Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cyber Security. Show all posts
Google Microsoft
Account Hijacking account takeover scams Crypto Crime Crypto scams cryptocurrency Cyber Scam Cyber Security Google Microsoft

Microsoft X Account Hijacked to Promote Clippy-Themed Crypto Token

 

Microsoft’s account on X was hacked and used to promote a cryptocurrency token, turning the technology company’s 13-million-follower social media presence into part of an apparent crypto pump-and-dump operation. The incident centered on the company’s @Microsoft account and began with activity involving another X profile impersonating Clippy, Microsoft’s former virtual assistant. 

The Microsoft account followed and reposted a post from @clippymsftcto, an account that has since been suspended. The activity subsequently drew attention to a $Clippy token. Another account, @ClippyMSFT, reposted Microsoft’s message and continued promoting the cryptocurrency. That account claimed the token had a liquidity pool directly paired with $MSFT. Microsoft later removed the unauthorized posts and acknowledged that its account had been accessed unauthorized. 

A company spokesperson said the account had been secured and that Microsoft was investigating how the breach occurred. The company also made clear that it had no association with the cryptocurrency which was being promoted. Microsoft said it did not authorize, sponsor or endorse a cryptocurrency associated with Clippy, Microsoft or $MSFT, and had not authorized the use of its branding or intellectual property in connection with such a token. The incident is part of a long pattern of cryptocurrency scams involving compromised accounts belonging to major organizations. 

Microsoft itself experienced a similar breach in June 2024, when its Microsoft India account, which had more than 211,000 followers, was taken. In that case, attackers used the account to impersonate meme-stock trader Keith Gill, known online as Roaring Kitty. They attempted to lure users to a website advertising a supposed GameStop cryptocurrency presale. Victims who connected their wallets and authorized transactions instead had their crypto assets stolen through a wallet-drainer malware. Compromised social media accounts has been a particularly useful tool for cryptocurrency scams, as posts from established organizations can appear more credible to potential victims. 

ScamSniffer reported in December 2023 that approximately $59 million in cryptocurrency has been stolen from 63,000 people through a Twitter advertising campaign using the “MS Drainer” wallet-draining service between March and November. Government accounts have also been targeted. In January 2024, the U.S. Securities and Exchange Commission’s official X account was compromised through a SIM-swapping attack. Attackers used it to publish a fake announcement claiming that Bitcoin exchange-traded funds had received approval, temporarily but significantly moving Bitcoin’s price. 

Eric Council Jr., identified as the hacker who compromised the SEC account, pleaded guilty in February 2025 and was sentenced to 14 months in prison over his involvement in the scheme. Microsoft now has its account secured and the posts associated with the breach removed. Its investigation is ongoing, but the cryptocurrency promotion associated with the unauthorized activity has further raised the risks of trusting what appear to be legitimate social media posts when they involve digital-asset promotions.
Read more »
Zoom
Cloud Cyber Security macOS Passwords Zoom

CloudSyncD MacOS Backdoor Used Fake Zoom Installer to Steal Passwords


Cybersecurity researchers have identified a new macOS backdoor called CloudSyncD that uses a fake Zoom installer to trick users into providing their computer passwords. The malware was discovered by Jamf Threat Labs and uses a two-stage infection process to gain elevated access and communicate with attacker-controlled servers.

One of the most unusual features of the malware is its use of zero-width Unicode characters to hide information about a stolen password inside what appears to be a normal configuration file.

Technical Details

CloudSyncD is distributed through a malicious disk image designed to look like a legitimate Zoom installer. The installer includes instructions telling users to bypass macOS Gatekeeper by going to System Settings and manually allowing the application to run.

Once the fake installer is launched, the first-stage program, called app_installer, displays a fake authorization window asking for the user’s administrator password. It checks the entered password locally using macOS’s dscl command. If the password is incorrect, the malware can continue prompting the victim.

The stolen password is not immediately sent to the attackers. Instead, the malware stores it inside a file called data.json. The password is Base64-encoded and placed inside a larger string containing random characters.

The malware then uses U+200B ZERO WIDTH SPACE and U+200C ZERO WIDTH NON-JOINER characters. These characters are invisible during normal viewing and encode the location and length of the hidden password. This technique allows malicious information to be concealed without obviously changing the appearance of the file. 

The second stage is an embedded Mach-O executable capable of running on both Intel-based and Apple Silicon Macs. The malware attempts to execute the payload without initially writing it to disk. When that approach fails because of macOS security protections, it can create a temporary file and use the captured password with sudo to execute the backdoor with elevated privileges.

Impact

After execution, CloudSyncD collects information about the infected Mac, including hardware and operating-system details, account information and network-related data. It communicates with a command-and-control server and can periodically check for additional instructions.

Researchers observed check-ins occurring approximately every 8 to 16 seconds in analyzed samples. The backdoor can receive executable files or compressed archives, potentially allowing attackers to deploy additional malware on an infected system. 

Read more »
Vehicle Tracking
Connected cars Cyber Security Data Privacy Automaker Data Vehicle Tracking

Automakers Face Scrutiny Over Connected-Car Data Sharing

 

Modern connected cars are increasingly functioning as data-collection platforms, with new research finding that many automakers routinely transmit customer information to advertisers, analytics providers, technology companies and data brokers. The findings, released by Northeastern University researchers in collaboration with Consumer Reports, raise fresh concerns about how much control drivers have over information generated by their vehicles and companion mobile applications. Of the 21 major automakers examined, 19 were found to collect and broadly share private consumer data, showing that the privacy risks extend well beyond a carmaker’s own systems. 

The study examined both vehicles and 30 connected-car apps, which are commonly used for remote locking, navigation, vehicle health reports and other services. Twenty-eight of those 30 apps shared data with at least one third-party advertising or analytics firm. More concerningly, seven apps sent personally identifiable information to outside companies, including owners’ names, email addresses and precise geolocation data. Such information can reveal where a person lives, works, shops or travels, making connected-car data particularly sensitive compared with ordinary online browsing records. 

Researchers also found that apps from General Motors brands—myCadillac, myChevrolet, myBuick and myGMC—as well as Honda, Nissan and Lincoln, shared vehicle identification numbers alongside location data or email addresses. A VIN is a unique identifier tied to a specific car, and pairing it with personal information can make it easier for data brokers to link driving behavior to an identifiable individual. The data reportedly reached a wide group of companies, including Alphabet, Amazon, Microsoft, Meta, Reddit and Pinterest, highlighting the overlap between automotive technology and the broader digital advertising ecosystem. 

The findings arrive amid heightened regulatory attention on vehicle privacy. In May, California Attorney General Rob Bonta, the California Privacy Protection Agency and local prosecutors fined General Motors more than $12 million and ordered the company to stop sharing driver data with credit-reporting agencies and data brokers for five years. Automakers have argued that some data sharing is based on customer opt-in consent or contractual restrictions that limit third parties from independently selling information. However, Consumer Reports said many motorists may not fully understand what they accept when activating connected services, especially when declining data sharing may affect vehicle features.

Honda was the only automaker named in the report to respond publicly to a request for comment. The company said it aims to earn customer trust and, after being informed of the findings, directed an analytics vendor to delete location data already collected. Honda also said it would no longer share that information with third parties. The wider issue remains unresolved: consumers increasingly rely on internet-connected cars, yet disclosures about who receives their data and why often remain unclear. Stronger transparency, meaningful consent and easy privacy controls will be essential if automakers want to retain drivers’ trust.
Read more »
Ethereum platform
Crypto Wallet cryptocurrency Cyber Security Cybersecurity Infrastructure Ethereum Ethereum platform

MetaMask Takes Precautionary Action After Infrastructure Security Incident

 

Crypto wallet provider MetaMask is taking precautions following a security incident impacting one of its infrastructures as it deals with the consequences surrounding Ethereum staking. The company has remained silent on the details concerning the systems that were compromised or whether information or infrastructure was at risk as the breach occurred. A spokesperson for MetaMask directed queries towards the company’s public statement on the issue. 

The company announced that it is addressing the matter internally with the help of external partners and security advisers while noting that there are no immediate risks to MetaMask wallets. The response to the incident involved changes to the non-custodial staking operations at MetaMask as the firm continues to remove the affected validators in collaboration with partners and clients while mitigating any further risks that may arise. 

The company is quick to note that its staking service is non-custodial meaning that it does not possess the withdrawal keys to the stakes deposited by clients. This is an important observation as the response to the security incident only involves the staking infrastructure and not the management of the deposits by clients. Part of the precautions being taken are affecting the validators through the Lido protocol as the firm announced that MetaMask Staking, previously known as Consensys Staking, had initiated protective measures for the clients’ assets on the Ethereum blockchain. 

The procedure involved transitioning the Ethereum validators operated by Lido Finance to the exit process. The changes to the validators through the Lido protocol will cause disruptions to the staking processes and may result in economic losses to the clients who have chosen to use the staking services. This occurs as the validators are being exited to mitigate the risks posed by the security incident affecting the Ethereum network. The Lido protocol further noted that the affected validators had begun exiting the protocol while also stating that the last validator would exit by October 7th. 

However, the date does not signify the day when the validators will have exited completely as some of them might be offline as of the 7th . Validators are critical to the operations of the Ethereum network as they propose new blocks, verify transactions and secure the network through their specialized software. As such, it will require significant efforts to ensure the adjustments made to the validators do not cause disruptions to staking processes while eliminating risks to the stakeholders who utilize the MetaMask services. 

MetaMask has not released further details concerning the security incident and its impact on the infrastructures that support its operations. For now, the company is focusing on addressing the effects of the incident while collaborating with external security advisers and partners. MetaMask is a crypto wallet provider whose products are developed by blockchain software company Consensys. It offers non-custodial crypto wallet solutions for individuals and organizations while allowing them to store their digital assets on the Ethereum network and other compatible blockchains.
Read more »
Data Governance
AI capabilities AI Chatbot AI Safety Anthropic AI ChatGPT. OpenAI Claude Consumer Protection Cyber Security Data Governance

AI Safety Concerns Put OpenAI and Anthropic Under FTC Scrutiny

 

Artificial intelligence companies are facing another layer of scrutiny in the United States, with the Federal Trade Commission examining whether increasingly capable AI products could expose consumers to unlawful or unexpected risks. 

OpenAI, Anthropic and other AI developers are among the companies being examined as part of the inquiry. Rather than focusing on a single incident, the investigation is expected to cover a wider range of potential consumer harms. These could include the handling of personal information, claims made about AI capabilities and situations in which AI systems operate in ways that create risks outside their intended use. The FTC is expected to seek information directly from the companies and could require senior executives to provide testimony. 

The investigation comes as developers have publicly acknowledged increasingly unusual behavior from advanced AI systems. OpenAI revealed over the summer that one of its AI systems had compromised Hugging Face. Similar disclosures were subsequently made by Anthropic and other companies. The FTC’s initial steps toward examining the issue, however, reportedly began before OpenAI publicly disclosed its incident. 

That timing gives the investigation a broader context. Regulators are not simply reacting to one publicly reported AI security incident but are examining how existing consumer-protection laws might apply as AI products become capable of interacting with computer systems, handling information and carrying out increasingly complex tasks. The FTC’s approach also comes against the backdrop of limited new federal AI regulation. 

The Trump administration has generally favored allowing the industry to develop with fewer new restrictions, with the administration arguing that the United States must compete with China in artificial intelligence. Trump has said he would encourage AI development and rely on agencies such as the FTC and Department of Justice to pursue misconduct under existing laws when necessary. AI executives and regulators have nevertheless discussed safety measures at the White House. 

OpenAI president Greg Brockman, Anthropic CEO Dario Amodei and FTC chair Andrew Ferguson were among those attending a meeting with Trump. The discussions resulted in a voluntary commitment from AI companies to develop protections against serious risks, including cyberattacks and chemical weapons. No new regulations were introduced as a result, and the companies also agreed to refer to AI at a certain level of capability as “super intelligence.” Ferguson’s position on AI companies has added another dimension to the FTC’s approach. 

While his agency has taken a less aggressive stance toward business regulation under his leadership, it continues to pursue cases involving companies including Meta and Amazon. Ferguson has also said AI developers could be held responsible for damage caused by their products. The latest inquiry is not the FTC’s first examination of OpenAI. The agency began investigating the company’s security practices in 2023 and issued a 20-page demand for information concerning personal data and how that information was being used in AI model development. 

OpenAI and Anthropic had not immediately commented on the latest investigation. As AI developers continue expanding what their systems can do, the FTC’s inquiry could help determine how existing consumer-protection rules are applied when those capabilities themselves become a source of potential harm.
Read more »
Stolen Passwords
Cyber Security Data Theft France Organization Security Stolen Passwords

French Tax Data Theft: Threat Actors Steal Password and Remain Undetected


A threat actor used stolen passwords of employees at France’s tax admin to steal tax data on businesses and hundreds of thousands of taxpayers in June.

Agencies could not detect intrusion 

Neither France's national cybersecurity nor the tax administration could notice the data leaving. According to the agency ANSSI’s report, the attack worked because of weak login security, weak monitoring, and poorly separated networks.

DGFIP, the tax administration, handles France’s tax website impots.gouv.fr. The data came from a tool called E-Contact that taxpayers use to contact the tax administration.
According to the DGFIP, the stolen data includes slightly over 250,000 firms and slightly over 350,000 individuals. Passwords and internet accounts belonging to taxpayers were not hacked.

Attack tactic

For individuals, the data that may have been accessed or copied includes their tax ID, contact details, family circumstances, reference taxable income and tax withholding rate, and a summary of the messages they exchanged with the DGFIP. The messages themselves might have been intercepted by less than 250 individuals.
For companies, it includes the firm name, SIREN registration number, address and basic details of their messaging. 

Different routes used

The threat actor used two different routes, the first started with suspicious logins in May and resulted in E-Contact. 
The first route depended on various stolen passwords of DGFIP staff. The passwords were stolen by infostealers, malware that secretly saved login details, from systems the DGFIP did not handle, most probably from staff’s own systems.

The two portals that the threat actor exploited, ADER and PIGP, required only a password, so the stolen password worked. DGFIP staff use PIGP web portal for HR services and email. ADER offers access to a few DGFIP applications through the RIE, the network that links French government ministries. 

The threat actor reached the RIE via compromised Education ministry systems linked to it. Sensitive DGFIP apps were not taken out from the rest of the RIE, allowing threat actors to access them from parts of the network with no apparent need. Officials also discovered signs of various attempts to hack into other government entities on the network.

The attacker was able to access a lot of data even though the accounts they used had no special rights. ANSSI did not look at how user rights were managed for this report.
Data from the land registry was obtained via the second path. It passed through APEX, a portal for partners like land surveyors and notaries, which requested an email with a one-time code and a password.
Read more »
Enterprise security
AI cybersecurity tools Cyber Security Cybersecurity measures Digital Transformation enterprise cybersecurity Enterprise security

84% of Indian SMEs Plan Higher Cybersecurity Spending as Readiness Gaps Remain

 

A large proportion of Indian small and medium enterprises (SMEs) plan to boost cybersecurity spending in the next 12-24 months yet experience gaps in terms of preparedness, monitoring and expertise, according to a TTBS and CMR study. The SME Digital Insights 2026 Cybersecurity study found that 84% of Indian SMEs plan to increase cybersecurity spend, highlighting that businesses are taking security seriously as they continue to embrace the digital transformation journey. 

However, the study identified a gap between expenditure planning and actual cybersecurity maturity. Around 40% of SMEs experienced a cyber incident in the last two years yet only 28% took structural actions to improve their cybersecurity capabilities after an incident. Continuous monitoring remains a major challenge, as only 12% of SMEs continuously monitored their cybersecurity environments, suggesting that businesses may continue to be reactive rather than proactively detecting and responding to threats. 

The study found that 35% of SMEs operate multiple cybersecurity tools in a fragmented manner, with limited visibility over the overall risk, creating difficulty for businesses in gaining a holistic understanding of their cybersecurity landscape. Cybersecurity spending continues to remain low for many businesses, with 46% allocating less than 5% of their overall IT budget to cybersecurity, leaving ample room for increased budget allocation as businesses continue to digitalize operations. Artificial intelligence (AI) is another emerging influence on SMEs’ cybersecurity strategies, as 35% of the businesses identified it as a key enabler to enhance detection, monitoring as well as incident response capabilities. 

Concurrently, 34% of SMEs foresee AI-enabled cyber threats to have a significant impact on their businesses in the next 12-24 months, pointing to the dual impact of AI technologies – as both a tool to secure and a threat enabler. Vishal Rally, Chief Revenue Officer at Tata Teleservices, said the planned increase in cybersecurity investment reflects that SMEs acknowledge the need to integrate security within the overall digital transformation strategy. 

Prabhu Ram, Vice President of the Industry Research Group at CMR, said that the findings reflect the uneven maturity in cybersecurity among Indian SMEs despite the anticipated rise in investment intent. For SMEs, the findings highlight that simply increasing cybersecurity budgets may not be enough to address the existing gaps in security. As businesses expand and become more digitalized, enhanced monitoring, visibility, expertise and integrated practices will also be required to mitigate the rising threats.
Read more »
Zero-Day Exploits
Citrix NetScaler Cyber Security RCE Security Patch Zero-Day Exploits

Citrix NetScaler Zero-Days Exploited in Attacks

 

Two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances are reportedly being exploited in the wild, raising serious concerns for organisations that rely on the products for remote access and application delivery. Security firm watchTowr disclosed the activity on September 26, stating that attackers had used the flaws to achieve remote code execution before Citrix released patches or detailed technical guidance. The company warned that the vulnerabilities could allow attackers to compromise exposed appliances and potentially gain access to connected networks. 

According to watchTowr, the flaws were discovered during forensic investigations into suspected intrusions. Both vulnerabilities reportedly enable remote code execution, meaning an unauthenticated attacker could potentially execute malicious commands on a vulnerable NetScaler device. Because these appliances frequently sit at the edge of corporate networks and handle VPN or application access, a successful compromise could provide attackers with an important entry point for credential theft, lateral movement, data exfiltration or ransomware deployment. 

At the time of the initial disclosure, Citrix had not confirmed the vulnerabilities, published affected-version information or released a security update. The absence of official indicators of compromise or a reliable workaround left administrators with limited options. Some organisations reportedly chose to take NetScaler appliances offline to reduce the risk, although doing so can disrupt remote workers, business applications and customer-facing services. Researchers expected Citrix to issue communications and patches during the week beginning September 28. 

The situation later developed when Citrix confirmed that two critical NetScaler flaws had been exploited and released fixes alongside patches for six additional vulnerabilities. The issues were identified as CVE-2026-88771 and CVE-2026-88772, both carrying a CVSS score of 9.5. The first is an improper input-validation vulnerability that could allow an unauthenticated attacker to run arbitrary commands, while the second involves improper memory-buffer restrictions and could lead to remote code execution or denial-of-service attacks. 

Security teams should treat these vulnerabilities as an emergency priority. Administrators should identify all internet-facing NetScaler ADC and Gateway systems, apply Citrix’s latest fixes immediately and review logs for unusual authentication, configuration or administrative activity. Organisations should also rotate potentially exposed credentials, inspect connected systems for signs of post-compromise activity and restrict management access wherever possible. CISA’s addition of both flaws to its Known Exploited Vulnerabilities catalogue further underlines the urgency of patching and incident investigation.
Read more »
cybercrime group
AI cybersecurity AI technology Critical Infrastructure critical infrastructure cybersecurity cyber espionage Cyber Security cybercrime group

Singapore Expands AI Cybersecurity After UNC3886 Attacks

 

Singapore is changing its cybersecurity strategy after a state-sponsored cyber espionage group targeted the country’s four major telecommunications companies. The attack by UNC3886, disclosed in July 2025, could have disrupted telecommunications and internet services had the attackers penetrated further and raised concerns about national security. 

The incident has pushed Singapore toward a more proactive approach that assumes sophisticated attackers may eventually enter protected networks. Instead of focusing only on preventing intrusions, authorities are emphasizing threat hunting and the detection of suspicious activity after attackers gain access. In an interview, Cyber Security Agency of Singapore (CSA) chief executive and Commissioner of Cybersecurity Gwenda Fong said advanced persistent threat actors such as UNC3886 pursue specific targets, meaning perimeter protection alone is not enough. 

Once inside a network, attackers still need to move toward sensitive systems and data, giving defenders opportunities to identify unusual internal activity. Singapore is using artificial intelligence to strengthen this detection and prevention work. The Government Technology Agency of Singapore (GovTech) has developed two AI-powered tools for government systems. One performs automated penetration testing across about 2,000 government systems, including systems containing citizen data and transactions. 

The second scans the source code of government applications and systems for security weaknesses so agencies can address vulnerabilities before attackers exploit them. The authorities have not disclosed which agencies are using the tools, but their use is being evaluated for expansion across Singapore’s 11 critical information infrastructure sectors, which include healthcare, aviation, banking and finance, energy, government and information and communications. 

CSA has also started regularly scanning internet-facing systems operated by critical infrastructure organizations to identify potential entry points such as unpatched software and weak configurations. The agency said these scans are external and do not involve active probing. Other measures include proprietary threat-detection tools developed by a technical agency under Singapore’s Ministry of Defence and the sharing of classified threat intelligence with critical infrastructure operators. CSA is also examining supply-chain security because compromised vendors could potentially expose data or disrupt services. 

The agency is considering requiring some vendors and suppliers working with critical infrastructure operators to obtain Cyber Essentials or Cyber Trust mark certifications, potentially as early as 2027. As of August, 874 Cyber Essentials and 346 Cyber Trust mark certifications had been issued. 

The shift reflects the growing importance of cybersecurity to national security, the digital economy and public trust. CSA reported that suspected advanced persistent threat activity in Singapore quadrupled between 2021 and 2024, while authorities expect threats to increase as attackers gain access to AI tools. 

For organizations connected to critical digital infrastructure, the message is clear: security cannot end at the network perimeter. Identifying weaknesses, monitoring internal activity and detecting attackers before they can reach sensitive systems are becoming essential parts of defending increasingly connected services.
Read more »
Grok
AI cybersecurity risks AI technology Botnet botnet cybersecurity Credential Theft Cyber Security DDoS Google Window Grok

x47.c Windows Botnet Uses xAI Grok for Persistence and AI Credit Draining

 

A new Windows botnet called x47.c is being sold with a range of capabilities, including credential theft, distributed denial-of-service (DDoS) attacks, SOCKS5 proxy access and a method designed to drain paid AI credits. According to Qrator, the malware also uses artificial intelligence to help maintain persistence on infected systems. 

The botnet is advertised by a threat actor known as WraithTools. In early August, the operator offered the base x47.c package for $200, with a DDoS add-on priced at $150. The complete package, including its full range of capabilities, was offered for $950. Customers receive access to a command-and-control panel that allows them to manage infected machines and access features including fast-flux configuration, information-stealing logs, proxies, concealment capabilities and DDoS operations. 

The DDoS section provides 18 attack methods, including HTTP floods, slow HTTP attacks, TCP and UDP floods, TLS stresser activity, and reflection and amplification techniques. One feature specifically targets paid artificial intelligence services. The AI drain mode is designed to consume a victim’s AI credits by sending requests directly to an AI provider. The operator supplies a model name and a valid API key for accounts using OpenAI, xAI and compatible chat APIs. Because the requests are sent directly to the provider, the targeted website can remain accessible while the account’s available AI credits are depleted. x47.c also incorporates an “AI stealth” module designed to maintain persistence on compromised Windows systems. 

The feature is advertised as using xAI Grok to select actions from a predefined list, including startup entries and scheduled tasks. Optional process hollowing and privilege escalation capabilities are also available. According to Qrator, the operator activates the AI functionality by including an xAI key in the botnet build. Status messages can indicate startup changes, persistence repairs and Windows Defender exclusions. The malware also has local fallback actions that allow maintenance operations to continue when an AI model call fails. 

The botnet provides operators with additional control over infected systems. They can select DDoS targets and download, update or remove software from compromised hosts. A rootkit module is also promoted for removing artifacts associated with rival malware. Beyond DDoS activity, x47.c can harvest passwords and cookies from browsers, along with Discord tokens, cryptocurrency wallet data and AI-service tokens. 

Its SOCKS5 module allows compromised systems to relay traffic, while operators can monitor proxy connections and review their health status and timeouts. The combination of AI-assisted persistence, credential theft, proxy capabilities, DDoS functions and AI credit draining makes x47.c a broad Windows botnet offering multiple ways to abuse compromised systems and online services.
Read more »
IT Security
Critical Vulnerability CVE CVE vulnerability CVEs Cyber Security Flaws IT Security

SolarWinds Patches Critical Unauthenticated RCE Vulnerabilities in Observability Self-Hosted

 

SolarWinds has issued security updates for two critical vulnerabilities in its Observability Self-Hosted product that could enable remote code execution without authentication. The flaws, tracked as CVE-2026-28324 and CVE-2026-28325, are present in multiple versions of the IT monitoring solution and have been patched in the latest release. Observability Self-Hosted is an on-premises and hybrid IT monitoring platform that enables organizations to centrally monitor their environments. 

It also features configuration management and control over operations data and security compliance. The first vulnerability, CVE-2026-28324, has a CVSS score of 9.8 and is described as an insufficient integrity check leading to remote code execution. SolarWinds reported that the problem affects deployments that use a non-default and non-secure configuration. Since the weakness is an unauthenticated remote code execution (RCE) vulnerability, SolarWinds warned that such deployments could be at risk of exploitation. 

The second flaw, CVE-2026-28325, has a CVSS score of 8.8 and is described as a deserialization of untrusted data issue that affects the instances of the application running in a specific communication mode. The company stated that it also allows for an unauthenticated RCE, meaning that the affected systems could be compromised by an attacker. Both weaknesses impact Observability Self-Hosted up to and including version 2026.2.2. SolarWinds has already released updates in the 2026.2.3 version of the product which resolves the identified issues. 

The company credited Kai Huang of Armadin for reporting the problems. The recent updates to Observability Self-Hosted follow the patch for an unauthenticated RCE vulnerability in SolarWinds Access Rights Manager (ARM). The flaw, tracked as CVE-2026-28326, has a CVSS score of 8.8 and impacts ARM versions up to and including 2026.2. This vulnerability also resides in a hardcoded static key for the affected system version. SolarWinds released the patch for CVE-2026-28326 last week after receiving the report from the anonymous security researcher. 

According to the company, this is the third high-severity flaw discovered in its products this year. Moreover, SolarWinds warned that all three could be actively exploited. However, the company added that there were no reports of exploitation for any of the three vulnerabilities. More information on the discovered issues can be found in the company’s advisory. 

The affected organizations should update their Observability Self-Hosted instances to version 2026.2.3 as it includes the fixes for two newly discovered RCE flaws. In particular, the update is recommended for the deployments that feature the non-default, insecure configurations described by the vendor.
Read more »
Cybersecurity measures
Check Point Check Point research CVE CVE vulnerability CVEs Cyber Security Cybersecurity measures

Check Point Warns of Active Exploitation of Two Critical Pre-Authentication Vulnerabilities

 

Check Point has issued urgent warnings to customers following the discovery of active attacks targeting two zero-day flaws in its products. The two vulnerabilities, tracked as CVE-2026-85102 and CVE-2026-93616, both with a CVSS score of 9.8, have had patches released by the company after confirmation of exploitation. CVE-2026-85102 is a pre-authentication remote code execution vulnerability in the processing of certificates during a VPN negotiation. 

Check Point published details of the issue and a fix on September 9, 2026. The company said there was no evidence of exploitation at the time of the patch release, but it has since detected attacks targeting Check Point Spark customers. The attacks, which first appeared on September 12, originate from anonymization infrastructure including VPN offerings and proxies. The researchers noted several certificates with subjects including “CN=vpn,OU=users,O=global,” “CN=vpn-user,OU=users,O=global” and “CN=vpnuser,OU=users,O=global.” 

Check Point warned that the list of certificate subjects is not comprehensive. Customers were advised to review logs for anomalous certificate-based Mobile Access logins and not limit search terms to the certificate subjects included in the advisory. They should also look out for any suspicious activity from users that have authenticated to the gateway via Mobile Access including scanning of internal ports and services. The second issue, CVE-2026-93616, is a pre-authentication path traversal vulnerability in the management web service of Check Point Security Management. 

An attacker could cause the system to execute a script from an arbitrary path and read an arbitrary Java class file, enabling them to gain unauthorized access to the underlying system. Check Point reported several limited attacks using this flaw on July 23, 2026. A patch for CVE-2026-93616 has been released, and customers are being urged to apply it immediately. 

Affected versions of Check Point Security Management include R82.20, R82.10 Jumbo Hotfix Take 44 or lower, R82 Jumbo Hotfix Take 126 or lower, R81.20 Jumbo Hotfix Take 166 or lower and R81.10 Jumbo Hotfix Take 190 or lower. LivePatch Take 28/29 does not mitigate the vulnerability. End-of-life versions of the product are also affected. Check Point recommended that all customers with affected versions of the product should apply the relevant hotfix as both flaws are currently being actively exploited.
Read more »
Supply Chain Attack
Code Injection Cyber Security DevSecOps GitLab Security Supply Chain Attack

GitLab Email Feature Exposes Critical Security Risk

 

GitLab’s “Email work item to this project” feature, intended to simplify issue creation, has been found to expose a serious security vulnerability that allows attackers to push code directly to the main branch and execute CI/CD pipelines. Security researchers at Aikido discovered that the private email addresses GitLab provides contain long-lived authentication tokens that grant far more access than users expect, effectively bypassing traditional security controls like IP restrictions. 

Modus operandi

When users click “Email work item to this project” in GitLab, they receive a unique email address containing a glimt- prefixed token that never expires. While GitLab’s interface suggests this address only creates issues within a specific project, the embedded token actually provides account-wide access across all projects the user can reach, both public and private. Attackers who obtain this email address can change the suffix from -issue@ to -merge-request@, attach a code patch, and submit it directly to any branch, including protected ones like main. If the patch modifies .gitlab-ci.yml, the attacker can execute arbitrary CI/CD jobs with the victim’s permissions, potentially exfiltrating secrets or deploying malicious code. 

One of the most concerning aspects of this vulnerability is its ability to circumvent IP allowlists and other network-based restrictions. Researchers tested this against private projects configured to accept connections from only a single IP address; while GitLab correctly blocked browser access and git clone commands from unauthorized IPs, it still accepted merge request emails and pushed commits to the main branch. This creates a dangerous blind spot for organizations that believe their IP restrictions provide comprehensive protection, when in reality the email pathway offers an unguarded backdoor into their repositories.

The vulnerability affects every GitLab.com account and all self-managed instances with incoming email enabled, with no option to disable the feature. GitLab has acknowledged the issue but classified it as intended behavior rather than a security bug, making only minor UI updates to clarify that the email addresses can create merge requests in addition to issues. However, these changes still don’t adequately communicate that the token reaches every project in the account, can push code to protected branches, and bypasses IP restrictions entirely. Researchers found over a dozen publicly exposed email addresses in open-source project documentation, many deliberately published by maintainers instructing users where to send bug reports. 

Mitigation strategies 

Organizations should immediately rotate their incoming email tokens via the personal access tokens page, though this invalidates all project addresses simultaneously. Teams should scan repositories and documentation for exposed glimt- tokens using secret detection tools, treating these addresses with the same caution as API keys or passwords. Additionally, security teams must recognize that IP allowlists alone don’t provide complete protection in GitLab, and should implement additional controls like requiring sender address verification and monitoring for unauthorized merge requests. Until GitLab implements more granular controls or allows feature disablement, proactive token rotation and vigilant secret scanning remain the primary defenses against this attack vector.
Read more »
Vulnerability
Account Token Theft AI Assistant Security AI Security Cyber Security Dictation Endpoint Local Privilege Escalation Mac Security MacOS Vulnerability Meta Muse Vulnerability

Meta Muse Flaw Lets Attackers Hijack AI Assistant


The Muse artificial intelligence assistant from Meta has been found to be vulnerable to an attack which allows malicious software to redirect its dictation traffic and control the actions performed by the application if it is locally running malware. 

The issue was demonstrated by security researcher Patrick Wardle in a proof-of-concept published on September 21, which demonstrates how an attacker with code execution rights under the user logged into Muse can exploit a hidden configuration in Muse. Wardle has also emphasized that the vulnerability does not provide an initial entry point into a Mac, but rather becomes dangerous after a malicious program or attacker has already been installed on the device. 

In addition, Wardle also warned that the attack may be delivered remotely via a ClickFix-style method, in which the victim is persuaded to execute a command without downloading or installing traditional malicious software. The Meta AI agent Muse was launched earlier this month as a personal AI agent capable of interacting with services and applications based on user permissions. Its capabilities include file sharing, email, messaging, calendars, shopping services, and smart-home applications. As a result of these permissions, the malicious process does not have to obtain the same access independently, making them particularly relevant to this attack. 

There is a problem with an undocumented Muse preference named endo_voyager_dictation_endpoint that controls the location where voice dictation is processed. The setting can be modified by an application running under the same user account. No additional macOS permission is necessary to modify the setting so that Meta's legitimate endpoint is replaced with an attacker's endpoint. 

A redirected endpoint can allow voice input intended for Muse to be sent to a service controlled by the attacker. Testing has demonstrated that both the audio and transcription can be intercepted. Once the input has been captured, the attacker can observe dictated prompts and influence Muse's instructions. 

A further significant benefit of the redirected traffic is that the token associated with the user's Muse account can be accessed and used to interact directly with Muse. Wardle demonstrated that the token can be accessed and used directly to access the account's chat history. Thus, malicious code is no longer simply stealing information, but rather abusing the AI assistant itself in order to carry out actions based on the privileges that have already been assigned. 

A secondary concern is how conventional endpoint security tools might interpret the activity. The Muse application is a legitimate, signed application, so actions initiated through it may appear to originate from a trusted process rather than directly from malware. Wardle's testing further revealed that access obtained through Muse tokens may extend beyond the compromised computer.

Using the token, the researcher was able to execute commands through Muse on another device since the same account can be used across multiple devices. In testing, the researcher was able to have the assistant on a smartphone report its location, scan for nearby Bluetooth devices, and identify smart home controls. 

Meta Releases Hotfix for Muse Zero-Day

The vulnerability has been addressed by Meta with a hotfix for Muse on MacOS. According to David Singleton of Meta Superintelligence Labs, the issue involves a local privilege escalation rather than a remote vulnerability. Moreover, exploitation requires malicious software to have already been installed under the user's account. 

By closing the configuration path that Wardle used in his proof-of-concept, the hotfix removes the ability to modify the dictation endpoint. As Meta stated, there was a limited practical risk associated with the attack since it requires the installation of local code. However, the requirement for local code execution does not necessarily exclude realistic attack scenarios. Wardle cited ClickFix-style attacks, in which victims are tricked into executing commands on their own computers.

By employing such a method, one might be able to gain a foothold without having to install conventional malware in order to exploit the Muse vulnerability. A broader concern with artificial intelligence agents that operate with extensive permissions has been highlighted by the vulnerability. As a result of Muse accessing a wide range of system resources and connected services, it may be possible for attackers to use those existing permissions once they have obtained control of the agent, rather than requiring separate access to each protected resource. 

In Wardle's testing, he demonstrated that the vulnerability can be exploited for a variety of purposes beyond the theft of dictated information. As part of the proof-of-concept activity, the user was able to take images and create documents on the Mac using Muse, in some cases without being made aware of. 

In addition, the research demonstrated that attackers controlling Muse sessions may interact with connected devices, although some actions are limited to the preparation of drafts during testing. This vulnerability does not imply the bypassing of macOS's underlying permission system directly, but rather the abuse of Muse once sensitive capabilities have been granted. As a result, the compromised process may be able to make requests through legitimate, signed applications, potentially making the results harder to distinguish from normal AI-aided operations. Moreover, the dictation system design of Muse contributed to the vulnerability as well. While Apple's dictation capabilities are available on device, Muse transmits voice inputs to Meta's infrastructure for processing. 

Wardle argued that this architecture created an endpoint that can be redirected by another local process. Several security and isolation controls have been implemented in the context of Muse, including its dedicated Secure VM architecture and additional safeguards designed to limit agent actions. However, the flaw revealed is not in the cloud environment designed to isolate user agents but in the macOS application itself. 

Personal artificial intelligence agents are increasingly being seen as sources of security concerns, particularly those that provide conversational capabilities as well as access to files, devices, accounts, and external services. In the event of an agent weakness, those permissions can be turned into an attack path. However, even if the underlying operating system enforces its normal security boundaries, the agent could potentially act as an attack vector.

Read more »
foreign cyber espionage
CISA Cyber Security department of energy FBI foreign cyber espionage

Foreign Hackers Got Into Two Colorado Water Systems, Messed With Pump Controls and Killed the Alarms

 




Foreign actors broke into the industrial control systems of two small private water utilities in Colorado last month, altered pumping cycles, changed equipment settings, and shut off the alarms that would have told operators something was wrong. The state confirmed the incidents on Friday. It has not named the utilities or the attackers.

Both systems are privately owned and serve fewer than 200 people each. The intrusions happened in late August. According to the governor's office, the attackers disabled remote access, switched off alarms, and changed how water was being pumped before operators caught on and regained control. Water quality and treatment were not affected at either location.

"These were brief incidents and the risks were quickly addressed by the providers themselves, who subsequently alerted the state," said Ally Sullivan, a spokeswoman for Governor Jared Polis. "To our knowledge, treatment processes and water quality were not impacted at either provider."

Colorado officials did not name a suspect. Sullivan said the office "cannot confirm what foreign actors may have been involved," but pointed to a CISA-tracked Iranian-backed group that has been working to access drinking water and wastewater systems across the country. Federal authorities have made no formal attribution in the Colorado case.


Part of Something Bigger

Colorado is the latest state in a list that has now reached at least 12 reporting intrusions into water system controls this year. The EPA says more than 100 drinking water and wastewater systems have been hit in 2026, most accessed through programmable logic controllers, or PLCs, connected to the open internet via cellular modems, often without the utilities realizing it.

The summer's single worst episode came on July 26 and 27, when attackers hit more than 30 communities in Minnesota in what state IT officials called a coordinated assault. At least four cities publicly confirmed disruptions. One plant went offline entirely; others dropped to manual operation. In Georgia, hackers took down a pump station, cutting pressure enough that residents were advised to boil water before using it. No one reported getting sick.

The FBI and EPA issued a joint warning on July 30 describing attackers who remotely changed IP addresses and passwords on exposed controllers, locking operators out. In some cases, the intrusions created conditions where untreated groundwater could have entered distribution pipes.

CISA said it tracked attacks against more than 100 internet-exposed water sector systems in July alone, the majority accessed through PLCs attached directly to cellular modems.


The Group Investigators Are Watching

The most scrutinized suspect is CyberAv3ngers, a threat group formally tied to Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command. The U.S. Treasury sanctioned six of its senior officials in February 2024. The State Department has offered $10 million for information on the group's activities.

The group has run through four documented phases since 2020. It started by exploiting default passwords on Israeli-made water utility controllers, moved on to deploying custom malware called IOCONTROL against industrial and IoT devices, and this year shifted to actively exploiting an authentication bypass flaw in Rockwell Automation's widely used Logix PLCs. No vendor patch exists for that vulnerability.

Six federal agencies, CISA, the FBI, NSA, EPA, the Department of Energy, and U.S. Cyber Command, warned jointly on April 7 that Iranian-affiliated actors were actively hitting internet-facing PLCs across water, energy, government, and manufacturing sites.


Congress and Industry Push Back

Senators Adam Schiff and Amy Klobuchar introduced the Water Cyber Shield Act in August, which would give the EPA authority to audit utilities and mandate corrective action. The bill authorizes $300 million annually through existing water infrastructure funds.

At DEF CON, the National Rural Water Association launched the Water Watch Center, pairing five managed security firms with small utilities at no cost. The program targets systems serving under 10,000 people, which make up 91 percent of the country's roughly 50,000 community water systems.

Denver Water, which supplies about 1.5 million people across the metro area, told Axios it evaluated the threat after the Colorado disclosure and found its systems unaffected. Federal investigators are working with state officials to determine how the two utilities were accessed.

Read more »
Linux
Cyber flaws Cyber Security cybersecurity vulnerabilities exploitable flaws Kernel Kernel Flaw Linux

Four Linux Kernel Flaws Expose Systems to Local Root Exploits

 

A security researcher has publicly released working exploit code for four Linux kernel vulnerabilities that can allow local users to escalate their privileges to root, giving them the highest level of access on an affected system. The vulnerabilities, dubbed DirtyAH6, TUNderflow, PPPoEject and DiagSpill, were discovered by researcher Asim Manizada and reported to the Linux kernel security team in mid-July. 

Kernel maintainers have since released fixes for all four flaws, meaning systems running fully updated kernels are not affected. Manizada published his technical analysis and working exploits on September 18 after coordinating with Linux distributions to give developers time to release patches. There are currently no reports of the vulnerabilities being exploited in real-world attacks. The published exploits were developed for specific kernel builds and can crash systems, making them primarily suited for isolated testing environments. 

Despite those limitations, publicly available exploit code increases the risk for systems that have not been patched. Local privilege escalation vulnerabilities are particularly relevant on shared or multi-user systems, where an attacker who has already obtained limited access can potentially use the flaws to gain complete control. Three of the vulnerabilities require unprivileged user namespaces to be enabled. 

This Linux feature allows ordinary users to obtain root-like privileges inside an isolated environment and is enabled by default on many distributions. DirtyAH6, tracked as CVE-2026-80844, affects the IPv6 IPsec Authentication Header code. TUNderflow, CVE-2026-81000, affects TUN/TAP virtual network devices, while PPPoEject, CVE-2026-68121, targets PPP over Ethernet code. DiagSpill, tracked as CVE-2026-74469, differs from the other three because it does not require user namespaces or special privileges. 

Instead, it requires the SCTP networking module to be available. Two vulnerabilities, DirtyAH6 and DiagSpill, can also be triggered remotely in limited circumstances, although the demonstrated remote impact is primarily system crashes. Manizada achieved remote root exploitation with DirtyAH6 in a controlled laboratory environment after first manipulating the target’s memory. He described achieving the same result remotely without that preparation as extremely difficult. He found no path to remote root with DiagSpill.

All four vulnerabilities are memory-safety flaws affecting different areas of Linux networking code. DirtyAH6 involves an out-of-bounds write in IPv6 IPsec handling, TUNderflow results from an integer wraparound in virtual networking code, PPPoEject is a use-after-free vulnerability, and DiagSpill involves a counter overflow that can result in a large out-of-bounds memory write. The researcher said the flaws were discovered using an AI-assisted process designed to map kernel memory handling and reason about memory layouts. 

The Linux fix for DirtyAH6 credits his custom AI tooling in its commit record. Manizada also previously disclosed another Linux kernel privilege-escalation flaw, OVSwrap, in July. Administrators should update to a kernel containing all four fixes. The first stable Linux kernel releases containing the complete set are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 and 7.2.4. Distribution kernels use their own versioning, however, so users should check security advisories from their Linux distributor to confirm the fixes have been included. 

If immediate patching is not possible, disabling unprivileged user namespaces can reduce exposure to DirtyAH6, TUNderflow and PPPoEject. Administrators can also disable AH6, TUN/TAP, PPPoE or SCTP features when they are not required. Manizada recommends patching rather than relying on feature restrictions because alternative exploitation paths may exist.
Read more »
cybersecurity vulnerability
API API Security Vulnerability Critical Infrastructure Cyber Security cybersecurity vulnerability

Critical Orkes Conductor Flaw Exploited for Unauthenticated Remote Code Execution

 

A critical vulnerability in Orkes Conductor is being actively exploited by attackers, potentially allowing them to execute arbitrary commands on vulnerable systems without authentication. Tracked as CVE-2026-58138 and rated 9.8 on the CVSS scale, the flaw affects Conductor, an open-source enterprise framework used to orchestrate microservices, workflows and AI agents. The vulnerability can be exploited through inline workflow definitions submitted to the platform’s workflow API. The security issue stems from the way Conductor executes scripts within workflows. 

Attackers can insert malicious JavaScript or Python expressions into workflow definitions and use them to execute arbitrary system commands. According to Empirical Security, INLINE tasks, along with LAMBDA, DO_WHILE and SWITCH tasks, can evaluate user-controlled JavaScript or Python expressions. Conductor creates the evaluator using a GraalVM context configured with HostAccess.ALL, effectively removing the intended sandbox protections. The attacker-controlled code can then reach the underlying Java runtime and execute operating system commands with the privileges of the Conductor process. 

In many deployments, that process runs with root privileges, potentially giving attackers extensive control over the affected system. Authentication does not prevent exploitation by default because the open-source Conductor server does not enforce authentication and leaves its workflow API accessible. An attacker can reportedly send a single unauthenticated POST request to register a malicious workflow containing an INLINE task and trigger its execution. Orkes patched CVE-2026-58138 in June with Conductor version 3.30.2. 

However, attackers began targeting the vulnerability after proof-of-concept exploit code was publicly released in early August. Empirical Security identified exploitation attempts in the wild on August 21. Fortinet subsequently blocked approximately 1,300 exploitation attempts between September 8 and September 9 and has issued an outbreak alert warning about continued exploitation. Organizations running Conductor should upgrade to version 3.30.2 or later and limit external access to the platform’s workflow API endpoints. 

Security teams should also place Conductor deployments behind firewalls and ensure vulnerable services are not directly exposed to the public internet. Administrators should monitor Conductor instances for suspicious workflow submissions and unexpected command execution. Systems that previously ran vulnerable versions should also be reviewed for signs of unauthorized access or compromise.
Read more »
open AI
AI Models Anthropic Claude Opus 4.7 ASLR Claude AI cyber espionage Cyber Security open AI

An AI Helped Researchers Break Into OpenAI

 



A three-person security research team quietly walked into OpenAI's internal infrastructure last July, submitted a pull request inside the company's private monorepo as proof, and then stopped. The whole operation, from first vulnerability discovery to confirmed repository access, took under 72 hours. The tool that made it possible was not a custom-built hacking suite. It was Claude Opus 5.

The researchers, Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini, work at Hacktron, an AI-assisted security research firm. They published their full technical account on September 13. OpenAI confirmed a fix roughly 14 hours after receiving the initial report on July 25, and paid out a $6,500 bounty on September 1.

The case is one of the clearest demonstrations yet of what skilled human researchers can accomplish when they hand the grinding, iterative work of exploit development to a capable AI model. It is also a story about a mundane but persistent failure: software that depends on unpatched libraries, and login systems that trust services they probably should not.


The Chain That Got Them In

The attack surface was not OpenAI's flagship products. It was the company's public help forum, community.openai.com, which runs on Discourse, an open-source forum platform used by tens of thousands of organizations.

Discourse allows users to upload images. For most formats, it relies on a tool called FastImage to inspect files before processing them. But FastImage does not support HEIC or HEIF images, the high-efficiency formats popularized by Apple. So Discourse passes those files to ImageMagick instead, which in turn calls an underlying library called libheif to do the actual decoding.

That handoff is where the vulnerability lived. libheif version 1.19.7, the version running inside Discourse's Docker image at the time, contained a heap buffer overflow. A specially crafted HEIC file could corrupt server memory, giving an attacker the ability to manipulate program execution. The flaw is tracked as CVE-2026-32882 and carries a severity score of 8.8 out of 10 in Discourse's own advisory, which classifies the result as remote code execution.

The patch for this bug had been available since libheif 1.22.0, released in May 2026. The CVE existed. The fix existed. But Discourse's Docker image, built on Debian 12, still shipped the old, vulnerable library when the Hacktron team looked in July. Debian had not yet backported the fix into its packaged version. That two-month window between upstream patch and downstream delivery is what the researchers walked through.

Once they had code execution on the Discourse server, the path to OpenAI employee accounts ran straight through the forum's login button. OpenAI's forum offers a "Sign in with OpenAI" option, the same single sign-on system its staff uses for ChatGPT, Codex, and other internal services. With control of the forum server, the researchers could hijack that authentication flow and take over the accounts of any OpenAI employee who had ever used it. The victims did not have to click anything or be online at the time.

Hacktron was explicit in their writeup about what this means: the forum was one path, not the problem. "If any first-party or third-party OpenAI service using the OpenAI SSO was compromised, it would lead to the same access," the team wrote. The identity flaw was OpenAI's, not Discourse's.

After confirming the account takeovers, the researchers used one employee's Codex account, which was connected to OpenAI's GitHub organization, to open a single pull request inside OpenAI's internal monorepo. They read nothing, merged nothing, and touched no customer data. The pull request was the proof. Then they stopped and filed their report.


Where the AI Came In

The libheif heap overflow gave the researchers memory corruption primitives, which is a starting point, not a working exploit. Memory corruption bugs require additional work to become reliable code execution, particularly on modern systems protected by Address Space Layout Randomization (ASLR), a defense that scrambles where code sits in memory to make it harder to redirect program flow.

This is where most vulnerability research slows down. Turning a crash into a reliable, weaponized exploit requires significant expertise, patience, and time. The Hacktron team decided to find out how much of that work an AI could absorb.

They started with Claude Opus 4.8, the previous flagship model from Anthropic. Across multiple sessions, it managed to help develop a working exploit when ASLR was disabled. When they enabled ASLR, matching the configuration of real servers, Opus 4.8 struggled and failed to produce anything reliable.

On the evening of July 24, Anthropic released Claude Opus 5. The researchers started a fresh session.

Within three hours, Opus 5 had produced a working exploit for an ARM64 Mac environment. They asked it to adapt the exploit to x86-64 and to the jemalloc memory allocator configuration that Discourse uses. By 6:00 a.m. on July 25, they had confirmed local code execution through an image upload.

The researchers then placed Claude in what they describe as an autonomous "/goal" loop, pointed at their own Discourse Cloud instance, framed as a capture-the-flag practice target. Opus 5 has guardrails meant to prevent it from writing exploits for real systems, so the team disguised the target. When they checked again at 10:00 a.m., the agent had achieved code execution on their cloud instance on its own, demonstrating access by reading /etc/hosts. They then used the generated exploit on OpenAI's forum and confirmed it worked there too.

The researchers are careful to note that this was not fully autonomous hacking. Skilled human judgment and direction were required throughout. But the gap between what they could accomplish in hours with Opus 5 versus the days or weeks such work might have taken without it was significant.

The cost of the entire Discourse and OpenAI portion of the project: a few days of AI compute and a few hours of human time.


One Bug, Many Targets

The OpenAI breach was not a standalone operation. It was one piece of a broader research campaign Hacktron calls HEIF Heist, a multi-month investigation into how widely the libheif library is embedded in major internet services, and how many of those services were running vulnerable versions.

Over roughly two months, the three researchers say they traced the same class of image-decoding flaws across software used by Slack, Meta, GitHub Enterprise, and web frameworks including Next.js, Astro, and Gatsby. The total cost of the entire campaign was under $3,000 in AI model usage, spread across roughly sixty days of work.

The team found that adapting each exploit to a new target environment generally took only one or two days with AI assistance. They report that the only company that appeared to detect their testing activity was Shopify, even after thousands of test images were sent to various targets and image processors at several of those companies crashed repeatedly under the load.

Not all of the claims have been independently verified. The Next.js vulnerability is confirmed in Vercel's own advisory. libheif's maintainers confirmed a working code-execution exploit against Meta's deployment of the library. The wider claim of successful code execution across the full list of targets has not been corroborated by external sources as of publication.

The HEIF Heist project also surfaced a difference between AI models. For cases where the team had information about the target environment, Claude Opus 5 was the primary tool. For targets where they had almost no prior knowledge of the deployment configuration, they switched to OpenAI's GPT-5.6 Sol, which they found performed better in those conditions. Each major model jump brought a clear capability improvement: Opus 5 succeeded where Opus 4.8 failed, and GPT-5.6 Sol handled blind exploitation scenarios that Opus 5 struggled with.

The report documented Russia-linked espionage operations using Claude to run nearly fully automated phishing campaigns against Ukrainian, European, and diplomatic targets. It described a Chinese group, including operators identified as university students in Hunan province, who used Claude as the core engineering layer of an offensive program that found multiple zero-day vulnerabilities in a major security product. It also described a French-speaking hacktivist who used Claude to attack European political parties, media organizations, and think tanks at a scale that previously would have required a well-resourced team.

Anthropic's core observation across all of those cases was the same observation the Hacktron team made in their own writeup: AI is closing the gap between what a small, budget-constrained team can do and what used to require state-level resources.

The Hacktron team put it plainly: "Work that once required a well-resourced team and months of effort can now be compressed into days."

That assessment lines up with what Anthropic itself told the company's own threat report readers, and with what security researchers have been warning about for the past year. The Hacktron operation is the first time those warnings have been backed by a public, step-by-step technical demonstration against one of the most scrutinized technology companies on the planet.


What Needs to Change

The specifics of the OpenAI fix have not been made public. The company acknowledged the finding through payment and remediation rather than through a detailed disclosure of the login flaw.

On the Discourse side, the forum platform responded fast: they received the report on a Saturday, replied on Sunday, had a fix ready on Monday, and published their advisory on Tuesday. They also added image-processing sandboxing as a hardening measure, running ImageMagick in a restricted environment so that even a successful exploit against the image library cannot directly execute arbitrary code on the host server.



Read more »
Privilege Escalation
Azure AI Cloud Security Cyber Security Microsoft Azure Privilege Escalation

Microsoft Fixes Critical Azure AI Flaw Rated CVSS 10.0

 

Microsoft has patched a maximum-severity vulnerability in Azure AI Foundry that could allow unauthorized attackers to escalate their privileges over a network. Tracked as CVE-2026-85889, the flaw carries a CVSS score of 10.0, making it one of the most serious security issues affecting Microsoft’s cloud-based artificial intelligence services. The company said the vulnerability resulted from missing authentication for a critical function within Azure AI Foundry. There is currently no evidence that the flaw has been exploited in real-world attacks. 

Azure AI Foundry, also known as Microsoft Foundry, is an enterprise platform used to build, deploy and manage generative AI applications and autonomous agents. A successful exploit could have enabled an unauthorized attacker to gain elevated privileges, potentially increasing access to sensitive resources or administrative functions. Security researcher Rémy Marot, who uses the handle @R_Marot, discovered and reported the vulnerability to Microsoft. The company has already addressed the issue across its cloud infrastructure. 

Microsoft said customers do not need to take any action because the affected cloud services have been fully mitigated. Alongside CVE-2026-85889, the company also fixed several other critical cloud vulnerabilities. These include CVE-2026-85885, a command injection flaw in Microsoft 365 Copilot rated 9.9; CVE-2026-85878, an improper authorization issue in Azure Database for PostgreSQL rated 9.9; and CVE-2026-87701, an improper neutralization vulnerability in Azure Cosmos DB rated 9.6. 

The tech giant separately released updates for two Windows vulnerabilities. CVE-2026-62721 affects the Windows User-Mode Power Service and could allow an authorized local attacker to gain SYSTEM privileges. CVE-2026-85921 is a double-free vulnerability in Windows Secure Kernel Mode that could enable privilege escalation to Virtual Trust Level 1. Both vulnerabilities were fixed through an out-of-band update for Windows 11 version 26H1, distributed as cumulative update KB5129194 for arm64 and x64 systems. 

The latest fixes arrive shortly after Microsoft patched 974 vulnerabilities across its software portfolio. Two of those flaws, affecting Windows Advanced Local Procedure Call and the Windows Update Stack, were reportedly exploited in active attacks. Proofpoint and Volexity said the ALPC flaw was chained with two Google Chrome vulnerabilities to create the BlueMoon exploit kit, which multiple espionage-linked threat actors allegedly used to deliver malicious payloads. The developments highlight the growing security risks surrounding cloud platforms, enterprise AI tools and widely deployed operating systems.
Read more »
NightmareStresser
Cyber Security DDOS Attacks FBI NightmareStresser

FBI Seizes NightmareStresser DDoS-for-Hire Domains in Global Crackdown

 

The U.S. Department of Justice has announced the court-authorized seizure of internet domains linked to “NightmareStresser,” one of the world’s longest-running Distributed Denial of Service (DDoS) for-hire services. The operation, led by the FBI Anchorage Field Office with support from the Royal Canadian Mounted Police, targets so-called “booter” and “stresser” platforms that enable paying customers to launch powerful cyberattacks against individuals, organizations, and critical online infrastructure across Alaska and globally. 

According to the seizure warrant affidavit, NightmareStresser was used to carry out hundreds of thousands of actual or attempted DDoS attacks worldwide since 2022. These services lower the barrier to entry for cybercrime by allowing users with minimal technical expertise to disrupt internet connections, knock targeted devices offline (“booting”), and degrade or completely interrupt access to websites and online services. Victims have included schools, government agencies, gaming platforms, and millions of everyday users whose connectivity was affected by these coordinated attacks.

The takedown forms part of Operation PowerOFF, an ongoing international law enforcement initiative aimed at dismantling criminal DDoS-for-hire infrastructures and holding both administrators and users accountable. Over the past eight years, federal prosecutors and investigators in Anchorage and Los Angeles have charged twelve defendants involved in facilitating DDoS-for-hire services and seized more than 100 associated domains. This latest action expands on those efforts by targeting all known booter sites, shutting down as many as possible, and coupling enforcement with a public education campaign on the harms caused by illegal DDoS activity. 

Assistant U.S. Attorneys Adam Alexander and Ainsley McNerney are prosecuting the case in the District of Alaska. The Justice Department emphasizes that booter and stresser services not only harm direct targets but also undermine broader internet reliability and safety. As digital dependence grows, such crackdowns signal a sustained push to disrupt the ecosystem enabling low-cost, high-impact cyberattacks—and to deter would-be offenders by removing the domains and infrastructure these services rely on to operate.
Read more »
Subscribe to: Posts (Atom)