ls ./archive --page 9
Claude Security now scans code with Mythos 5, the model Anthropic keeps most tightly restricted. Customers never touch it; they get findings with a CWE category, severity, confidence and a suggested patch. Alongside it, a $35 million fund pays open-source maintainers in Claude credits. The whole design is a bet that findings can be shared when the capability cannot.
ShinyHunters registered a fake ReliaQuest SSO page and rang staff one by one, each time impersonating a named colleague from the security team. One person typed their password and approved the push. ReliaQuest says the attackers got view-only access to an Okta dashboard and nothing else — and the interesting part is which controls held.
CVE-2026-21962 is a CVSS 10.0 flaw in Oracle's HTTP Server and WebLogic proxy plug-in. Oracle patched it on 20 January. Exploit code appeared on 22 January and a honeypot logged attacks the same day. CISA added it to the Known Exploited Vulnerabilities catalog on 24 August with a due date of 27 August — and under a directive nobody noticed replacing the old one, agencies now have to check whether they were already breached.
Broadcom shipped 91 vulnerability fixes for the Spring framework in one release, including a critical flaw in Spring Security's embedded LDAP server. The count went 22, then 16, then over 200. The jump is attributed to Broadcom putting AI on the problem, which is the same capability the attack stories run on, pointed the other way.
The Dutch Data Protection Authority found Uber suspended driver accounts — sometimes permanently — through automated decisions with no human review, and did not tell drivers it was happening. The violations run from 2018 to 2022. It is the authority's fourth fine against the company, and Uber is appealing.
The Telegraph reported on 22 August that a small British generator was shut down for four days in July, and the coverage that followed called it Iran-linked. Neither the government nor the NCSC has confirmed that, the plant has not been named, and the CEO of Dragos is publicly warning that this is exactly the situation false flags are built for.
Zimperium's analysis of ToxicPanda 2.0 describes malware that claims the VPN permission, filters the device's own traffic, and blocks Google Play and Play Services so security updates and app verification cannot run. It targets 349 apps across 16 countries and supports 167 remote commands.
Cisco Talos found an exposed directory belonging to UAT-10147 and pulled out target lists of roughly 170,000 URLs, AI tooling across the whole attack lifecycle, and a cross-platform implant called SPECTRE that unlinks EDR callbacks in the kernel using two vulnerable drivers from 2019 and 2021.
Anthropic's status page logged elevated errors across multiple models, Opus 5 among them, from 05:06 UTC on 24 August, with the cause identified 21 minutes later. The API, Claude Code, claude.ai and Cowork all showed partial outages. It is the second multi-model incident in four days, and the 90-day uptime numbers are where the pattern shows.
The DoJ and FTC sued TikTok and ByteDance in August 2024 over children's privacy. The settlement is $300 million now and $100 million more once a court vacates the consent decree entered against Musical.ly, TikTok's predecessor — the order from the 2019 case that was supposed to stop this happening again.
KB5121003 broke several games with access violation errors and restarts. Microsoft traced it to drivers with filenames like inpoutx64, installed by peripherals and internal components with RGB lighting. The workaround being shared is to delete a service and remove the file from the Windows drivers folder.
Marcus Hutchins at Expel picked apart SynkLoader, pushed through Microsoft Teams by attackers posing as the IT help desk and hosted on Azure so the download looks legitimate. Its PhishLocker module paints a convincing Windows 11 lock screen to harvest the password. It is a borderless full-screen app, and Alt+Tab exposes it.
MalwareHunterTeam spotted the technique in July and SOCRadar says it is still running. A phishing ZIP drops a shortcut file, the shortcut connects to an FTP server and takes commands from the greeting banner, and either E4del or PINHOLE lands. Novel — and SOCRadar notes that being novel is also what makes it visible.
Truffle Security spent four years pulling AWS keys out of repositories, Git history, Docker images and CI logs. Of the ones it could fully verify, 88% still authenticated this month. The median key was five years old, the oldest 17.4, and only 13.7% had ever been rotated.
Two critical bugs in TrueConf Server, patched in June, are being used by Head Mare to plant PhantomCore. Kaspersky says the attackers replaced a server file with a web shell and pushed malicious client installers. CISA added both to its exploited catalogue on 20 August with two different deadlines.
isolated-vm is how a lot of Node applications run untrusted JavaScript without a container. EndorLabs found its ExternalCopy path iterates a transfer list twice and trusts the earlier pass, so a JavaScript getter returning different values each time can point the native layer at attacker-chosen memory. Fixed in 6.2.0 and 7.0.1.
Adversa AI encrypted its instructions so guardrails saw only harmless-looking ciphertext, then let the model's own code sandbox decrypt and execute them. It reported the technique to xAI on 3 June, chased twice, got no reply, and published. Grok still falls to it, including zero-click exfiltration through tool use.
Abnormal found iAuthFlow V2 selling for $10,000 on Russian-language forums. During the phishing flow it silently registers an attacker-controlled passkey on the victim's account. Passkeys are independent of the password, so the standard remediation — reset, revoke sessions — leaves the intruder logged in.
TrendAI found 14 npm packages posing as calendar utilities and carrying RedC2 4.0, a Linux implant sold on Hack Forums. There is no install hook: the payload launches when the module loads, so one transitive import runs it. The framework's Red Agent turns natural-language prompts into intrusion command sequences.
Nine vulnerabilities across Crosswork and Secure Workload, five of them scoring a maximum 10.0, including two separate authentication bypasses and a SQL injection. None are known to be exploited. All came out of Cisco's own internal review, which is the second such batch in a fortnight.
Kaspersky found previously unknown malware on Android head units running DoFun, delivered through the legitimate update mechanism of a system app over an MQTT broker. It checks in every 90 minutes, runs ad fraud, and is attributed with high confidence to the group behind the BADBOX botnet.
Check Point's Jiří Vinopal reverse-engineered BTR.sys, the Boot Time Removal Tool inside Defender, and showed it can be loaded to delete Defender itself in the window after the filesystem comes up but before the antivirus does. Microsoft says it needs admin rights already, so no patch is planned.
Four years after AcidRain wiped thousands of satellite modems on the day Russia invaded Ukraine, Viasat says it has spent a year with Atalanta validating that its network is more resilient. The technique is mathematical software analysis. The announcement contains an endorsement, an ambition, and no measured result.
WMIC is not vulnerable. It is a signed Microsoft binary that does exactly what it says, which is why ransomware uses it to delete shadow copies, uninstall antivirus and add Defender exclusions. Deprecated in 2016, finally gone from Windows 11 24H2 and 25H2 — a decade, because you cannot patch a tool that works.