Security · Top stories
New Rust-based Gaslight Malware Targets macOS with AI Disruption Techniques
A new macOS malware, codenamed Gaslight, uses prompt injection techniques to evade AI analysis. Linked to North Korean threat actors, the malware embeds fabricated system-failure messages to disrupt AI-assisted triage efforts.
DoJ Seizes Huione Cloud Account Linked to Cryptocurrency Fraud
The U.S. Department of Justice has seized a Huione Group cloud account used for money laundering linked to various cyber scams. This action, which follows new sanctions against related entities, aimed to disrupt significant financial networks facilitating fraudulent activities connected to cryptocurrency.
AWS Security Agent enhances features with threat modeling and code review updates
AWS Security Agent, part of AWS Continuum, now includes threat modeling, advanced code reviews, and support for multiple code repositories. These updates aim to enhance application security throughout the development lifecycle by offering context-aware analysis and vulnerability remediation.
Service Desk Identity Verification Weaknesses Undermine Strong Login Security
Organizations often rely on knowledge-based questions for service desk identity verification, creating a security gap that bypasses stronger login protections like MFA. Attackers use publicly available information and social engineering, increasingly aided by AI, to impersonate employees and gain account access through password resets or MFA device registration. This vulnerability is significant as stolen credentials are a major factor in data breaches, and NIST guidelines no longer recommend knowledge-based authentication.
Delta Investigates Fake Wi-Fi Network Incident on Flight from Las Vegas
Delta Air Lines is investigating an incident on Flight 591 from Las Vegas to Atlanta where an unauthorized Wi-Fi network, allegedly created by a passenger, appeared mid-flight. The network, named "Delta WiFi Fast," reportedly spoofed the legitimate in-flight Wi-Fi and may have attempted to phish for credentials, leading pilots to alert air traffic control and temporarily disable the aircraft's Wi-Fi.
Internet-Exposed Synology NAS Hit by Ransomware Due to Unpatched 18-Month-Old Flaw
A Reddit user's Synology DS918+ NAS was encrypted by ransomware after being exposed to the internet with an 18-month-old unpatched remote code execution vulnerability (CVE-2024-10441). The incident highlights risks of direct internet exposure and issues with Synology's update notifications for older devices.
CrowdSec Reports Source Code Leak from May 2026, Attributes to Tanstack Compromise
CrowdSec confirmed a source code leak from May 2026 involving its private GitHub repositories, which contained code for its SaaS console, AWS routines, connectors, and automations. The company states no client data or sensitive credentials were leaked, and the incident's impact is limited to CrowdSec, with the Tanstack compromise identified as the likely vector.
Levi Strauss & Co. Reports Corporate Data Exfiltration After Social Engineering Attack
Levi Strauss & Co. disclosed that hackers accessed and exfiltrated corporate information from three employee computers through a social engineering attack. The company stated that the incident did not disrupt business operations and found no evidence of consumer data exposure, but the specific corporate data taken was not disclosed. The company believes the incident will not materially impact its business.
Analog Devices Discloses Data Breach, Files Exfiltrated
Semiconductor company Analog Devices reported a data breach detected on June 23, where an unauthorized party accessed systems and exfiltrated certain files. The company stated that operations were not disrupted and the incident is not expected to materially impact its business, though it is also assessing public reports of a separate cybersecurity matter from July 26.
DKIM Replay Attacks Persist Despite Key Rotation; DNS Cleanup is Crucial
Email administrators are encountering persistent DKIM replay attacks even after rotating their DKIM keys. This occurs because DKIM signatures, once valid, remain valid for unchanged messages, allowing attackers to re-send legitimate, signed emails from their own servers. Addressing this requires a specific DNS cleanup step often omitted from standard key rotation guidance.
OpenAI Employee Pleads Not Guilty to Planting Listening Device
Abdulrahman Alfozan, an OpenAI employee and venture partner at Raed Ventures, pleaded not guilty to charges of planting a listening device in an OpenAI executive conference room. He faces a maximum of five years in prison if convicted, amidst growing concerns over AI technology theft.
SS7 and Diameter Signaling Flaws Enable Tracking, Interception, and Impersonation
SS7 and Diameter signaling protocols, used in 2G/3G and 4G/5G networks respectively, contain vulnerabilities that allow attackers to track, intercept, and impersonate mobile users. These flaws stem from a lack of robust authentication in the protocols, enabling various attacks including intercepting two-factor authentication codes and locating individuals.
Passkeys Improve Authentication Security, But Do Not Eliminate Identity Risk
Passkeys, built on public-key cryptography, offer a significant improvement over passwords by providing phishing-resistant authentication and protecting against credential theft. While passkeys strengthen the authentication process, they do not address broader identity security concerns such as compromised accounts or untrustworthy devices. Organizations should adopt passkeys for stronger authentication but recognize that identity risk extends beyond successful login.
AI Agents Operate in Browsers via Debugging Interfaces, Extensions, and Agentic Browsers
AI agents are increasingly operating within employee browsers through methods like the Chrome DevTools Protocol, browser extensions, and dedicated agentic browsers. This development poses new security challenges as these agents can access authenticated sessions and perform actions that may not be detectable by current security tools. Organizations need to understand these methods to assess risks and implement appropriate controls.
Unused Access Keys Pose Security Risk Due to Lack of Lifecycle Management
Unused and forgotten access keys for non-human identities, such as those for defunct projects or departed personnel, create significant security vulnerabilities because they do not expire automatically. This issue highlights a critical gap in identity and access management, as these lingering credentials can be exploited by attackers much faster than traditional audit cycles can detect them.
Manipulated Inputs Can Bypass Robot Safety Systems, VicOne Research Shows
VicOne LAB R7 research demonstrates that robots can misinterpret their environment or receive false instructions through manipulated inputs, leading to unintended and potentially unsafe behaviors even when safety functions are active. This highlights a vulnerability where adversarial inputs can compromise robot safety systems that rely on accurate sensor data and commands.
AI Generates More Convincing Fake Login Pages, Increasing Account Takeover Risk
Generative AI is making it easier for attackers to create realistic fake login pages and tailor phishing campaigns. These AI-assisted pages can capture credentials, MFA codes, and hijack authenticated sessions, leading to increased account takeovers.
Citrix NetScaler Zero-Days Highlight Modern Edge Defense Effectiveness
Citrix released emergency patches for eight remote code execution vulnerabilities (CVE-2026-88771 to CVE-2026-88778) in NetScaler ADC and Gateway after active exploitation was detected. This event demonstrates how consolidated edge devices are high-value targets, but also how improved threat intelligence and rapid patching represent a stronger defensive posture in enterprise security.
PHP Vulnerabilities Highlight Internet Infrastructure Fragility Amidst AI Advancement
Recent critical vulnerabilities in PHP required immediate patching or site takedowns, exposing the internet's reliance on often-fragile open-source components. This incident raises concerns about how widespread AI tools could accelerate the discovery and exploitation of such weaknesses in foundational internet infrastructure.
AI Training with Stolen Trade Secrets Leads to Federal Court Injunction
A recent federal trade secrets case in the U.S. District Court for the Northern District of California involved a former employee using stolen proprietary information to train an AI agent to create a competing business. The court granted a temporary restraining order and preliminary injunction, recognizing the AI agent as an "existential threat" due to the irreversible contamination of AI models by trade secrets. This case highlights new risks for companies regarding AI-driven misappropriation and the challenges of proving AI models are free of proprietary information once exposed.
AI Tools Accelerate Vulnerability Discovery, Raising Cybersecurity Concerns
AI-powered tools are enabling the rapid discovery of vulnerabilities in critical internet infrastructure, leading to increased anxiety among cybersecurity experts. This development suggests a potential shift in the landscape of cyber threats, as AI agents become more adept at identifying and exploiting previously unknown bugs.
Underfunded Open-Source Projects Pose Significant Security Risks
A report highlights that many critical open-source projects, foundational to modern software, are severely underfunded and understaffed, with 11 out of 23 surveyed projects having only one or two maintainers. This lack of resources increases the risk of vulnerabilities and exploits, as demonstrated by past incidents like Heartbleed, Shellshock, and Log4Shell.
Security Teams Face Challenges Managing 'Wild Code' Created by Employees
The proliferation of employee-built AI-assisted workflows and applications, termed 'wild code,' is creating new security risks for organizations. These tools often operate with excessive permissions, expose sensitive data, or lack clear ownership, posing challenges beyond traditional software security concerns.
Underground Market for KYC Services Facilitates Identity Fraud
The operator of OnlyFake pleaded guilty in the US for creating over 10,000 fraudulent digital identity documents, enabling cybercriminals to bypass identity checks and launder money. Underground markets offer manipulated documents, deepfakes, and live verification assistance to circumvent Know Your Client (KYC) processes.
Salesforce Agentforce Vulnerability Exposes Internal Agent Instructions to External Users
Salesforce's Agentforce, when combined with Email-to-Case and Web-to-Case features, creates a path for unauthenticated external users to access and influence internal agent instructions. This vulnerability arises from the interaction between existing platform features and new agent capabilities, rather than a misconfiguration of the agent itself. The issue highlights a gap in governance and security reviews for agents integrated into established platforms.
Typo-squatting Attacks Using Homoglyphs Remain Viable Against Major Domains
Researchers demonstrated that specific combinations of Unicode characters can still bypass browser protections against typo-squatting, even in Chromium which has advanced rulesets. This is due to edge cases involving Cyrillic characters that resemble Latin letters but are not on existing blocklists, allowing malicious actors to create deceptive URLs.
Undersea Internet Cables Face Increased Sabotage Risk Amid Global Tensions
A new book highlights growing sabotage risks to undersea internet cables and pipelines due to increased gray-zone warfare and conflicts. While most damage is accidental, recent incidents involving ships dragging anchors are under scrutiny as potential deliberate acts, raising concerns about critical infrastructure vulnerability.
VEX Documents Address Inaccurate Vulnerability Reports in Software Supply Chains
The article discusses how Vulnerability Exploitability eXchange (VEX) documents can help system administrators and security teams manage the influx of vulnerability reports. VEX statements clarify whether a specific software product is actually affected by a known vulnerability, reducing false positives from SBOM-based scanning. This approach helps maintainers and security teams prioritize actual threats and avoid unnecessary patching.
AI Agents Inherit User Permissions and Lack Audit Trails When Using Borrowed Credentials
An investigation into AI agents using human credentials revealed that agents inherit all user permissions, leading to significant permission scope variations and a lack of audit trails in critical environments. This practice, common in development, creates security vulnerabilities by obscuring agent actions and making revocation difficult.
OAuth Grants Pose Significant Security Risks Due to Lack of Governance and Lifecycle Management
OAuth grants create standing trust relationships between applications, often without proper IT and security oversight, leading to thousands of unmanaged access paths to corporate data. These grants operate outside traditional identity controls like SSO and MFA, persist even after user credentials are disabled, and can remain dormant but valid, making them a target for attackers.
Ransomware Groups Target Backups to Increase Pressure for Ransom Payments
Ransomware groups are increasingly targeting and destroying backup infrastructure to prevent data recovery and force victims to pay ransoms. This tactic has been observed in attacks by groups like ALPHV/BlackCat, BlackMatter, and Gunra, highlighting a critical shift in ransomware strategy. Organizations must re-evaluate backup strategies to ensure isolation and protection from compromised credentials.
CISO Report: Cyber Risk Shifts to Workflow, AI Governance, and Human Factors
The 2026 Voice of the CISO report indicates a shift in cyber risk, moving closer to daily workflows, AI governance, and human risk factors. This change requires security leaders to focus on protecting sensitive data within people, cloud platforms, collaboration tools, SaaS applications, and AI-enabled workflows, rather than solely on external threats.
Technology Solutions Emerge to Combat Social Engineering, Including AI Deepfakes
Social engineering remains a significant and successful attack vector, with traditional security awareness training proving ineffective against increasingly sophisticated methods, including AI deepfakes. New technological approaches are being developed to detect social engineering in live conversations, moving beyond human detection limitations. This shift addresses the rising financial and data loss from social engineering attacks, exemplified by recent high-profile breaches.
Credential Layer Expansion Outpaces Security Visibility Amidst Accelerating Software Production
The rapid acceleration of software production, evidenced by a significant increase in GitHub commits, is causing the credential layer to expand faster than security teams can monitor it. This growth leads to more exposed credentials, with GitGuardian detecting 28.65 million new hardcoded secrets in public GitHub commits in 2025, highlighting a critical need for enhanced visibility and security measures.
C2PA Timestamping Vulnerability Allows Manipulation of Content Authenticity
A vulnerability in the C2PA specification allows for the manipulation of content timestamps, even when a trusted Time Stamp Authority (TSA) is used. This "spec footgun" enables attackers to create content that appears to predate its actual creation, undermining the authenticity guarantees of C2PA.
Zero Trust Architectures Vulnerable to Day-One Human Error and Fraudulent Identities
Zero Trust architectures face vulnerabilities from human error during onboarding and service desk processes, particularly when establishing initial trust for new users. Attackers exploit these gaps by using fraudulent identities to gain access to corporate networks, bypassing subsequent security controls. Organizations must implement robust identity verification during hiring and throughout employment to counter these threats.
Financial Services Face Increased Software Supply Chain Vulnerability Risks
Financial services companies are facing new pressures to modernize their software supply chains due to advanced AI models that can rapidly exploit dormant vulnerabilities. Historically, these firms accepted vulnerability backlogs for stability, but exploitation has now surpassed phishing as the primary initial access vector for breaches in the sector. This shift necessitates a re-evaluation of long-standing risk management strategies.
Elder Fraud Cases Rise, Fueled by Personal Data Exposure and SIM Swaps
Elder fraud cases in the US are increasing, with 72% of 2024 cases linked to exposed personal data and resulting in $4.2 billion in losses. Scammers use publicly available information and SIM swaps to impersonate family members in messaging apps, gaining access to sensitive data and two-factor authentication codes. Protecting family members involves minimizing online personal data, enabling two-factor authentication, and being aware of scam tactics.
CRA Compliance Requires Embedding Security Controls in Software Development
The Cyber Resilience Act (CRA) necessitates that organizations integrate security controls directly into their software development lifecycle, rather than treating it solely as a policy or reporting task. Effective compliance depends on the ability of software delivery systems to consistently produce and prove reliable security outcomes. This shift requires moving beyond ad-hoc security practices to standardized and enforced controls within the codebase and build processes.
Browser-Based Attack Techniques Evolve with Phishing and Malicious Copy-Paste
Browser-based attacks are increasing, with phishing and malicious copy-paste (ClickFix) identified as leading threats. These techniques bypass traditional security measures by intercepting live sessions, using diverse delivery methods, and exploiting user actions to install malware.