Collaborate Disseminate
An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent.
… Continue reading Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs
Every patch is a confession.
The moment a vendor ships a security fix, the diff between the old code and the new code tells anyone watching exactly what was broken and where. Turn that diff back into a working exploit, and you can hit every system tha… Continue reading N-day is Becoming N-Hour. Patching Faster Won’t Save You.
A cloud tenant using nothing but ordinary GPU access can push a data center’s power draw up and down fast enough to threaten the grid it runs on, with no exploit and no break-in.
That is the claim behind Bit2Watt, described by three Zhejiang Universit… Continue reading New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit
Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites.
The two security flaws, tracked as CVE-2026-6303… Continue reading WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER, the AI-agent-driven operator it first documented earlier this month.
The same operator has now been spotted deploying ENCFORGE, a new compiled Go ransomware d… Continue reading New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack
Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber.
In a post shared on X, the threat intelligence firm said it’s observing in-the-wild exploitation of CVE-2026-687… Continue reading Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as par… Continue reading FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live… Continue reading Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050.
Group-IB, which named… Continue reading HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools.
The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and pu… Continue reading ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More