News Archive
2287 stories · page 79 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
SonicWall SMA1000 flaws exploited as zero-days to push custom malware
SonicWall's SMA1000 Secure Mobile Access appliances were targeted in zero-day attacks for several weeks, with threat actors exploiting two vulnerabilities to install custom malware. The company confirmed the exploitation of these previously undisclosed flaws, urging customers to apply patches immediately.
Hackers steal $23.7 million in crypto from Ostium in off-chain attack
Ostium, a decentralized trading platform, has confirmed that an attacker stole approximately $23.75 million from its liquidity provider vault last week. The incident, which Ostium described as an attack on its off-chain infrastructure, involved the manipulation of price feeds to generate illicit profits.
Attackers pummel critical WordPress vuln to create all sorts of mischief
WordPress has issued urgent patches for two critical vulnerabilities, CVE-2026-60137 and CVE-2026-63030, which, when chained together, enable unauthenticated remote code execution (RCE). The patches were released late Friday, but by Saturday morning, widespread exploitation was already underway, with security researchers observing tens of thousands of exploitation attempts and over 100…
'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover
Reports indicate that a new exploit chain, dubbed "WP2Shell," is actively being leveraged by attackers to target WordPress installations. The attack, which combines CVE-2026-60137 and CVE-2026-63030, reportedly enables remote takeover of affected sites. This development comes just three days after the initial disclosure of these vulnerabilities, suggesting a rapid weaponization by malicious…
Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
Security researchers have identified multiple sandbox escape vulnerabilities across four prominent AI coding agents: Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity. The vulnerabilities, discovered by Pillar Security's research team, Eilon Cohen, Dan Lisichkin, and Ariel Fogel, do not involve direct attacks on the sandboxes themselves. Instead, the sandboxed agents manipulate…
JadePuffer agentic attacks now target AI model data with ransomware
A new variant of the JadePuffer autonomous AI agent, dubbed EncForge, has been observed targeting AI model data with ransomware. This development follows earlier reports this month detailing JadePuffer's capabilities as an agentic threat actor (ATA) that can autonomously execute all phases of a ransomware attack, from initial access to data encryption.
Hugging Face Says Autonomous AI Agent System Breached Production Infrastructure
Hugging Face has reported a security incident where an autonomous AI agent system successfully breached a portion of its production infrastructure. The company indicated that the AI-led cyberattack resulted in unauthorized access to a limited number of datasets and service credentials.
Scammers impersonate FBI on social media, prey on crime victims
The FBI's Internet Crime Complaint Center (IC3) has issued a renewed warning about scammers impersonating the agency and its personnel on social media platforms, exploiting individuals who have already fallen victim to cybercrime. The fraudsters are employing various tactics, including AI-generated content, to appear legitimate and deceive victims into providing personal or financial information.
Flock Safety kills acoustic system designed to detect 'human distress'
Flock Safety has discontinued its acoustic gunshot detection system, which had drawn criticism from privacy advocates for its advertised ability to detect "human distress." The company quietly announced on July 10 that it would "remove" the product, according to a blog post.
Malicious cloud customers can bring down the power grid
Researchers in China have identified a novel cyber-physical vulnerability, dubbed Bit2Watt, that could allow malicious cloud tenants to destabilize data centers and the broader electrical grid by manipulating GPU workloads. The attack, detailed in a preprint paper by Zhouhao Ji, Kaikai Pan, and Wenyuan Xu from Zhejiang University, highlights a potential pathway for adversaries to cause…
Director of Commerce AI standards office out after three months
The director of the Center for AI Standards and Innovation (CAISI), Chris Fall, is stepping down from his role after only three months. The Department of Commerce confirmed Fall's departure and stated that NIST Director Dr. Arvind Raman will assume the position of Acting CAISI Director.
New HollowGraph malware uses Microsoft Graph for stealthy C2 comms
A new malicious component, dubbed HollowGraph, has been identified using Microsoft 365 mailboxes, specifically their calendar features, as a covert command-and-control (C2) channel. This module is believed to be part of the Cavern C2 framework, which has previously been associated with an Iranian threat actor targeting entities in Israel.
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
Security researchers at Rapid7 have reportedly uncovered an AI-assisted phishing toolkit after a malware operator inadvertently exposed their delivery server. The server, left wide open, contained 1,048 files, offering a comprehensive look into the attacker's operations. This cache included lure templates, tests for filename spoofing, execution experiments, various droppers, builder notes, and…
Odyssey piracy scams appear within hours of the movie’s release
Within hours of the theatrical release of Christopher Nolan's film *The Odyssey*, cybersecurity researchers observed a rapid proliferation of scams designed to exploit public interest in pirated copies of the movie. These campaigns did not target the film's distribution directly but rather individuals searching for illicit downloads, leveraging social engineering tactics rather than software…
Hackers were inside South Korea's diplomat training system for 9 months
An online education system used by South Korea's diplomatic academy was compromised by unidentified hackers for nine months, leading to the theft of personal information belonging to current and former employees of the Ministry of Foreign Affairs (MoFA). The breach of the Korea National Diplomatic Academy's e-learning platform occurred between April 2025 and February 2026.
OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability
A denial-of-service (DoS) vulnerability, dubbed "HollowByte," has reportedly been addressed in OpenSSL. The flaw could allow attackers to exhaust server memory by sending specially crafted payloads that trigger buffer pre-allocations which are not subsequently freed. The fix was implemented silently, indicating a patch was released without a public security advisory detailing the vulnerability…
New HollowGraph Malware Hijacks Microsoft 365 Calendars for Covert C2 Communications
A newly discovered Windows malware, dubbed HollowGraph, has been identified as abusing the Microsoft Graph API to establish a covert two-way command and control (C2) channel through compromised Microsoft 365 calendars. Cybersecurity researchers at Group-IB, who named the sophisticated malware, have attributed it with high confidence to the Cavern backdoor framework.
20th July – Threat Intelligence Report
Ernst & Young, a global accounting and professional services firm, has disclosed a data breach stemming from a compromised third-party IT support platform. The incident potentially exposed sensitive information, including client documents, tax details, and employee data, which had been submitted in support tickets.
On Flock License Plate Tracking Cameras
Flock Safety, a company providing automated license plate recognition (ALPR) cameras to law enforcement agencies, has faced scrutiny following an incident where a journalist was mistakenly identified and arrested due to a partial plate match. The incident involved a Jaguar Land Rover (JLR) media fleet vehicle with a New Jersey manufacturer plate, 34 10 DTM, which was flagged as stolen. The…
Hugging Face breached by autonomous AI agent
Hugging Face, a prominent platform for open-source machine learning models and datasets, has confirmed a security breach that it attributes to an autonomous AI agent system. The company disclosed the incident in a blog post published on Thursday, July 16, following the detection of unauthorized access earlier that week.
Microsoft confirms Windows Server Update Services sync delays
Microsoft has confirmed an ongoing issue affecting Windows Server Update Services (WSUS) servers, leading to extended synchronization times and operational timeouts. This problem, which began in recent days with a noticeable increase in impact starting July 13, 2026, prevents IT administrators from deploying the latest Windows updates via WSUS or Configuration Manager.
A week in security (July 13 – July 19)
--- Source 2 --- Shark Vacuum Security Flaw Exposed Home Layouts, Wi-Fi Passwords
Meet Dusseldorf, Microsoft’s open-source out-of-band security platform
Microsoft has released an open-source security platform named Dusseldorf, designed to assist researchers and security teams in detecting out-of-band vulnerabilities. The platform, available on GitHub, provides infrastructure for capturing and analyzing network traffic that applications generate when interacting with external systems during an attack.
More alerts are making your team slower, and an outcome-based SOC fixes that
--- Source 2 --- Rapid7 Unveils AI-Powered SOC Platform to Combat Alert Fatigue and Accelerate Threat Response