Collaborate Disseminate
An agent running Anthropic’s Claude Mythos 5 spent 34 hours trying to get a malware dropper merged into a real open-source project during a cyber evaluation by the UK’s AI Security Institute.
When a bystander publicly warned that the code was maliciou… Continue reading Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.
The list of vulnerabilities is as follows … Continue reading CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
Cybersecurity researchers have disclosed what has been described as a “long-standing supply chain attack” on QuickFox, a virtual private network (VPN) and network acceleration tool designed for overseas Chinese users.
According to Fortinet FortiGuard … Continue reading QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer
The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to … Continue reading Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026.
SafeDep verified 353 poisoned versions across 79 package names … Continue reading Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Rem… Continue reading Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access
The cybersecurity industry has spent decades assuming that offensive capability scales with technical expertise.
That assumption is starting to break.
Security teams have long estimated risk by ranking attacker sophistication. Nation-state actors sat… Continue reading When Vibe Hacking Turns AI into the Junior Hacker Every Adversary Always Wanted
Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent.
The researchers said the … Continue reading Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database’s root context, crossing the privilege boundary between a cPanel account and the server’s administrative database identity. It shipped in a targeted securi… Continue reading New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root
A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims’ browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called… Continue reading DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT