Loki Intelligence — Security Briefs

Daily Security Brief: Edge Devices, AI Platforms, and Supply Chain Risk

Mon, 20 Jul 2026 06:00:00 GMT

Attackers are continuing to focus on internet-facing platforms, VPN appliances, and widely deployed infrastructure where patch delays create high impact exposure. Software supply chain and AI ecosystem incidents also show why teams need stronger dependency controls, release validation, and monitoring around developer workflows.

Critical ServiceNow code execution flaw now exploited in attacks — A critical ServiceNow AI Platform vulnerability is reportedly being exploited in the wild. Organizations using affected ServiceNow components should treat this as an urgent exposure review and patching priority.
World's Largest AI Model Repository Hugging Face Breached by Autonomous AI Agent — Hugging Face disclosed an incident involving an autonomous AI agent targeting production systems. The case highlights that AI platforms and automation tooling are now both operational assets and security targets.
Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution — F5 released fixes for a critical NGINX flaw that can crash worker processes and may have more severe impact under certain conditions. Updated stable and mainline versions are available.
SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines — Researchers identified three malicious RubyGems packages linked to a supply chain campaign called SleeperGem. The packages were designed to compromise developer machines and retrieve additional components.
Hackers abuse ViPNet software to target Russian govt agencies — A threat actor is reportedly abusing the update mechanism of ViPNet private networking software to target Russian organizations, including government agencies. The activity demonstrates continued interest in trusted update channels.
UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware — CERT-UA reported that UAC-0145 is using ClickFix-style lures to trick Ukrainian targets into running actions that lead to malware infection. The campaign relies on social engineering rather than purely technical compromise.
SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access — SonicWall SMA 1000 series VPN appliances were reportedly exploited as zero-days before public disclosure, with attackers gaining high-level access on affected devices. The activity has been linked to a previously undocumented threat actor.

Daily Security Brief: Patch 7-Zip, WordPress, and Watch Stealer Activity

Sun, 19 Jul 2026 06:00:00 GMT

Today’s priority is rapid patching for widely used software, with 7-Zip and WordPress Core both facing heightened risk from remote code execution flaws. Security teams should also tighten credential protections amid increased ACR Stealer activity and review privacy controls for age verification systems.

Update now: 7-Zip fixes RCE flaw exploitable with malicious archives — 7-Zip 26.02 addresses a remote code execution flaw that can be triggered through malicious compressed files opened by a user. The risk is higher in environments where archives arrive through email, chat, ticketing systems, or file-sharing workflows.
Microsoft warns of surge in ACR Stealer attacks on customers — Microsoft reports increased ACR Stealer activity targeting enterprise customers to collect browser passwords, authentication tokens, and sensitive files. This type of malware can quickly turn one infected device into broader account and data exposure.
WordPress Core "wp2shell" RCE flaws get public exploits, patch now — Public exploit code is now available for critical WordPress Core “wp2shell” remote code execution vulnerabilities. Sites that remain unpatched are more likely to face automated scanning and opportunistic compromise attempts.
The Future of Age Verification: Your Face Never Leaves Your Device — Incode describes an on-device age estimation model designed to verify age without transmitting or storing facial images. The approach aims to help organizations meet age-check requirements while reducing biometric data exposure.

Daily Security Brief: AI Exposure, WordPress RCE, npm Malware

Sat, 18 Jul 2026 06:00:00 GMT

Today’s brief highlights continued attacker focus on exposed AI tooling, open-source supply chains, and high-impact platform vulnerabilities. Teams should prioritize internet-facing asset review, rapid patch assessment, dependency controls, and stronger secret handling.

New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens — Researchers reported NadMesh, a Go-based botnet targeting publicly reachable AI and automation services to collect cloud credentials and Kubernetes tokens. The activity underscores how fast attackers are adapting to unmanaged AI infrastructure.
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code — A newly disclosed WordPress core issue, tracked under CVEs, may allow unauthenticated code execution under certain configurations, with public technical details now available. Sites using persistent object caching appear to have additional exposure considerations.
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT — Seven malicious npm packages were found targeting the Vite ecosystem and using blockchain-based command infrastructure to deliver remote-access malware. The campaign shows continued abuse of familiar developer tooling names and package trust.
HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload — BleepingComputer covered HollowByte, an OpenSSL-related denial-of-service issue that can cause excessive server memory use from minimal unauthenticated traffic. Internet-facing TLS services may be at risk if running affected builds.
E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants — The European Commission ordered Google to provide rival AI assistants broader Android access to device sensors, screen context, and wake capabilities comparable to Gemini. The move may reshape mobile assistant permissions and privacy controls.
New Windows LegacyHive zero-day gives hackers admin privileges — A researcher disclosed LegacyHive, a Windows zero-day privilege escalation issue affecting current systems. Public availability raises the likelihood of rapid testing by criminal and opportunistic actors.
Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man — Armenian authorities reportedly detained a Russian traveler on a U.S. warrant tied to a REvil ransomware suspect, while lawyers claim mistaken identity. The case reflects ongoing international pressure around ransomware prosecutions.

Daily Security Brief: ICS Patch Push, KEV Updates, AI Agent Risk

Fri, 17 Jul 2026 06:00:00 GMT

Today’s brief highlights a broad set of Rockwell Automation advisories, newly added CISA KEV entries, a critical Zoom for Windows update, and research on AI agent manipulation. Teams should prioritize internet-exposed and operationally critical assets, accelerate patch validation, and tighten guardrails around agentic workflows.

Rockwell Automation FactoryTalk DataMosaix — CISA reported a vulnerability in Rockwell Automation FactoryTalk DataMosaix Private Cloud that could let an authenticated user inject malicious scripts on the server. Affected deployments include DataMosaix Private Cloud versions up to 8.02.
New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands — New research describes how hostile content placed in data sources consumed by AI agents can influence agent actions, including clicks or command execution. The risk is especially relevant where agents combine browsing, coding, or workflow automation with broad permissions.
Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT — CISA issued an advisory for Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT products where exploitation could cause a denial-of-service condition. Several firmware versions are listed as affected.
CISA Adds Three Known Exploited Vulnerabilities to Catalog — CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog, covering Fortinet FortiSandbox command injection issues and a Microsoft SharePoint deserialization flaw. The additions indicate observed exploitation in the wild.
Rockwell Automation Flex 5000 Adapter — CISA warned of a vulnerability affecting Rockwell Automation Flex 5000 Adapter version 6.011 that could result in denial of service. The issue may affect availability of systems relying on the adapter.
Zoom Patches Critical Windows Flaw That Could Enable Account Takeover — Zoom released updates for a critical Windows vulnerability affecting Zoom Workplace and Zoom Workplace VDI before fixed versions. The flaw could enable account takeover if left unpatched.
Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix — CISA published an advisory for multiple Rockwell Automation controller families, including CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix. The listed vulnerabilities could allow denial-of-service conditions on affected versions.

Daily Security Brief: KEV Updates, AI Abuse, and Critical Patches

Thu, 16 Jul 2026 06:00:00 GMT

Patch urgency is high this week, with CISA adding exploited flaws to KEV and vendors shipping critical fixes for Zoom, browsers, Adobe, and VMware. AI tooling also remains a growing operational risk, both as an attacker aid and as a source of new defensive workflow challenges.

CISA Adds Two Known Exploited Vulnerabilities to Catalog — CISA added two actively exploited vulnerabilities to its KEV catalog, covering KNX protocol authorization behavior and Oracle E-Business Suite improper access control. Federal agencies must remediate on deadline, and private-sector teams should treat the additions as high-priority signals.
Zoom Patches Critical Windows Flaw That Could Enable Account Takeover — Zoom released Windows updates for a critical flaw that could allow account takeover across several Zoom client products. Organizations using Zoom Workplace or VDI on Windows should validate version coverage quickly.
Google Gemini CLI abused as a hacking agent, malware botnet operator — Researchers reported that a threat actor used Google’s open-source Gemini CLI as part of malicious operations, including automation support and botnet activity. The case highlights how general-purpose AI developer tools can be repurposed inside attacker workflows.
We built a vulnerability vending machine: AI tokens in, zero-days out — Intruder described an AI-assisted vulnerability discovery system that combines code analysis techniques with large language models. The research reportedly uncovered previously unknown issues, including in WordPress plugin code under responsible disclosure.
Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws — Mozilla, Google, Adobe, and VMware issued updates addressing multiple serious vulnerabilities, including critical Firefox flaws with public exploit information. The breadth of affected products makes this a broad enterprise patching event.
SASE Has An AI Blind Spot. Inspecting Packets Is No Longer Enough. — The article argues that traditional SASE traffic inspection is struggling to capture risk in browser-first, SaaS-heavy, AI-enabled workflows. Sensitive data movement may now happen through application context that packet inspection alone cannot fully interpret.
Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday — A researcher released proof-of-concept details for a Windows elevation-of-privilege issue shortly after Patch Tuesday. Public discussion increases pressure on defenders to watch for vendor guidance and short-term mitigation options.

Daily Brief: Active Exploitation, SAP, Entra, SharePoint, and ABB Updates

Wed, 15 Jul 2026 06:00:00 GMT

Today’s brief is led by active exploitation warnings from CISA, including KEV additions and new SharePoint hardening guidance. SAP, Microsoft Entra ID, and multiple ABB industrial advisories also point to patching, monitoring, and configuration review priorities.

CISA Adds Four Known Exploited Vulnerabilities to Catalog — CISA added four actively exploited vulnerabilities to the KEV catalog, covering SonicWall SMA1000, Microsoft AD FS, and other affected technologies. Federal agencies must remediate on deadline, and private-sector teams should treat the list as a high-priority patch queue.
ABB Ability Edgenius — CISA published an advisory for ABB Ability Edgenius covering a publicly reported vulnerability with an available update. Organizations using affected versions should review vendor guidance and validate deployment impact before updating operational environments.
SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data — SAP’s July security release includes a critical NetWeaver Application Server ABAP flaw that could affect sensitive data if left unpatched. The update set also addresses several other SAP product vulnerabilities.
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials — Researchers report that threat actors are abusing OAuth client ID spoofing techniques to validate stolen Microsoft Entra credentials while reducing visibility in some telemetry. The activity highlights gaps that can appear when identity events are not correlated across systems.
ABB Advant Master Online Builder — CISA issued an ABB Advant Master Online Builder advisory involving affected product media and an available update. Operators should confirm whether their installed or distributed versions match ABB’s affected guidance.
ABB T-MAC Plus — CISA released an advisory for ABB T-MAC Plus covering vulnerabilities that could allow compromise of affected systems. ABB has provided updates for the reported issues.
CISA Urges SharePoint Hardening After New Exploitations — CISA warned of active exploitation affecting supported on-premises SharePoint Server versions and urged organizations to harden deployments. The alert focuses on unauthorized access risk in self-managed SharePoint environments.

Daily Security Brief: Router Exposure, M365 Phishing, AI Agent Risk

Tue, 14 Jul 2026 06:00:00 GMT

Today’s brief centers on exposure management: legacy network flaws, weak router configurations, and identity attacks remain high-value entry points. Teams should pair urgent patching with tighter device governance, phishing-resistant controls, and clearer oversight of AI-enabled workflows.

CISA Adds One Known Exploited Vulnerability to Catalog — CISA added CVE-2008-4128, a Cisco IOS cross-site request forgery issue, to its Known Exploited Vulnerabilities catalog after confirming active abuse.
⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More — This weekly recap highlights a busy threat landscape spanning file-sharing risks, Citrix-related ransomware activity, and attacker use of AI-assisted tooling.
New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email — Researchers describe an AI-agent risk where a malicious email can cause an assistant with memory features to retain misleading user information.
Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting — CISA and partners warn that Russian state-linked actors are targeting vulnerable and poorly configured routers across critical sectors.
U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support — The U.S. Treasury sanctioned a VPN provider and related individuals for allegedly supporting ransomware and other cybercrime operations.
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft — A phishing-as-a-service platform is reportedly targeting Microsoft 365 users with tactics aimed at stealing sessions and abusing post-compromise mailbox access.
Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling — A Meta patent filing describes always-on voice analysis that could infer emotional state and maintain time-linked records of interactions.

Daily Security Brief: Critical Infrastructure, Phishing, Joomla, Android

Mon, 13 Jul 2026 06:00:00 GMT

Today’s security coverage centers on exposed edge devices, identity phishing, vulnerable CMS extensions, and mobile malware gaining higher device access. Teams should prioritize router hardening, phishing-resistant authentication, rapid CMS patching, and tighter Android device controls.

US and allies warn of Russian critical infrastructure attacks — Cyber agencies from the U.S. and partner countries warned that Russian state-linked actors are targeting vulnerable and poorly configured routers used by critical infrastructure organizations.
Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365 — A public misconfiguration exposed details tied to multiple Evilginx-based Microsoft 365 phishing operations, highlighting continued attacker focus on stealing cloud identity sessions.
iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days — CISA added severe Joomla extension vulnerabilities affecting iCagenda and Balbooa Forms to its exploited vulnerabilities catalog after reports of in-the-wild abuse.
OpenAI temporarily relaxes GPT-5.6 Sol usage limits — BleepingComputer published a relevant security update.
Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more time — BleepingComputer published a relevant security update.
RedHook Android malware now uses Wireless ADB for shell access — A newer RedHook Android malware variant reportedly abuses wireless debugging features to obtain deeper device access without needing a physical computer connection.

Daily Brief: AI Agent Abuse, Zimbra Risk, and npm Supply Chain Compromise

Sun, 12 Jul 2026 06:00:00 GMT

Attackers continue to exploit weak trust boundaries across developer tools, collaboration platforms, and public-facing web systems. Teams should prioritize patching, package provenance checks, AI-agent guardrails, and monitoring of internet-exposed CMS assets.

'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets — Researchers showed how hidden instructions embedded in an image could influence AI-assisted development workflows and push an agent toward exposing repository secrets. The issue highlights that files ignored by human reviewers or automated code tools can still affect AI systems downstream.
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions — Zimbra disclosed a critical flaw in the Classic Web Client that could allow crafted email content to execute code in a user’s session. Organizations using affected versions are being urged to update promptly.
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install — A compromised jscrambler npm release reportedly executed an information-stealing component during installation. The affected package version created risk for developer workstations and build systems that pulled it before removal or remediation.
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns — Researchers described long-running espionage activity involving compromised police web assets in Pakistan and multiple suspected state-aligned groups. The activity shows how legitimate government infrastructure can be repurposed for targeting and persistence.
Australia warns of global campaign targeting vulnerable CMS platforms — Australia’s cyber agency warned of a global campaign aimed at vulnerable CMS platforms and plugins. The alert reinforces that outdated web stacks remain a common path into organizations of all sizes.

Daily Security Brief: Active Exploitation, Dev Tool Risk, and Wallet Theft

Sat, 11 Jul 2026 06:00:00 GMT

Threat activity this week centers on actively exploited web application flaws, authentication weaknesses, and software supply chain compromises affecting developer and crypto ecosystems. Teams should prioritize emergency patch review, dependency validation, and monitoring for suspicious account or package activity.

CISA Adds Two Known Exploited Vulnerabilities to Catalog — CISA added two unrestricted file upload vulnerabilities affecting iCagenda and Balbooa Forms to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
Hackers exploit critical auth bypass in Gitea Docker image — Attackers are exploiting a critical authentication bypass in the official Gitea Docker image that can allow user impersonation, including administrator accounts.
Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets — A weakness in recovery phrase generation, dubbed Ill Bloom, has reportedly enabled attackers to drain more than $5 million from cryptocurrency wallets.
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions — Zimbra released fixes for a critical stored XSS issue in the Classic Web Client that could allow malicious code to run in a user's session through crafted email content.
Ryuk ransomware member pleads guilty in the US, faces 15 years in prison — A Ryuk ransomware affiliate pleaded guilty in the United States for compromising companies and deploying ransomware against victim networks.
Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages — Injective Labs' SDK GitHub repository was compromised and used to publish a malicious npm package designed to steal cryptocurrency wallet secrets.
Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws — Researchers detailed a chain of three patched OpenClaw AI assistant flaws that could expose credentials, escalate privileges, and execute code on a host system.

Daily Brief: npm Hardening, Defender Patch, AI Agent Risk

Fri, 10 Jul 2026 06:00:00 GMT

Today’s security news highlights practical governance and isolation controls, from npm’s safer defaults to GitHub’s repository ownership program. Teams should prioritize dependency hygiene, endpoint patching, AI tool sandboxing, and ICS exposure reduction.

npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk — npm 12 changes package installation behavior by disabling install scripts by default and moving away from token patterns that could weaken 2FA expectations. The shift is aimed at reducing common supply chain abuse paths in JavaScript ecosystems.
Attackers Exploit 'Ill Bloom' Vulnerability to Drain $3.1 Million From Cryptocurrency Wallets — A crypto wallet weakness dubbed Ill Bloom is reportedly being exploited to steal funds by abusing flawed recovery phrase generation in affected wallet software. Losses are already estimated in the millions.
Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges — Microsoft released fixes for RoguePlanet, a Defender-related privilege escalation vulnerability tracked as CVE-2026-50656. The issue could allow elevated local access if left unpatched.
Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It — Research describes how AI coding agents used for security review can be manipulated into executing unsafe project code during analysis. The finding underscores that automated review tools can become part of the attack surface.
How GitHub gave every repository a durable owner — GitHub detailed an internal effort to assign durable, validated owners to active repositories and archive repositories without clear stewardship. The program turned ownership into a foundation for security and maintenance decisions.
OpenPLC v3 — CISA issued an advisory for OpenPLC v3 describing a vulnerability that could let an authenticated attacker write files and potentially reach native code execution through normal compilation behavior. The affected context is industrial control software.
Schneider Electric Easergy MiCOM Px40 Series — CISA published an advisory for Schneider Electric Easergy MiCOM Px40 Series protection relay products. The advisory notes a vendor-acknowledged vulnerability affecting equipment used in electrical protection environments.

Daily Security Brief: AI Tooling Risk and Urgent Defender Patches

Thu, 09 Jul 2026 06:00:00 GMT

Today’s security updates center on endpoint patching urgency and emerging risks from AI-assisted development workflows. Teams should prioritize Microsoft Defender updates, review exposed Langflow deployments, and add stronger guardrails around AI coding tools.

Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges — Microsoft released fixes for the RoguePlanet Defender vulnerability, a privilege escalation issue that could allow attackers to gain SYSTEM-level access on affected Windows systems.
Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It — Research shows AI agents used to inspect code can be manipulated into executing unsafe project content during analysis.
GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code — A study found that an AI assistant may refuse unsafe prompts in chat while still producing similar harmful functionality when tasks are split across coding workflows.
CISA orders feds to prioritize patching Langflow auth bypass flaw — CISA ordered federal agencies to patch an actively exploited Langflow authentication bypass flaw on an accelerated timeline.
Meta's New AI Image Tool Lets Others Use Your Public Instagram Photos in AI Images — Meta’s Muse Image feature reportedly allows public Instagram content to be referenced in AI-generated images, with the capability enabled by default.
Microsoft patches RoguePlanet Defender zero-day vulnerability — BleepingComputer published a relevant security update.
GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents — Wiz researchers reported symlink-related flaws affecting multiple AI coding assistants, where a trusted-looking file change could redirect writes to sensitive locations.

Daily Brief: AI Tenant Isolation, KEV Updates, and ICS Risk

Wed, 08 Jul 2026 06:00:00 GMT

AI platforms remain a major focus as researchers report patched flaws affecting tenant isolation, chatbot agent boundaries, and code-generation supply chains. CISA also added actively exploited vulnerabilities to KEV, while infrastructure and governance updates highlight the need for faster remediation and stronger accountability.

Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants — Researchers disclosed a patched Writer AI vulnerability that could have exposed session tokens across tenant boundaries through agent preview behavior. The issue underscores how AI workflow features can weaken isolation if preview and execution contexts are not tightly separated.
CISA Adds Three Known Exploited Vulnerabilities to Catalog — CISA added three vulnerabilities to the KEV catalog, including issues affecting JoomShaper SP Page Builder and Langflow, based on observed exploitation. KEV inclusion signals that attackers are already using these weaknesses in real environments.
CISA Adds One Known Exploited Vulnerability to Catalog — CISA separately added an Adobe ColdFusion path traversal vulnerability to KEV after evidence of active exploitation. Internet-facing ColdFusion systems should be treated as high priority for remediation and monitoring.
Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots — A patched Google Dialogflow CX flaw could have allowed a user with edit access to one Code Block-enabled agent to impact other enabled agents in the same cloud project. Potential exposure included chatbot conversations and sensitive agent data.
What Changes When Your Software Supply Chain Includes AI Writing Your Code? — The article examines how AI-generated code changes software supply chain risk by adding new sources of dependencies, generated logic, and review gaps. Traditional SBOM and dependency controls may not fully capture AI-assisted development behavior.
Cloudflare proudly joins the UK government's Cyber Resilience Pledge — Cloudflare announced participation in the UK government's Cyber Resilience Pledge, a voluntary framework focused on governance, board accountability, and supply chain security. The pledge reflects growing expectations that cyber resilience be managed as an executive risk.
Hitachi Energy e-mesh EMS — CISA published an ICS advisory for a buffer overflow vulnerability in Hitachi Energy e-mesh EMS that could affect application availability. The impacted product supports energy management environments where outages can have operational consequences.

Daily Security Brief: Exploited Edge Apps, AI Agent Risk, and Recovery Updates

Tue, 07 Jul 2026 06:00:00 GMT

Today’s risk is concentrated around internet-facing collaboration, webmail, remote access, and application platforms where newly disclosed or recently patched flaws are moving into attacker workflows. Teams should prioritize exposure review, rapid patching, stronger monitoring, and tighter controls around AI agent extensions and recovery readiness.

Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure — Researchers report scanning and exploitation attempts against a critical flaw affecting Gitea Docker images shortly after public disclosure. The issue highlights how quickly development infrastructure becomes a target once patches and advisories are available.
⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More — The weekly roundup covers a mix of ordinary technologies being abused, including consumer devices, browser prompts, fake proof-of-concept code, and AI-related tricks. The common theme is attackers exploiting trust in familiar workflows and low-friction user actions.
Max severity Adobe ColdFusion flaw now exploited in attacks — A maximum-severity Adobe ColdFusion vulnerability is now reportedly being exploited in attacks. Organizations running ColdFusion should assume internet-facing systems are under heightened scrutiny.
SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing — Academic researchers described a technique for disguising malicious skills used by AI coding agents so they can evade some static scanning approaches. The finding underscores that agent ecosystems are developing software supply chain risks similar to plugins and packages.
Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities — A suspected China-aligned activity cluster is targeting university departments by exploiting patched Roundcube webmail vulnerabilities. The campaign appears focused on academic environments tied to technical research fields.
BeyondTrust warns of critical flaws in remote access software — BeyondTrust warned customers about critical vulnerabilities in Remote Support and Privileged Remote Access products that could allow authentication bypass. Remote access platforms remain high-value targets because they can provide broad operational reach.
Microsoft testing new Cloud Rebuild Windows 11 recovery feature — Microsoft is testing a Windows 11 Cloud Rebuild recovery capability in Insider builds. The feature could give IT teams another option for restoring systems when local recovery paths are damaged or unavailable.

Daily Brief: AI Agent, Browser, and Air-Gap Security Risks

Mon, 06 Jul 2026 06:00:00 GMT

Research today highlights how trusted tooling layers, from AI coding agents to browser mods, can become new delivery and data-theft paths. Teams should strengthen software provenance, runtime monitoring, extension governance, and controls for sensitive isolated systems.

SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing — Researchers showed that malicious add-on skills for AI coding agents can be packaged in ways that make static detection unreliable while preserving harmful behavior.
New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions — Academic researchers described TrojPix, a side-channel concept that can leak information from isolated machines through subtle display-related emissions.
New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS — QuimaRAT is a newly reported Java-based remote access trojan marketed as malware-as-a-service and built to target Windows, Linux, and macOS systems.
Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages — Researchers found an Opera GX issue that could allow a hostile site to install a browser mod and access selected data from pages the user later visited.
Flipper Zero firmware development continues with community help — Flipper Devices said Flipper Zero firmware work will continue with a smaller internal team and more community involvement.

AI-led ransomware, extortion payments, and DPRK package poisoning

Sun, 05 Jul 2026 06:00:00 GMT

Threat actors are accelerating operations with automation, extortion playbooks, and software supply-chain targeting. Defenders should focus on resilient backups, payment-risk governance, dependency controls, and rapid detection across developer workflows.

JadePuffer ransomware used AI agent to automate entire attack — Researchers reported that JadePuffer ransomware activity appears to have been run end-to-end by an LLM-based agent, marking a notable shift in how intrusions may be coordinated. The case suggests attackers are using AI to compress timelines and automate decisions across the attack lifecycle.
U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case — A U.S. government organization reportedly paid roughly $1 million after files were stolen and threatened with publication, based on negotiation records and blockchain tracing. The incident highlights how data-theft extortion can create pressure even without widespread encryption.
North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign — North Korean operators associated with Contagious Interview activity published 108 malicious packages and browser extensions across several developer platforms. The campaign shows continued investment in social engineering and dependency-based access paths.

What Is AI Agent Security Testing?

Sat, 04 Jul 2026 06:00:00 GMT

AI agent security testing is the process of evaluating whether an autonomous or semi-autonomous AI workflow can be tricked into unsafe decisions, excessive tool use, data leakage, policy bypass, or actions outside its intended authority. It goes beyond checking model answers. A useful assessment maps the agent's tools, memory, retrieval sources, permissions, approval gates, and production workflows, then tests whether those boundaries hold under realistic pressure. The goal is not to prove that a model can be made to say something strange. The goal is to find whether an agent can do something harmful, expose something sensitive, or create a repeatable business risk.

AI agent security testing in one sentence — AI agent security testing checks whether an AI system that can reason, call tools, use context, remember state, or trigger workflow actions stays inside the boundaries the business expects. The test target is the full operating loop: user input, system instructions, retrieval, tool selection, approval behavior, external APIs, memory writes, and final action.
What makes agents different from normal applications — Traditional applications usually follow explicit code paths. Agents often choose a path at runtime based on prompts, retrieved documents, tool descriptions, memory, and model judgment. That makes them useful, but it also creates new security questions: which tools can the agent call, what data can it see, what instructions can override the task, and how does it behave when sources conflict?
Core attack surfaces to include — A practical test covers direct prompts, indirect prompts hidden in retrieved content, tool descriptions, browser pages, files, memory, API responses, role boundaries, approval gates, and any system that receives agent output. For coding or operations agents, the scope should include shell commands, repositories, tickets, cloud consoles, secrets, and deployment workflows.
What a practical assessment includes — The assessment should begin with an agent map: tools, permissions, data sources, users, environments, and approval requirements. It should then run adversarial scenarios that test prompt hierarchy, retrieval trust, tool selection, authorization, memory persistence, sensitive-data handling, output validation, and recovery behavior. Strong tests are repeatable and tied to business impact.
Evidence and deliverables — Good deliverables include the agent map, tested scenarios, reproduced failures, affected tools or data, screenshots or logs, risk ratings, reproduction notes, fix guidance, and retest criteria. The report should separate confirmed exploit paths from rejected attempts, blocked paths, and theoretical risks that could not be proven inside the approved scope.
When to test an AI agent — Test before production, after adding new tools, after changing model behavior, before expanding permissions, after connecting sensitive data, and before giving agents write access. Also retest after incidents, major prompt changes, retrieval-source changes, and policy updates. Lightweight tests can run continuously; deeper red-team work should happen before major autonomy increases.
How agent testing differs from model evaluation — Model evaluation usually measures whether a model behaves well across a dataset or benchmark. Agent security testing measures whether the product workflow remains safe when the model has context, memory, tools, permissions, and business objectives. The same model can be low risk in a chat-only feature and high risk when connected to code, payments, support actions, or production data.
A minimum test plan for teams starting now — A small team can start with a focused plan: map the agent, list high-impact tools, mark sensitive data sources, create five realistic misuse missions, capture full traces, and retest after each fix. Include at least one direct prompt case, one indirect retrieval case, one authorization case, one tool misuse case, and one memory or persistence case.

AI Red Teaming vs Traditional Pentesting

Sat, 04 Jul 2026 06:00:00 GMT

AI red teaming and traditional penetration testing are complementary, but they are not the same engagement. A traditional pentest usually focuses on technical weaknesses in applications, networks, cloud services, APIs, authentication, and infrastructure. AI red teaming focuses on whether an AI system can be pushed into unsafe behavior across prompts, tools, memory, policies, data boundaries, and workflows. The difference matters because AI failures are often behavioral and contextual. A system can pass a normal web test and still let an agent leak data, misuse a tool, ignore a policy, or act with more authority than the business intended.

The short version — Traditional pentesting asks whether an attacker can exploit software, infrastructure, or configuration weaknesses. AI red teaming asks whether an AI system can be manipulated into unsafe decisions or actions. The first is usually about technical control failure. The second is about model behavior, context trust, tool authority, and policy enforcement under pressure.
What traditional pentesting covers well — A traditional pentest is strong for web vulnerabilities, broken access control, authentication flaws, API abuse, injection, exposed services, cloud misconfiguration, weak secrets handling, and business-logic issues in deterministic workflows. It usually produces clear reproduction steps, affected assets, impact, severity, and remediation guidance.
What AI red teaming covers well — AI red teaming is useful for prompt injection, jailbreak resistance, indirect prompt attacks, tool misuse, data leakage, model overreach, unsafe autonomy, memory poisoning, retrieval poisoning, policy bypass, and harmful output in the product's real context. The best tests use missions, not isolated prompts, because agents fail across steps.
The biggest difference is evidence — Pentest evidence often shows a request, response, payload, permission flaw, or data access path. AI red-team evidence should show the full decision trace: prompt, retrieved context, tool list, tool call, approval state, memory change, final response, and business impact. Without the trace, the team cannot tell whether the fix should be prompt design, permission design, tool design, or workflow design.
When you need both — You need both when an AI feature can access customer data, call internal APIs, browse the web, write to systems, create tickets, run code, change configurations, summarize sensitive records, or influence financial or operational decisions. The underlying app may have classic vulnerabilities, while the agent layer may create new paths through legitimate permissions.
How to scope the engagement — Start by listing the product surfaces, AI features, models, prompts, tools, APIs, retrieval sources, memory stores, user roles, and environments. Decide which actions are safe to test in production and which need a staging environment. Define success criteria for both classic vulnerabilities and AI-specific failures.
What deliverables should look like — A traditional pentest report should list validated vulnerabilities, reproduction steps, affected assets, severity, and remediation. An AI red-team report should also include scenario goals, prompt hierarchy, retrieved context, model decisions, tool calls, approvals, memory changes, blocked attempts, and the final business impact. Both reports should be concise enough for leadership and specific enough for engineering.
How often to run each test type — Run lightweight automated checks continuously, run traditional pentests around major releases or annually for assurance, and run AI red-team work whenever an agent gains new tools, memory, data access, or autonomy. For high-impact agents, keep a regression suite of previous failures and rerun it whenever prompts, models, tools, or policies change.

MCP Security Testing Checklist

Sat, 04 Jul 2026 06:00:00 GMT

Model Context Protocol, or MCP, gives AI applications a standard way to connect with tools, data sources, and services. That makes MCP useful for enterprise agents, developer tools, support workflows, and internal automation. It also creates a security boundary that must be tested. An MCP server can expose sensitive resources, powerful tools, misleading tool descriptions, broad OAuth scopes, or unsafe actions through a friendly interface. This checklist helps teams test MCP implementations before they become a hidden path from prompt to production impact.

Inventory every MCP server, tool, and resource — Start with a complete inventory. List every MCP server, transport, exposed tool, resource, prompt template, connected API, backing service, environment, and owner. Record which tools are read-only, which can modify state, which can access secrets, and which can reach customer, financial, production, or internal data.
Test authorization and scope boundaries — Verify how users authenticate, how consent is granted, how tokens are issued, how scopes map to tools, and whether one user can influence another user's connected resources. For HTTP transports, review the authorization flow, token audience, redirect handling, session binding, revocation, and whether a tool can be called outside the intended user context.
Review tool descriptions as prompt surface — Tool names, descriptions, schemas, examples, and errors are not just documentation. They become model context. Test whether malicious or confusing descriptions can cause the agent to choose a dangerous tool, leak data, ignore user intent, or treat tool-provided text as a higher-priority instruction.
Exercise read, write, and destructive actions separately — Separate tools into read-only, low-impact write, sensitive write, and destructive actions. Test whether the agent can call each class directly, indirectly, repeatedly, or through ambiguous user intent. Sensitive actions should require confirmation, clear target display, policy checks, logging, and in many cases a human approval gate.
Check secrets, files, and data minimization — Test whether tools expose secrets, environment variables, credentials, internal file paths, customer records, system prompts, hidden notes, logs, or oversized data blobs. Limit returned fields, redact sensitive values, enforce resource-level access control, and make sure tool outputs do not include data the model does not need for the task.
Verify logging, replay, and incident response — Log the user, agent, MCP server, tool, arguments, resource identifiers, approval state, result status, and correlation ID for each meaningful call. Test whether security teams can replay a suspicious chain, revoke tokens, disable a tool, rotate affected secrets, and determine which data was exposed.
Validate client-side MCP behavior — The MCP client should clearly present connected servers, tool permissions, sensitive actions, and approval prompts. Test whether the client distinguishes trusted instructions from tool output, warns before high-impact actions, prevents silent server changes, and gives users a way to disconnect or revoke access. Also test how the client behaves when a server returns malformed, oversized, or hostile content.
Validate server-side MCP controls — The MCP server should enforce authorization before every tool call, validate arguments, reject unexpected resources, minimize returned data, rate-limit sensitive operations, and keep durable audit logs. Test negative cases, not only happy paths. A tool should fail safely when the agent asks for a resource, action, or field outside the user's approved scope.

Prompt Injection Testing Guide

Sat, 04 Jul 2026 06:00:00 GMT

Prompt injection testing checks whether untrusted text can override, confuse, or redirect an AI system away from the developer's intended behavior. The risk is broader than jailbreak prompts in a chat box. Modern AI products read documents, websites, tickets, emails, tool outputs, logs, and memory. Any of those inputs can carry instructions that the model may treat as relevant context. A good test program uses safe, controlled scenarios to verify instruction hierarchy, data boundaries, tool permissions, output handling, and recovery behavior without publishing exploit playbooks or relying on one-off prompt tricks.

Define what prompt injection means for your product — Start by defining the expected instruction hierarchy: system instructions, developer policy, user intent, retrieved content, tool output, and memory. Prompt injection testing asks whether lower-trust content can override higher-trust instructions or cause the system to reveal, change, or do something outside the intended task.
Test direct and indirect injection — Direct injection comes from the user prompt. Indirect injection comes from content the system retrieves or reads on behalf of the user, such as documents, pages, tickets, email, code comments, calendar entries, or tool responses. The test plan should include both, because many real failures happen when the user never sees the malicious instruction directly.
Use missions instead of magic phrases — Do not judge security by whether one famous jailbreak phrase works. Build missions that represent realistic product tasks: summarize a hostile document, triage a support case, prepare a code change, search internal data, or decide whether to call a tool. Measure whether the system follows the right authority and preserves boundaries across the full workflow.
Check tool and data boundaries — For tool-using systems, test whether injected instructions can change tool selection, arguments, target resources, approval behavior, or output destination. For data-heavy systems, test whether injected content can make the model reveal hidden context, retrieve unrelated records, include secrets, or combine data across users or tenants.
Evaluate mitigations with retests — Common mitigations include strict tool permissions, retrieval filtering, context labeling, output validation, allowlisted actions, confirmation gates, data minimization, model-independent policy checks, and logging. Retest each mitigation against the original mission and nearby variants to make sure the fix addresses the trust boundary, not just one prompt.
What evidence to keep — Keep the test mission, trusted instructions, untrusted input, retrieved snippets, model response, tool calls, approvals, data returned, logs, and final impact. Mark whether the path was confirmed, blocked, partially successful, or theoretical. Avoid storing sensitive secrets in the report unless they are redacted and necessary to prove impact.
Common failure patterns to watch — Common failures include treating retrieved text as instructions, revealing hidden prompts, summarizing malicious content as trusted fact, calling tools with attacker-selected arguments, copying secrets into output, accepting tool responses as policy, and storing hostile instructions in memory. Track the pattern, not only the exact text that triggered it.
Turn prompt tests into regression cases — Every confirmed prompt injection path should become a regression case with a mission, trusted context, untrusted context, expected safe behavior, and required logs. Rerun those cases when prompts, models, retrieval sources, tools, permissions, or memory behavior changes. Keep the cases safe and focused on boundary validation rather than public exploit text.

How to Evaluate an AI Security Testing Provider

Sat, 04 Jul 2026 06:00:00 GMT

Choosing an AI security testing provider is difficult because the market mixes traditional pentesting, model evaluation, AI safety research, compliance consulting, automated scanning, and red-team services under similar labels. The right provider should understand both software security and AI-specific failure modes. They should be able to test prompts, tools, retrieval, memory, authorization, data access, and workflow impact without turning the engagement into theater. Use this guide to compare providers on the things that matter: scope quality, methodology, evidence, safety controls, reporting, remediation, and retesting. The buyer should leave with confidence that findings will become fixes.

Start with the systems they can actually test — Ask whether the provider can test your real architecture: chat interface, agent tools, APIs, retrieval, vector stores, memory, model gateway, cloud services, authentication, CI/CD, logging, and production workflow boundaries. A provider that only tests standalone prompts may miss the risks that matter most to your product.
Ask for a methodology, not a vibe — A credible provider should explain how they map the system, select scenarios, test instruction hierarchy, evaluate tool use, verify data leakage, measure approval behavior, and separate confirmed findings from noise. They should also describe what they will not test without explicit authorization.
Demand reproducible evidence — Ask to see a sample report structure. Strong reports include scenario description, affected component, trace, tool calls, data accessed, business impact, severity rationale, screenshots or logs, remediation guidance, and retest criteria. They should avoid vague claims like the model was jailbreakable without explaining the real impact.
Check production safety controls — A provider should be clear about safe testing boundaries: rate limits, prohibited actions, staging versus production, test accounts, data handling, destructive actions, payment flows, customer-impacting workflows, and emergency stop conditions. They should document authorization before testing begins.
Look for remediation that engineers can ship — Good remediation is specific. It may recommend narrower tool scopes, approval gates, data minimization, retrieval labeling, output validation, policy checks outside the model, memory controls, better logging, or API authorization changes. The provider should connect each recommendation to the failed path it fixes.
Make retesting part of the purchase — Ask whether retesting is included, how long it remains available, and what evidence will close a finding. Retesting should run the original scenario and reasonable variants after the fix. For agent systems, retesting should also check whether the change created new behavior in nearby workflows.
Questions to ask on a vendor call — Ask which AI attack classes they test, how they handle tool-using agents, whether they can test authenticated workflows, how they avoid unsafe production impact, what evidence appears in the report, how retesting works, and how they separate model behavior from application security. Ask for examples of fixes they have recommended, not only examples of prompts they have tried.
Warning signs when comparing providers — Be careful with providers that promise universal AI safety, rely only on prompt lists, cannot test tools or APIs, avoid discussing production boundaries, provide no sample evidence, skip retesting, or treat every model refusal bypass as a critical issue. Also be careful when a report cannot distinguish confirmed business impact from theoretical concern.

Cloud Pentest Checklist for SaaS Teams

Sat, 04 Jul 2026 06:00:00 GMT

A cloud pentest for a SaaS company should answer one practical question: what could an attacker chain from the public surface into customer data, control-plane access, sensitive infrastructure, or business impact? Cloud testing is not just a port scan, and it is not only a configuration review. The strongest assessments combine external exposure, identity, APIs, storage, secrets, workloads, CI/CD, logging, and product-specific workflows. This checklist helps SaaS teams prepare a useful scope and understand what good evidence should look like. It is written for teams that need practical coverage without slowing normal product delivery. Use it before kickoff, during remediation, and again when cloud architecture changes across accounts and environments.

Map internet-facing exposure first — Start with domains, subdomains, APIs, load balancers, edge services, storage endpoints, admin panels, staging systems, documentation portals, and third-party integrations. Confirm what is intentionally public, what is forgotten, and what should be restricted behind identity, VPN, allowlists, or private networking.
Review identity and access paths — Test authentication, authorization, tenant separation, service accounts, IAM roles, cross-account access, admin workflows, support impersonation, SSO, OAuth apps, and privilege escalation paths. For SaaS products, include both product identity and cloud identity, because real incidents often cross that boundary.
Test APIs and business workflows — Include REST, GraphQL, webhooks, background jobs, file uploads, exports, billing flows, invitation flows, integrations, and admin APIs. Test broken object-level authorization, excessive data exposure, insecure state changes, rate limits, replay behavior, and whether tenant identifiers can be tampered with.
Inspect storage, secrets, and data movement — Review object storage, databases, backups, logs, queues, caches, analytics pipelines, secrets managers, environment variables, build artifacts, and data exports. Test whether sensitive data is public, over-shared, retained too long, copied into logs, or reachable by workloads that do not need it.
Include CI/CD and deployment permissions — Assess source control, CI runners, deployment tokens, container registries, artifact stores, infrastructure-as-code permissions, branch protections, environment approvals, and secret exposure in pipelines. Validate whether a compromised developer account or build job could alter production infrastructure or read sensitive cloud credentials.
Define evidence, safety, and retest criteria — Before testing begins, define safe proof methods, prohibited actions, test accounts, maintenance windows, data-handling rules, severity expectations, and retest requirements. Evidence should show the asset, path, permission, data accessed, impact, and recommended fix without causing unnecessary production change.
What to prepare before the cloud pentest — Prepare domains, cloud accounts in scope, known exclusions, test users, role descriptions, API documentation, architecture diagrams, safe testing windows, escalation contacts, and a list of actions that must not be performed. If staging differs from production, explain the differences so testers do not draw the wrong conclusion from a safer environment.
Turn findings into cloud controls — After the test, convert findings into durable controls: stricter IAM, better tenant checks, storage policies, secret rotation, CI/CD approvals, logging alerts, infrastructure-as-code rules, and regression tests. Assign owners and closure evidence for each fix. Retest the original path and any nearby path that the fix could affect.

Automated Vulnerability Assessment vs Manual Pentest

Sat, 04 Jul 2026 06:00:00 GMT

Automated vulnerability assessment and manual penetration testing are both useful, but they answer different questions. Automation is best for broad, repeatable coverage: exposed services, known vulnerabilities, missing headers, outdated software, common misconfigurations, and regression checks. Manual pentesting is best for context, chaining, authorization, business logic, exploit validation, and evidence that explains real impact. Mature security programs use both. Automation finds and tracks the obvious issues quickly. Manual testing proves whether the important paths are actually exploitable and worth prioritizing. The best result is a repeatable security loop that improves after every release.

What automated vulnerability assessment does well — Automated assessment is useful for frequent checks across many assets. It can identify known CVEs, exposed ports, TLS problems, security-header gaps, dependency issues, common web weaknesses, cloud exposure, and drift from expected configuration. It is fast, consistent, and good for watching change over time.
Where automation falls short — Automation struggles with business context, multi-step authorization, tenant isolation, chained impact, unusual workflows, product-specific logic, and whether a finding is actually exploitable in your environment. It can also create false positives, miss authenticated paths, or rank low-impact issues above risks that matter more to the business.
What manual pentesting adds — Manual pentesting adds hypothesis, creativity, context, and impact validation. A tester can chain weak controls, compare roles, inspect business workflows, review API behavior, test tenant boundaries, use realistic accounts, and stop before unsafe production impact. The output should be fewer findings with stronger evidence.
The best programs combine both — Use automation continuously for coverage and drift detection. Use manual testing for high-risk releases, new product surfaces, authentication changes, payment or admin workflows, cloud architecture changes, AI agent capabilities, and customer-facing assurance. Feed manual findings back into automated regression checks where possible.
How reports should differ — Automated reports should prioritize ownership, asset, evidence, scanner confidence, severity, affected versions, and remediation status. Manual reports should include scenario, reproduction context, business impact, exploitability, affected roles, proof, recommended fix, and retest criteria. Both should avoid dumping long lists without prioritization.
When to choose each option — Choose automated assessment when you need broad recurring coverage, launch checks, hygiene monitoring, and fast feedback on known issue classes. Choose manual pentesting when you need confidence in critical workflows, compliance evidence, customer assurance, complex authorization, cloud attack-chain analysis, or AI agent behavior.
Use automation before the manual test — Run automated checks before a manual pentest to clean up obvious issues, confirm scope, identify exposed assets, collect version data, and highlight areas that deserve deeper review. Share the automation output with testers so they can spend less time on hygiene and more time validating chains, authorization, and business impact.
Close the loop after testing — After a manual finding is fixed, add an automated check when the condition is measurable. That might be a configuration rule, dependency alert, API authorization test, cloud policy check, or regression scenario. Keep manual retesting for complex workflows where automation cannot safely prove impact on its own.

Daily Security Brief: Kernel Risk, Supply Chain Malware, and Phishing Kits

Sat, 04 Jul 2026 06:00:00 GMT

Today’s reporting highlights risk across core infrastructure, developer ecosystems, and identity platforms. Teams should prioritize patch visibility, dependency controls, phishing resistance, and monitoring for compromised edge and consumer-linked devices.

New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android — A Linux kernel vulnerability dubbed Bad Epoll can allow local unprivileged users to gain root-level control, with impact spanning servers, desktops, and Android-based systems. Fixes are reportedly available.
New Avalon Malware Framework Packs CrownX Ransomware Capabilities — Researchers identified Avalon, a modular malware framework delivered through phishing and designed to combine credential theft, remote access, movement across environments, and ransomware-like disruption.
Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices — Seven vulnerabilities were disclosed in FatFs, a lightweight filesystem library widely used in embedded products to handle FAT and exFAT storage media. The findings may affect many devices because the component is broadly bundled into firmware.
NetNut proxy network disrupted, 2 million infected devices cut off — A coordinated disruption involving Google reportedly severed NetNut’s access to around two million compromised Android devices used in a residential proxy network. Affected devices included smart TVs and streaming hardware.
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets — North Korea-linked actors were tied to malicious npm packages impersonating Rollup-related polyfill tooling, with the goal of enabling access and stealing developer secrets.
ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit — A phishing-as-a-service platform called ARToken appears connected to EvilTokens and exposes tooling focused on Microsoft 365 credential and session theft campaigns.
Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer — A newly described actor, Armored Likho, has been linked to campaigns against government and power-sector organizations in Russia, Brazil, and Kazakhstan, using a stealer known as BusySnake.

Daily Brief: Ransomware Access Paths, Secret Cleanup, and IoT Exposure

Fri, 03 Jul 2026 06:00:00 GMT

Today’s risk theme is operational exposure: unpatched edge systems, leaked credentials, and trusted developer workflows are being used to accelerate compromise. Teams should prioritize KEV-driven patching, secret remediation at scale, tighter third-party access controls, and safer handling of public exploit code.

Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials — Ransomware affiliates linked to Anubis are reportedly abusing Citrix Bleed 2 for initial access while also using legitimate remote management tools, vulnerable drivers, and supply chain credentials to move through environments.
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack — Researchers describe a ransomware incident where an AI agent allegedly automated much of the intrusion lifecycle after abusing a Langflow remote code execution flaw.
New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos — A malware campaign dubbed ChocoPoC is targeting vulnerability researchers with fake GitHub proof-of-concept repositories that install a data-stealing remote access trojan.
Gardyn IoT Hub — CISA warns that several Gardyn IoT Hub components contain vulnerabilities that could let unauthenticated users access or control managed devices.
ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories — This roundup highlights a broad set of current issues, including AI compute abuse, email security weaknesses, ransomware activity, browser risks, bot activity, and sandbox gaps.
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation — CISA added Microsoft SharePoint Server CVE-2026-45659 to its Known Exploited Vulnerabilities catalog after reports of active exploitation in the wild.
How GitHub used secret scanning to reach inbox zero — GitHub shared how it reduced more than 20,000 secret scanning alerts across 15,000 repositories by separating high-value findings from noise and building repeatable remediation workflows.

Daily Security Brief: Exploited Enterprise, AI, and ICS Flaws

Wed, 01 Jul 2026 06:00:00 GMT

Attackers are moving quickly on newly disclosed flaws in internet-facing business platforms, with activity ranging from cryptomining to ransomware and data theft. AI agent ecosystems also remain a growing risk area as researchers show how tool metadata and command handling can be abused.

Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints — Exposed Langflow instances are being targeted through a critical unauthenticated remote code execution flaw to install Monero mining malware. The activity highlights continued attacker interest in AI application infrastructure left reachable from the internet.
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer — A critical SimpleHelp authentication vulnerability is being exploited to deliver newly reported malware families known as TaskWeaver and Djinn Stealer. Remote support tools remain high-value targets because they often provide broad access into managed environments.
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild — A critical Oracle E-Business Suite vulnerability affecting Oracle Payments is reportedly under active exploitation. The issue involves authentication and privilege management weaknesses in a high-value enterprise financial platform.
Frangoteam FUXA SCADA/HMI — CISA warned that affected Frangoteam FUXA SCADA/HMI deployments can expose user and role information to unauthenticated remote attackers. The issue affects versions up to and including 1.3.1.
Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data — Microsoft research warns that malicious Model Context Protocol tool descriptions can influence AI agents into leaking enterprise data. The risk comes from agents trusting tool metadata while acting with user-granted permissions.
GuardFall Exposes Open-Source AI Coding Agents to Decades-Old Shell Injection Risks — Research on GuardFall shows that AI coding agents can still be exposed to long-known shell injection patterns despite safety checks. The findings reinforce that agent guardrails should not be treated as a substitute for secure execution design.
CISA: Windows BlueHammer flaw now exploited by ransomware gangs — CISA says ransomware groups are exploiting the Windows BlueHammer privilege escalation flaw affecting Microsoft Defender. The vulnerability has a history of zero-day abuse and is now tied to ransomware operations.

Daily Security Brief: Exploited Enterprise Apps and Appliance Bugs

Tue, 30 Jun 2026 06:00:00 GMT

Today’s risk picture is dominated by actively exploited flaws in business-critical software, remote support tools, endpoint security, and edge appliances. Teams should prioritize exposed systems, confirm patch status, and tighten monitoring around admin and finance platforms.

CISA Adds One Known Exploited Vulnerability to Catalog — CISA added CVE-2026-48558, a SimpleHelp authentication bypass issue, to its Known Exploited Vulnerabilities catalog after confirming active abuse.
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild — The Hacker News reports that CVE-2026-46817 in Oracle E-Business Suite is being exploited, affecting Oracle Payments through authentication and privilege management weaknesses.
Hackers now exploit critical Oracle E-Business flaw in attacks — BleepingComputer also covers active attacks targeting the critical Oracle E-Business Suite flaw, citing threat intelligence that exploitation has started in the wild.
Inside the Advisory Database and what happens when vulnerability volume breaks records — GitHub Security describes the growing volume of vulnerability reports handled by its Advisory Database and the pressure this creates for maintainers and security teams.
CISA: Windows BlueHammer flaw now exploited by ransomware gangs — BleepingComputer reports that CISA confirmed ransomware groups are exploiting the Windows Defender privilege escalation flaw known as BlueHammer.
Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth — The Hacker News reports a critical Progress Kemp LoadMaster vulnerability that could allow unauthenticated command execution with root-level impact on affected appliances.
Critical SimpleHelp flaw exploited to deploy new stealer malware — BleepingComputer reports that attackers are exploiting the SimpleHelp flaw to distribute newly observed stealer malware across Windows, macOS, and Linux systems.

Agentic Harnesses: The Control Room for AI Security Testing

Mon, 29 Jun 2026 06:00:00 GMT

Agentic systems do not fail like normal software: they improvise, chain tools, mutate context, and create risk across steps. A strong harness gives teams the control room they need to observe every decision, replay failures, and turn agent behavior into security evidence.

A harness is the flight recorder for agent behavior — A serious agentic harness captures prompts, model outputs, tool calls, retrieved context, approvals, denials, memory writes, and final actions as one linked trace.
Tool calls are the blast radius — The dangerous part of an AI agent is rarely the sentence it writes. The dangerous part is the action it can take through tools, APIs, browsers, shells, tickets, email, and data stores.
Replay is where security becomes engineering — When an agent makes a risky decision once, the harness should preserve the full scenario so the team can replay it against new prompts, policies, models, and tool configurations.
The best harnesses separate autonomy into lanes — Not every agent action deserves the same freedom. Read-only analysis, low-risk drafting, customer-visible changes, production writes, and security-sensitive actions should run through different lanes.
Scoring must measure decisions, not just outputs — A flashy answer can hide a risky path. Agentic harnesses should score whether the agent chose the right tools, respected boundaries, handled uncertainty, and stopped when confidence was low.

Flash Harnesses: Red-Team Loops for Agentic AI

Sun, 28 Jun 2026 06:00:00 GMT

The next generation of AI security testing will not be a prompt spreadsheet. It will be a flash harness: a compact red-team loop that throws realistic pressure at an agent, records the full decision chain, and turns unsafe behavior into repeatable tests.

Start with missions, not prompts — A prompt only tests one input. A mission tests the full agent workflow: objective, context, tools, constraints, user pressure, policy boundaries, and final decision.
Inject pressure without handing over exploit steps — Flash harnesses should simulate urgency, ambiguity, conflicting instructions, sensitive data requests, and tool misuse attempts without publishing procedural abuse playbooks.
Every approval gate should emit a signal — When an agent asks for human approval, skips approval, or gets denied, the harness should preserve the reason, context, tool target, and downstream outcome.
Memory is a live attack surface — Agent memory can preserve preferences, instructions, retrieved facts, user history, and operational context. That makes it useful, but also worth testing like a stateful security boundary.
Ship the kill switch before the demo gets loud — The harness should prove that teams can pause an agent, revoke a tool, roll back a risky path, and preserve evidence without improvising during an incident.