A single prompt undid the guardrails on AWS agent infrastructure
One chat message pulled temporary cloud credentials out of an agent and opened every other agent in the account.
The Latest
Shai-Hulud worm burrows into an AI agent platform’s SDK
A poisoned npm release of Tensorlake's SDK carried a payload that hunts cloud credentials and can wipe a home directory.
Two odd characters let attackers fake trusted web addresses
Researchers registered 20 lookalike domains that Chrome and Edge display as the genuine article.
Let’s Encrypt will cut default certificate life to 64 days
The shorter lifetime starts February 10, 2027, and it is a rehearsal for 45-day certificates in 2028.
A leader of a 15,000-mule laundering network admits guilt in the US
Your Mule Cashout moved stolen funds abroad and stiffed the very people it recruited to withdraw the cash.
Cardiac monitor maker iRhythm says hackers took data on 360,000 people
Intruders spent five days inside third-party-hosted business applications before the company noticed.
A hidden chip inside Ledger wallets drained $93M in crypto
Tampered devices sold through one Southeast Asia reseller carried a circuit board that photographed recovery phrases.
An AI-driven crew turned 51 agents loose on Ukrainian targets
A Russian-speaking broker ran two attack pipelines at once, and an open directory handed researchers the whole operation.
Ransomware fixer accused of charging clients and paying the crooks
Prosecutors say a Florida recovery firm billed $19M for decryption it never actually performed.
Empire Market founder gets 40 years for a $430M dark web bazaar
A Virginia man who co-ran the marketplace from 2018 to 2020 will spend four decades behind bars.
Germany takes custody of an alleged Qilin ransomware leader
Japan extradited a Russian suspect arrested in Osaka, but the gang kept attacking during the handover.
Phone-call extortion crew pulled in $207M without any malware
A leaked chat archive shows the Silent Ransom Group targeting law firms through social engineering alone.
Engineer who locked his own employer out gets prison time
A core infrastructure engineer wiped admin accounts and demanded 20 bitcoin from the firm that employed him.
Hijacked island domains minted fake certificates for Google
Attackers seized three country-code registries and used them to forge trusted HTTPS certificates.
Spotlight
five flaws under active attack join the federal must-patch list
Federal agencies have three weeks to close a batch of old bugs now confirmed as actively exploited.
Budget Android phones ship with malware already in the firmware
A campaign called Midnight Mimosa plants persistent, uninstallable malware inside low-cost MediaTek devices across 150-plus countries.
Wind and solar controls sit wide open on the web
Researchers found 8,547 internet-facing systems at European renewable sites, including turbine dashboards with a live Stop button.
Exposed GPU monitors hand attackers the keys to AI clusters
A high-severity NVIDIA exporter flaw and thousands of open monitoring ports let anyone chart, and crash, the hardware running AI workloads.
Features
Unpatched backup server flaws become a path to crypto miners
Attackers are chaining two AhsayCBS bugs to plant webshells and mine cryptocurrency on exposed systems, with no vendor fix yet.
Three teams bank $560,000 for cracking a Pixel 10
A single phone target carried the biggest prizes at Pwn2Own Ireland, where researchers walked away with over $1.2M in total.
FBI seizes seven domains tied to a Chinese hacking contractor
Federal agents pulled down tooling that a Beijing-linked contractor used to probe power plants, airports and universities worldwide.
Crooks hide a ClickFix lure inside a ChatGPT Custom GPT
Huntress found attackers using a fake Custom GPT to funnel victims into a ClickFix malware chain.
Attackers stack two remote-access tools to keep a foothold on Windows
Microsoft traced phishing emails that drop one remote tool, then install a second, redundant one.
MI5 tells UK universities a research funder answers to Beijing
MI5 has publicly tied a Beijing research funder to China's civilian spy agency.