in a $1 billion deal.
Features
Microsoft 365 accounts hijacked through compromised hotel Wi-Fi gateways
Threat actors compromised captive Wi-Fi gateways at hotels to silently redirect business travelers to fake Microsoft 365 login pages.
Iran-linked hackers turn victim machines into covert relays with NightLedger
Nimbus Manticore deploys NightLedger backdoor and custom WebSocket tunnelers to turn compromised systems into covert relay nodes across the Middle…
BlackFog dissects MedusaHVNC malware that hides entire browser sessions from victims
BlackFog researchers dissect MedusaHVNC, a remote access trojan that exploits Windows hidden desktops to hijack browser sessions and evade detection.
Certighost exploit opens Active Directory certificate services to domain takeover
Researchers released a Certighost exploit for a critical AD CS flaw that lets authenticated users escalate privileges to full domain…
Hollowgraph malware turns Microsoft 365 calendars into covert spy channels
Group-IB discovered HOLLOWGRAPH, malware that uses Microsoft 365 calendars as covert command channels with events dated to 2050.
Russian Laundry Bear group exploits Zimbra zero-day to steal email and 2FA codes
US agencies warn that Russian APT group Laundry Bear is actively exploiting CVE-2025-66376 against unpatched Zimbra Collaboration servers worldwide.
